Cross site scripting

Cross-site scripting XSS vulnerability in NetIQ Self Service Password Reset SSPR 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Uber: Self-XSS Vulnerability on Password Reset Form

Hello Security Team, I have found Third Security Vulnerability on your website :- https://partners.uber.com/ Vulnerability :-"XSS vulnerability on password reset time :" My Payload is this :- '" Following This Reproduce Steps : 1 send password reset link on your email id 2 open password reset lin...

Open edX edx-platform design vulnerability

Open edX edx-platform is a free and open source course management system CMS created by Harvard University and the Massachusetts Institute of Technology Harvard and MIT. The system can be used for MOOCs Massive Open Online Courses as well as smaller courses and training modules. Open edX...

Default credentials

lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a...

CVE-2015-2286

lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a...

CVE-2015-2286

CVE-2015-2286 concerns Open edX edx-platform. The vulnerability is in the template file lms/templates/footer-edx-new.html prior to 2015-01-29, where links on the password-reset page were not properly restricted. This allowed user-assisted remote attackers to discover password-reset tokens by read...

CVE-2015-2286

lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a...

SRC-2016-0009 : ATutor LMS password_reminder TOCTOU Authentication Bypass Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...

Kaltura Community Edition < 11.1.0-2 - Multiple Vulnerabilities

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Kaltura Community Edition Multiple Vulnerabilities Affected versions: Kaltura Community Edition =11.1.0-2 PDF:...

Kaltura Community Edition 11.1.0-2 Code Execution / File Upload / File Read

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Kaltura Community Edition Multiple Vulnerabilities Affected versions: Kaltura Community Edition =11.1.0-2 PDF:...

Slack: Bypass two-factor authentication

If a user set 2FA, a user has to enter verification code when a user tries to reset password. Under the "Password Reset" page, a user can enter wrong two-factor authentication code many times. I said "many times" because your bug bounty policy stated... Exclusions Issues found through automated...

Facebook Password Reset Bug Gave Hacker Access To Any Account

Anand Prakash could have hacked your Facebook account or anyone else’s. The India-based security researcher found a glaring password-reset vulnerability last month that has since been patched. The bug allowed him to crack open any of Facebook’s 1.1 billion accounts using a rudimentary brute force...

Hacker Reveals How to Hack Any Facebook Account

Hacking Facebook account is one of the major queries of the Internet user today. It's hard to find — how to hack Facebook account, but an Indian hacker just did it. A security researcher discovered a 'simple vulnerability' in the social network that allowed him to easily hack into any Facebook...

[Responsible disclosure] How I could have hacked all Facebook accounts

Note: This is being published with the permission of Facebook under the responsible disclosure policy. The vulnerability is now fixed. Summary: This post is about a simple vulnerability found on Facebook which could have been used to hack into other user's Facebook account easily without any user...

TRSIDS系统任意账户密码重置漏洞

No description provided by source...

Coinbase: An adversary can overwhelm the resources by automating Forgot password/Sign Up requests

As Coinbase doesn't use CAPTCHA on publicly available forms such as 'Forgot Password' & 'Sign Up' , the requests can be automated to overwhelm the resources to result in denial of service for CoinBase or mail flooding of customers. The steps to reproduce the issue are as follows. Step 1: Browse t...

Veris: Password reset link is not Expiring

Hello, According to your policy, reset or change password link should be expired within 30 minutes. But it is not so, link is working even after completion of 30 minutes. Proof of Concept: Please find it attached. Do evaluate it and inform me accordingly. Best Regards, Hely H. Shah...

The vulnerability of the AD Self Password Reset password reset tool allows a hacker to reset arbitrary passwords.

The vulnerability of the PasswordReset.Controllers.ResetController.ChangePasswordIndex method PasswordReset.dll, a password reset tool for AD Self Password Reset, is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to reset arbitra...

Legal Robot: Rate limiting on password reset links

Security researcher discovered a potential issue where no rate limiting was applied to sensitive functions, like password reset links...

Yeager CMS 1.2.1 File Upload / SQL Injection / XSS / SSRF

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Yeager CMS vulnerable version: 1.2.1 fixed version: 1.3 CVE number: CVE-2015-7567,...