Weblate: Invalidate session after password reset - hosted website

Hey team, The Hosted Website doesn't invalidate session after the password is reset. It's one of the OWASP recommendations to terminate the session when a password is changed and force the user to re-login. Quote from OWASP: Renew the Session ID After Any Privilege Level Change The session ID mus...

ownCloud: password reset email spamming

Description: The email API https://yoursite/index.php/login?user=admin to reset password is unlimited and can be used as a email bomb vuln address:https://yoursite/index.php/lostpassword/email Reproduce steps:use demo.owncloud.org as example 1.https://demo.owncloud.org/index.php/login has a defau...

Weblate: Access to completion page without performing any action

Hi!, This is much of a best practice as it doesn't have much impact on the user. But I believe you may want to know. After making a registration or on finalizing a password reset, one is redirected to a page, https://demo.weblate.org/accounts/email-sent/. I noticed that even without making any of...

Atlassian Resets HipChat Passwords Following Breach

Atlassian reset user passwords for its group chat service HipChat on Monday following an incident that may have resulted in unauthorized access to a server used by the service. The company began warning users Monday via email that as a result an attacker may have secured access to user informatio...

Weblate: [hosted.weblate.org]Account Takeover

Hello Team, Steps to Reproduce: Go to Login Page Reset Your Password by Clicking Reset it. Put your email and answer the captcha. Go to your email and click your reset Link. You dont need to Change Your Password because you'll be logged in. Scenario Victim forgot to logout his/her Email Account o...

Weblate: Weak e-mail change functionality could lead to account takeover

Hi, Summary I have found a design issue on the e-mail change functionality offered by the "/accounts/profile" handler. In particular, the e-mail change functionality does not require the current user password to be completed. Since the e-mail could be used to reset the password of the account, an...

Weblate: Improper Password Reset Policy on https://hosted.weblate.org/

Application should not allow the user to set the last 3-5 password in terms of secure design principles. It should give a warning or provide such avoidance while user is using repetitive usage of passwords. Repro: 1. Try to set same old password via Password Reset link. Fix: Application should...

Arbitrary Password Reset Vulnerability in Kingsoft Wordsmith Android App

Kingsoft Wordsmith is a translation and learning software from Kingsoft Corporation. An arbitrary password reset vulnerability exists in Kingsoft wordmaster android app. Due to a design flaw in the feature of changing cell phone number, an attacker can reset the password of another person by only...

Arbitrary User Password Reset Vulnerability in Kingsoft Wordsmith Android App

Kingsoft Wordsmith is a free translation and learning software from Kingsoft. Kingsoft wordmaster android app there is any user password reset vulnerability, the vulnerability arises from the change of password did not increase the verification of the old password due to the attacker can take...

Nextcloud: The email API to reset password is unlimited and can be used as a email bomb

Description: The email API https://demo.nextcloud.com/qazxsw/lostpassword/email to reset password is unlimited and can be used as a email bomb Reproduce steps: 1.Every Instant trial's link is https://demo.nextcloud.com/yourname,and it always has a default user admin 2.then I try to visit one...

Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Trend Micro Threat Discovery Appliance adminsystime.cgi Remote Command Execution', 'Description' = %q This module exploits two...

MantisBT Arbitrary Password Reset Vulnerability

MantisBT is a Web-based bug tracking system. An arbitrary password reset vulnerability exists in MantisBT verify.php, which allows remote attackers to exploit the vulnerability by submitting a special request to reset an arbitrary password with unauthorized access...

MantisBT 1.3.x < 1.3.10, 2.x < 2.3.0 Pre-Auth Remote Password Reset Vulnerability

MantisBT is prone to a remote password reset vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Mantis Bug Tracker 1.3.0/2.3.0 - Password Reset Exploit

Exploit for php platform in category web applications + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt + ISR: ApparitionSec Vendor: ================ www.mantisbt.org...

Design/Logic Flaw

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2017-7615

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2017-7615

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2017-7615

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2017-7615

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2017-7615

CVE-2017-7615 affects MantisBT up to version 2.30 (e.g., 2.3.0/2.3.1). The vulnerability is in verify.php where an empty confirm_hash enables pre-auth remote password reset and unauthenticated admin access, allowing unauthorized password changes and admin access. Public exploit references exist (...