228 matches found
Mail.ru: Double authentication bypass
Report describes current behavior of "Bind session to IP" and "Disable parallel session" security settings and is unrelated to authentication. While behavior doesn't match to reporter's expectation e.g. mobile and desktop sessions may exist in parallel despite of the settings current behavior is...
CVE-2017-14134
A Reflected XSS Vulnerability affects the forgotten password page of Maplesoft Maple T.A. 2016.0.6 Customer Hosted via the emailAddress parameter to passwordreset/PasswordReset.do, aka Open Bug Bounty ID OBB-286688...
Cross site scripting
A Reflected XSS Vulnerability affects the forgotten password page of Maplesoft Maple T.A. 2016.0.6 Customer Hosted via the emailAddress parameter to passwordreset/PasswordReset.do, aka Open Bug Bounty ID OBB-286688...
CVE-2017-14134
A Reflected XSS Vulnerability affects the forgotten password page of Maplesoft Maple T.A. 2016.0.6 Customer Hosted via the emailAddress parameter to passwordreset/PasswordReset.do, aka Open Bug Bounty ID OBB-286688...
SQL Injection Vulnerability in Shue Wei Information Digital Campus Unified Authentication Platform
Shuewei Digital Campus Unified Authentication Platform serves as the authorization and access control center for network applications, realizing security management from users to applications. It provides unified user management, authentication service and authority management for all application...
kenro.co.uk XSS vulnerability
Open Bug Bounty ID: OBB-417779 Description| Value ---|--- Affected Website:| kenro.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...
forgottenkingdoms.org XSS vulnerability
Vulnerable URL: http://www.forgottenkingdoms.org/help.php?keyword=%27%22%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 03.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4772525 VIP websit...
CVE-2017-7731
A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten Password feature...
CVE-2017-7731
A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten Password feature...
Default credentials
A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten Password feature...
CVE-2017-7731
A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten Password feature...
WebSummit: Subdomain Takeover at http://gameday.websummit.net
As i said in the title i found a subdomain takeover vulnerability on the url http://gameday.websummit.net The url was trying to find a bucket that didn't exist from a probably forgotten dns entry that was at gameday.websummit.net.s3-website-eu-west-1.amazonaws.com So i created a bucket with the...
FTP Password Recovery - Command-line Lost or Forgotten FTP Password Finder Tool for Windows
FTP Password Recovery is a free command-line tool to find your lost or forgotten FTP password for any FTP server. It automatically detects if the target FTP server allows any Anonymous without password connections. In case your FTP server is running on different port other than port 21 then you c...
Khan Academy: The web app's forgot password page is vulnerable to text injection/content spoofing
An attacker will exploit this by chaining it with CSRF there is not protection against CSRF for that page as scenario can only be created by a POST request. The attacker will target innocent users by doing this and some of them would fall in trap by calling the number or by sending the email. Mor...
Forgotten Places - Lost Circus - Base64 encoded String, Exported ContentProvider, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Forgotten Places - Lost Circus published at the 'play' market has multiple vulnerabilities...
Forgotten Tales RPG - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Forgotten Tales RPG published at the 'play' market has multiple vulnerabilities...
idxco.com XSS vulnerability
Vulnerable URL: http://www.idxco.com/mgmt/forgottenPassword.php?message=%22%3E%3Csvg/onload=alert%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 30.11.2015 Latest check for patch:| 30.11.2015 01:27 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...
Latest Microsoft Transparency Report Details Content Removal Requests
Microsoft launched a new transparency website this week that bundles reports detailing requests for data the company has received, including those from law enforcement, the government, and elsewhere. The page, which Microsoft is calling its Transparency Hub, is somewhat similar to what Apple did...
Forgotten password features leaks information to the user that could be used to gain unauthorised access to Confluence
Using the forgotten password feature in Confluence it is possible to find out which email addresses are stored in the system from the responses given from the form when submitted. These responses need to be made generic so that it is not possible to tell which email addresses are or are not store...
Forgotten password features leaks information to the user that could be used to gain unauthorised access to Confluence
Using the forgotten password feature in Confluence it is possible to find out which email addresses are stored in the system from the responses given from the form when submitted. These responses need to be made generic so that it is not possible to tell which email addresses are or are not store...