CVE-2016-3084

CVE-2016-3084 affects the Cloud Foundry UAA password reset flow, vulnerable to brute force when using the internal UAA user store. The issue occurs due to multiple active reset codes at a given time and does not apply to deployments using SAML/LDAP. Affected products/versions include Cloud Foundr...

CVE-2016-3084

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple...

Weblate: Takeover of an account via reset password options after removing the account

Hi, The Reset password mechanism can't validate or authenticate an user properly. After removing a user account it's possible to takeover the user account by using reset password option. which is turn into takeover an account. Step to Reproduce: 1. Go to weblate 2. Remove your account from weblat...

Weblate: Spamming any user from Reset Password Function

It is possible to spam any user whose email-id is known. csrfmiddlewaretoken token can be used more than one. Users can be spammed heavily by just Brute force attack on password reset page. Implementtion: Implement a Captcha...

Trend Micro Threat Discovery Appliance 2.6.1062r1 logoff.cgi Directory Traversal Exploit

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a logoff.cgi directory traversal authentication bypass vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance = 2.6.1062r1 logoff.cgi Directory Traversal Authentication Bypass Vulnerability...

Wallacepos Cross-Site Scripting Vulnerability

wallacepos is a web-based POS system. A cross-site scripting vulnerability exists in wallacepos version 1.4.1, which stems from the program's failure to adequately filter user data submitted to wallacepos-master/myaccount/resetpassword.php. A remote attacker can exploit this vulnerability to...

Error session termination mechanisms lead to account hijacking-vulnerability warning-the black bar safety net

Error session termination mechanisms Session termination is to secure the session period in one important aspect. Security implementation session tokens can effectively reduce the session hijacking attack. The session is terminated as the number of attack control mechanisms, such asXSS（cross-site...

Boozt Fashion AB: Email link poisoning / Host header attack

Description ------------- It is possible to poison the link of the password reset email. This is generally done by altering the Host header, but in this case, the WAF is successfully blocking it. The trick here is to add an X-Forwarded-Host header in the request so the server is using this value...

CareMonkey - Reset Password Token Remote Vulnerability

Document Title: =============== CareMonkey - Reset Password Token Remote Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1926 Video: https://www.youtube.com/watch?v=cnwmQAUI7ik Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1873 Release Date:...

Bug Tracker 2.7.1 Information Disclosure

======================================================================== | Title : Bug Tracker V 2.7.1 database disclosure vulnerability | Author : indoushka | email : [email protected] | Tested on: windows 8.1 Français V.Pro | Vendor : https://www.twbsd.org/demo/...

Ladesk Agent Session Reset Password

Document Title: =============== Ladesk Agent 1 Bug Bounty - Session Reset Password Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1849 Release Date: ============= 2016-06-27 Vulnerability Laboratory ID VL-ID:...

Authorization

The RPC API in the RSCD agent in BMC BladeLogic Server Automation BSA 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure...

Facebook Fixes Instagram Vulnerability That Opened 1M Accounts to Compromise

Facebook was quick to fix an issue earlier this month that could’ve let an attacker break into four percent of all active, locked Instagram accounts, meaning it affected approximately one million users. Belgium-based IT security consultant Arne Swinnen discovered the issue two weeks ago when he...

Veris: Password(s) can be found via login process.

Hello security team, It is possible to find passwords of other users by enumerate the login process. The scenario is quiet simple: 1 Go to https://sandbox.veris.in/portal/login/ 2 Fill in 'Email ID' and 'Password' and click 'Log In' 3 Capture the request via burp suite and send it to intruder. 4...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to api/v3/public/shares/downloads/, the 2 authType parameter to api/v3/auth/login, or the 3 login parameter to...

X (Formerly Twitter): URGENT : NICHE.co Account Take Over Vulnerability

Hello ! This is an urgent report that you should immediately take care of !! I found out an account take over vulnerability on your acquisition : niche.co Proof of concept code CSRF Attack Page: /get-started/complete s The authenticitytoken parameter is not properly validated by the end of the...

moneymappress.com XSS vulnerability

Vulnerable URL: http://www.moneymappress.com/reset-password/ Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 23:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 18766 Google Pagerank| 3 VIP website status:|...

mangocam.com XSS vulnerability

Vulnerable URL: https://www.mangocam.com/login/reset-password/ Details: Description| Value ---|--- Patched:| Yes, at 29.11.2015 Latest check for patch:| 29.11.2015 20:49 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 424433 Google Pagerank| 2 VIP website status...

phpyun 任意用户密码修改两处 (秒破/demo测试)

简要描述： 好久没看过php了。。。。 如题咯。 详细说明： 来看到找回密码的地方。 app/controller/forgetpwd/index.class.php function sendaction $username=yuniconv"utf-8","gbk",$POST'username'; if!$this-CheckRegUser$username&&!$this-CheckRegEmail$username $res'msg'=yuniconv"gbk","utf-8","用户名不符合规范！"; $res'type'='8'; echo...

Password retrieve logic vulnerability summary-vulnerability warning-the black bar safety net

0x00 background description Please note these two articles: Password retrieve function there may be a problem Password retrieve function there may be issues supplemented From the above two documents the past six months, recently finishing a password to get back to the mind map, open the collectio...