CVE-2017-18472

Affected product: cPanel before 62.0.4. Vulnerability: reflected XSS in the reset-password interface (SEC-198). Root cause: lack of proper validation of client-side data in the reset-password flow. Impact: allows execution of client-side code in some contexts. Remediation: upgrade to cPanel 62.0....

CVE-2017-18472

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...

PT-2019-8407

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 62.0.4 Description The issue allows for reflected XSS in reset-password interfaces. Recommendations For versions prior to 62.0.4, update to version 62.0.4 or later to resolve the issue...

CVE-2017-18472: Improper Neutralization of Input During Web Page Generation

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...

CVE-2019-14277

Axway SecureTransport 5.x through 5.3 or 5.x through 5.5 with certain API configuration is vulnerable to unauthenticated blind XML injection and XXE in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks i.e., SSRF...

Sql injection

DISPUTED Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid...

CVE-2019-12279

Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that...

Arbitrary Password Reset Vulnerability in Companion Life App

The Companion Life App is an app for opening neighborhood gates. An arbitrary password reset vulnerability exists in Companion Life APP, which can be exploited by an attacker to reset any password...

CVE-2019-10014

In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated...

Default credentials

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csresetpass function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account...

wp-jobhunt-exploit

wp-jobhunt-exploit CVE-2018-19487, CVE-2018-19488, exploit for...

wp-jobhunt-exploit

wp-jobhunt-exploit CVE-2018-19487, CVE-2018-19488, exploit for...

JobCareer < 2.4.1 - User enumeration & Reset password

The theme used a vulnerable version of the WP-jobhunt plugin affected by the issues below: CVE-2018-19487: The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csemployerajaxprofile function through the admin-ajax.php file, which allows remote...

CVE-2018-19555

tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password...

CVE-2018-19555: Cross-Site Request Forgery (CSRF)

tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password...

PT-2018-15000

Name of the Vulnerable Software and Affected Versions TELEPORT version 3.1.0 Description The issue allows for a CSRF attack via the "user/do-reset-password" endpoint to change any password, including the administrator password. Recommendations For version 3.1.0, as a temporary workaround, conside...

CVE-2018-17298

An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password...

PT-2018-13976

Name of the Vulnerable Software and Affected Versions Enalean Tuleap versions prior to 10.5 Description An issue was discovered where reset password links are not invalidated after a user changes their password. Recommendations For versions prior to 10.5, update to version 10.5 or later to resolv...

CVE-2018-17298: Weak Password Recovery Mechanism for Forgotten Password

An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password...

Arbitrary User Password Recovery Vulnerability in Smart Campus Platforms

Smart Campus Platform is a set of smart campus system developed by Guangdong ZhiNai Internet of Things Technology Co. The system involves a number of functional modules such as teaching scheduling, class transfer, class time statistics, teacher leave, student big data management platform,...