Statamic framework Incorrect Permission Assignment

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc...

Cloud Foundry UAA reset password vulnerable to brute force attack

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple...

The vulnerability of the /cloud_config/router_post/get_reset_pwd_veirfy_code function in TP-LINK’s WR-886N router software allows a attacker to execute arbitrary code.

The vulnerability of the /cloudconfig/routerpost/getresetpwdveirfycode function in TP-LINK’s WR-886N router software is caused by buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely by sending a specially crafted request...

The vulnerability of the /cloud_config/router_post/check_reset_pwd_verify_code function in TP-LINK’s WR-886N router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /cloudconfig/routerpost/checkresetpwdverifycode function in TP-LINK’s WR-886N router software arises due to buffer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2022-24681

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen...

CVE-2022-23869

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.7.2, which originates from the fact that in the RuoYi v4.7.2 interface, the user test1 does not have the privilege to reset the password of the user test3, but can request...

CVE-2022-24743

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue ...

Default credentials

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue ...

CVE-2021-44627

A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloudconfig/routerpost/getresetpwdveirfycode feature, which allows malicious users to execute arbitrary code on the system via a crafted post request...

CVE-2021-44623

A Buffer Overflow vulnerability exists in TP-LINK WR-886N 20190826 2.3.8 via the /cloudconfig/routerpost/checkresetpwdverifycode interface...

Zoho Corporation ADSelfService Plus 跨站脚本漏洞

Zoho Corporation ADSelfService Plus is a single management platform from Zoho Corporation, Inc. for complete self-service password management. Zoho Corporation ADSelfService Plus suffers from a cross-site scripting vulnerability that originates from Reset Password, Unlock Account and User Must...

XWiki RCE Vulnerability (GHSA-mgjw-2wrp-r535)

Xwiki is prone to an remote code execution RCE vulnerability SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since t...

CVE-2022-23616

CVE-2022-23616 affects XWiki Platform. An unprivileged user can achieve remote code execution by injecting a Groovy script into their own profile and invoking the Reset Password feature, which saves the user profile with programming rights in affected versions. The issue has been fixed in XWiki 1...

CVE-2022-23616 Remote code execution in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since t...

Xwiki Platform 注入漏洞

Xwiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company Xwiki. XWiki Platform suffers from an injection vulnerability that stems from an affected version in which its unprivileged users can execute remote code execution to inject a groovy...

GHSA-CV25-3GMG-C6M8 Injection in UserFrosting

In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...

Information disclosure

In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, the reset password token and new user email token are accidentally logged which may lead to information disclosure...

Opencart 3 Extension TMD Vendor System SQL Injection

Exploit Title: Opencart 3 Extension TMD Vendor System - Blind SQL Injection Author: Muhammad Zaki Sulistya [email protected] Date: 03-11-2021 Product: TMD Vendor System Vendor Homepage: https://www.opencartextensions.in/ Software Link:...