CVE-2023-49274

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this...

Default credentials

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this...

CVE-2023-42571

Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the Samsung Account password with SMS verification when user lost the device...

CVE-2023-5693

A vulnerability was found in CodeAstro Internet Banking System 1.0 and classified as critical. This issue affects some unknown processing of the file pagesresetpwd.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been...

PT-2023-32266 · Unknown · Codeastro Internet Banking System

Name of the Vulnerable Software and Affected Versions: CodeAstro Internet Banking System version 1.0 Description: A critical issue affects the processing of the file pages reset pwd.php, where the manipulation of the email argument leads to sql injection. The attack can be initiated remotely...

PT-2023-32268 · Unknown · Codeastro Internet Banking System

Name of the Vulnerable Software and Affected Versions: CodeAstro Internet Banking System version 1.0 Description: A cross-site scripting issue was found in the CodeAstro Internet Banking System, affecting an unknown functionality of the file pages reset pwd.php. The manipulation of the email...

U.S. Dept Of Defense: Full account takeover of any user through reset password

A vulnerability was reported that allowed full account takeover on a website. By requesting a password reset, the temporary password was disclosed in the request, allowing unauthorized access to any user account. Remediation was suggested to prevent disclosure of temporary passwords...

CVE-2023-38877

A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 April 2023. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server...

CVE-2023-38875

A reflected cross-site scripting XSS vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'validator' parameter in '/reset-password'...

CVE-2023-38876

A reflected cross-site scripting XSS vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' parameter in '/reset-password'...

PT-2023-26654

Name of the Vulnerable Software and Affected Versions msaad1999's PHP-Login-System version 2.0.1 Description A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in the web browser of a user. This is achieved by including a malicious payload into the...

CVE-2023-38875

A reflected cross-site scripting XSS vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'validator' parameter in '/reset-password'...

CVE-2023-36472 Strapi may leak sensitive user information, user reset password, tokens via content-manager views

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...

CVE-2023-35134

CVE-2023-35134 affects Weintek Weincloud v0.13.6, where an attacker could reset an account’s password using only the JWT token. The ICS advisory notes an authenticated/remote exposure with the account API; CISA recommends upgrading to the fixed account API version (v0.13.8) and applying standard ...

Insufficient Session Expiration

serenity.net.web is vulnerable to Insufficient Session Expiration. A link contains a token that could be used to reset a password, but it has a three-hour expiration date and is given as a query parameter. If the attacker has access to the browser history, they can use the token once more to obta...

HackerOne: Banned user still able to invited to reports as a collabrator and reset the password

A security vulnerability allowed a permanently banned user to still be invited as a collaborator to reports and reset their password, despite being restricted from accessing any account features or reports...

CVE-2022-35850

An improper neutralization of script-related HTML tags in a web page vulnerability CWE-80 in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting XSS attack via the...

LDAP Tool Box Self Service Password v1.5.2 - Account takeover

Exploit Title: LDAP Tool Box Self Service Password v1.5.2 - Account takeover Date: 02/17/2023 Exploit Author: Tahar BENNACEF aka tar.gz Software Link: https://github.com/ltb-project/self-service-password Version: 1.5.2 Tested on: Ubuntu Self Service Password is a PHP application that allows users...

CVE-2023-0940

The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones...

Combodo iTop 安全特征问题漏洞

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. A security signature issue vulnerability exists in Combodo...