CVE-2020-25727

The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input field...

Default credentials

The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm involving an increment that allows a malicious user to change any user's account password include the admin account...

Sql injection

The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input field...

CVE-2020-25727

CVE-2020-25727 affects the Alfresco Reset Password add-on prior to 1.2.0. The vulnerability is a CMIS-SQL Injection that lets an attacker inject a CMIS SQL query through the email input field. Public details in connected items confirm the issue and the affected component, but no patch/version rem...

CVE-2020-25728

The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm involving an increment that allows a malicious user to change any user's account password include the admin account...

CVE-2020-25728

The CVE pertains to the Alfresco Reset Password add-on prior to version 1.2.0, which uses a broken increment-based algorithm that lets a malicious user change any user’s password, including the admin account. Exploitation details are not provided in the connected documents beyond this description...

PT-2020-16172 · Alfresco +1 · Alfresco Reset Password Add-On +1

Name of the Vulnerable Software and Affected Versions: Alfresco Reset Password add-on versions prior to 1.2.0 Description: The issue allows a malicious user to inject a query within the email input field, utilizing CMIS-SQL Injection. Recommendations: For versions prior to 1.2.0, update the Reset...

Exploit for OS Command Injection in Webmin

CVE-2019-15107 Webmin RCE Error - Perl execution Failed Your...

How to Reset Password in Veeam Plug-In for Microsoft Azure Appliance

Purpose This article documents methods to reset the password of the Veeam Plug-In for Microsoft Azure service account. Solution Reset Password via The Microsoft Azure portal 1. Open the Microsoft Azure portal. 2. Log in using your Microsoft Azure credentials. 3. Select the virtual machine with...

Evenroute IQrouter has an unspecified vulnerability (CNVD-2020-25368)

Evenroute IQrouter is a smart router from Evenroute USA. A security vulnerability exists in the 'resetpassword' function in the web panel in Evenroute IQrouter 3.3.1 and earlier versions. A remote attacker can exploit this vulnerability to arbitrarily change the password of the root account...

PT-2020-12957 · Linux +2 · Linux +2

Name of the Vulnerable Software and Affected Versions: IQrouter versions 3.3.1 and earlier Description: The issue allows remote attackers to change the root password arbitrarily using the Lua function reset password in the web-panel. This can occur on a brand-new network that has not been...

Logic flaw vulnerability in human capital management platform of P&L Software Co.

P&T Software is a large-scale enterprise management informatization solutions and IT integrated service provider, mainly for petroleum, chemical, construction, real estate, electric power, minerals, equipment manufacturing, banking, insurance, government and other industries, widely engaged in...

Rocket.Chat: account takeover on 3.0.1 version

I find user reset password hash info and other security info on "/api/v1/users.info" note : I login on rocketchat with ldap account my role : user note: in request "https://target/api/v1/users.info?username=xhttps://target/api/v1/users.info?username=%5Bx%5D" you should change usrname to userId 1-...

Unauthorized Access Vulnerability in moxa mb3180/mb3280/mb3480 Series Serial Communication Servers

MOXA MGate is a serial communication server produced by Taiwan moxa technology Co. An unauthorized access vulnerability exists in the moxa mb3180/mb3280/mb3480 series serial communication servers, which can be exploited by attackers to reset the system IP, password, and reboot the system...

Service Account Takeover

keycloak is vulnerable to service account takeover. The vulnerability exists as the service accounts reset password flow were using the placeholder.org domain...

Stripo Inc: Password token leak via Host header

Password token leak via Host header -------------- Vulnerability Description: Token will be leaked by the Server to that third party site and that token can be used by third parties to reset the password and take over the account & directly login in your account Steps To Reproduce: 1 Send reset...

Design/Logic Flaw

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password functi...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The CVE-2019-16669 issue concerns Pagekit 1.0.17, where Reset Password returns responses that differ depending on whether the entered e‑mail matches a valid user. This behavior enables user enumeration (information disclosure) by attackers, as described across multiple sources (CVE records, Red H...