Uber: password reset token leaking allowed for ATO of an Uber account

With an email address for a valid Uber account, it was possible to take over that account because the reset token was exposed in the response of a password reset HTTP request. This meant an attacker could initiate password reset for an account and immediately receive the reset token for that...

RubyGems: Password Reset emails missing TLS leads account takeover

Hi, I saw that the email is sent in clear-text instead of TLS Transport Layer Security any Man-in-the-middle attacker is able to read these sensitive Emails and get the password reset link which lead to account takeover. Email details: from: [email protected] to: [email protected] date: Fri, Sep 3...

Legal Robot: Bypass 8 chars password complexity with 6 chars only due to insecure password reset functionaliy

While password complexity requirements were implemented in the original signup page, these were not added to the password reset page. Thanks to this security researcher's efforts, we've added this functionality there as well...

HiMall Multi-User Mall System Exists Arbitrary Password Reset Vulnerability

Hishop multi-user mall system is a multi-store support multi-vendor stationed, mainly for high-end customers, for traditional enterprises and large and medium-sized online business to improve the operational capacity of merchants as the core, similar to Jingdong, Tmall e-commerce platform. Hishop...

Linex All Versions Password Reset Vulnerability

LinkEx is an open source web application for exchanging links. A password reset vulnerability exists in all versions of LinEx, which can be exploited by an attacker to reset the administrator password and gain administrator privileges...

500 Million Yahoo Accounts Stolen By State-Sponsored Hackers

Yahoo says it was the victim of state-sponsored hackers who stole information associated with 500 million accounts. Yahoo CISO Bob Lord said the attack happened on the company’s network in late 2014; he did not name the country responsible. “The account information may have included names, email...

HackerOne: Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)

Hi there, I noticed when we hit the /userssignin endpoint too many times it will give us HTTP/1.1 429 Too Many Requests Date: Mon, 19 Sep 2016 01:52:19 GMT Content-Type: text/plain However, this can be "reset" although I struggle to get it to work EVERYTIME on /users/signin. This however, does wo...

Yelp: Password reset token not expiring

Hello Yelp, Old unused Password reset tokens are not expiring on yelp.com after the issuance of a new token. EXPLANATION: Suppose at 09:00 hrs I used password reset options of yelp and got a token on my email.Lets call it token01. But i did not use it. And at 09:04 hrs I used again the password...

Boozt Fashion AB: Host header poisoning leads to account password reset links hijacking

Hi, Issue Summary : While conducting my regular testing I discovered that the mobile version of boozt.com application relies on the host header when constructing password reset links emailed to the user. Thus, an attacker can inject a arbitrary host header which leads to password reset leakage...

Yelp: Bybass The Closing of the account and logged again to your account

Hello Details: All My accounts have been closed i dnot know the reason so i have played around and manged to bypass this mechanism using the last unused password token Steps: - go to forget password page and get new password reset token and dnot use it - go and make anything against the rules lea...

Vodafone Mobile Wifi Reset Admin Password

import urllib2 import json from datetime import datetime, timedelta import time import httplib from threading import Thread from Queue import Queue from multiprocessing import process print """ Vodafone Mobile WiFi - Password reset exploit Daniele Linguaglossa """ threadlock = False session = ""...

Vodafone Mobile Wifi - Reset Admin Password

Exploit for multiple platform in category web applications import urllib2 import json from datetime import datetime, timedelta import time import httplib from threading import Thread from Queue import Queue from multiprocessing import process print """ Vodafone Mobile WiFi - Password reset exploi...

Vodafone Mobile Wifi - Reset Admin Password

Vodafone Mobile Wifi - Reset Admin Password import urllib2 import json from datetime import datetime, timedelta import time import httplib from threading import Thread from Queue import Queue from multiprocessing import process print """ Vodafone Mobile WiFi - Password reset exploit Daniele...

Vodafone Mobile Wifi - Reset Admin Password

import urllib2 import json from datetime import datetime, timedelta import time import httplib from threading import Thread from Queue import Queue from multiprocessing import process print """ Vodafone Mobile WiFi - Password reset exploit Daniele Linguaglossa """ threadlock = False session = ""...

CVE-2016-7107

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors...

CVE-2016-7107

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors...

CVE-2016-7107

Huawei UMA (Unified Maintenance Audit) prior to V200R001C00SPC200 SPH206 is affected by CVE-2016-7107 due to insufficient parameter validation on certain pages, enabling remote attackers to reset arbitrary user passwords and thereby compromise data integrity via unspecified vectors. The issue is ...

CVE-2016-5676

cgi-bin/cgisystem in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action...

CVE-2016-5676

cgi-bin/cgisystem in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action...

CVE-2016-5676

cgi-bin/cgisystem in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action...