CVE-2015-8570

The password reset functionality in Lepide Active Directory Self Service allows remote authenticated users to change arbitrary domain user passwords via a crafted request...

CVE-2015-8570

CVE-2015-8570 involves Lepide Active Directory Self Service. The vulnerability allows remote authenticated domain users to change arbitrary domain passwords via crafted requests during the password reset process, due to a flaw in how the reset functionality is processed. Multiple sources (NVD ent...

Lepide Active Directory Self Service Elevation of Privilege Vulnerability

Lepide Active Directory Self Service is a password self-service solution. A security vulnerability exists in the processing of the password reset feature of Lepide Active Directory Self Service. The vulnerability can be exploited by a domain user to change the password of any user within an Activ...

ntop-ng 2.0.15102 Privilege Escalation

Vulnerability title: ntop-ng = 2.0.151021 - Privilege Escalation Author: Dolev Farhi Contact: dolev at flaresec.com Vulnerable version: 2.0.151021 Fixed version: 2.2 Link: ntop.org Date 27.11.2015 CVE-2015-8368 Product Details: ntopng is the next generation version of the original ntop, a network...

ntop-ng 2.0.151021 - Privilege Escalation

ntop-ng 2.0.151021 - Privilege Escalation Vulnerability title: ntop-ng = 2.0.151021 - Privilege Escalation Author: Dolev Farhi Contact: dolev at flaresec.com Vulnerable version: 2.0.151021 Fixed version: 2.2 Link: ntop.org Date 27.11.2015 CVE-2015-8368 Product Details: ntopng is the next generati...

ntop-ng 2.0.151021 - Privilege Escalation Vulnerability

Exploit for multiple platform in category web applications Vulnerability title: ntop-ng = 2.0.151021 - Privilege Escalation Author: Dolev Farhi Contact: dolev at flaresec.com Vulnerable version: 2.0.151021 Fixed version: 2.2 Link: ntop.org Date 27.11.2015 CVE-2015-8368 Product Details: ntopng is...

ntop-ng 2.0.151021 - Privilege Escalation

Vulnerability title: ntop-ng = 2.0.151021 - Privilege Escalation Author: Dolev Farhi Contact: dolev at flaresec.com Vulnerable version: 2.0.151021 Fixed version: 2.2 Link: ntop.org Date 27.11.2015 CVE-2015-8368 Product Details: ntopng is the next generation version of the original ntop, a network...

Deriv.com: Email Verification Link can be Used as Password Reset Link!

Hello again! basically,I have found a new issue which allows attacker to use a Email Verification Link and make it into a password reset link! Proof Of Concept: When you Send a Email Verification Link It looks like this...

Well-known Forum app for vBulletin 5 exposure remote command execution vulnerability that may have leaked millions of user data-bug warning-the black bar safety net

! On Monday, it is reported that vBulletin developer site suffered a hacker attack and compromised nearly 4 8 million the vBulletin user's sensitive information. In the event a hacker after the attack, the vBulletin official emergency mandatory require the user to reset the password, they warn th...

PageFair Hack Serves Up Fake Flash Update to 500 Sites

More than 500 users of a free analytics service may have had their websites compromised over the weekend after a hacker was able to execute malicious JavaScript through the service. On Halloween night, an attacker was able to hijack a “key email account” at PageFair, an ad blocking analytics...

Snapchat: Password Reset - query param overrides postdata

Suppose a user were to reset their password at the following url with the given query parameters: https://accounts.snapchat.com/accounts/changepassword? newpassword=someNewPass&newpassword2=someNewPass Then regardless of the new password entered into the form, someNewPass becomes the user's new...

Web Hosting Service 000webhost Hacked, Information of 13 Million Leaked

Information on nearly 14 million users of 000webhost, a Lithuanian web hosting service, was spilled earlier this year when a hacker exploited an old version of the company’s website and gained access to the backend. 13.5 million customer usernames, plaintext passwords, email addresses, IP...

Subrion 3.x - Multiple Vulnerabilities

Subrion 3.x - Multiple Vulnerabilities - Title = Subrion 3.X.X - Multiple Exploits - Author = bRpsd skype: vegnox - Date Release = 23 October, 2015 - Vendor = Subrion Homepage = http://www.subrion.org/ Download = http://tools.subrion.org/get/latest.zip Vulnerable Versions = 3.X.X Tested Version =...

Subrion 3.x.x File Download / Arbitrary Access

Title = Subrion 3.X.X - Multiple Exploits - Author = bRpsd skype: vegnox - Date Release = 23 October, 2015 - Vendor = Subrion Homepage = http://www.subrion.org/ Download = http://tools.subrion.org/get/latest.zip Vulnerable Versions = 3.X.X Tested Version = Latest, 3.3.5 on a Wamp Server. x Google...

Western data WD from the encrypted hard drive was traced to the presence of vulnerability-vulnerability warning-the black bar safety net

Researchers said, there are several versions of the encrypted Western Digital hard drive there are many vulnerabilities, the hack once you get to the physical contact of the opportunity, you can easily get inside the data, during which time you can disregard the hard disk password. Western Digita...

Uber: Issue with Password reset functionality

Dear Team, There are password change issues with uber. there are two issues: 1User is not receiving notification when he reset password via password reset link. 2Password reset link is not expiring after used once. Good thing: when user change his info like profile update, password change. User g...

Devellion CubeCart Password Reset Vulnerability

Devellion CubeCart is a free and open source e-commerce shopping cart software. The classes/admin.class.php script in Devellion CubeCart fails to properly validate that a password reset request is occurring, allowing a remote attacker to change the administrator password by sending a specially...

CVE-2015-6928

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...

CVE-2015-6928

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...

CVE-2015-6928

CubeCart is affected by a password-reset validation flaw in admin.class.php affecting 5.2.12–5.2.16 and 6.x (before 6.0.7). The issue allows a remote attacker to change the administrator password by sending a recovery request with a space character in the validate parameter and the administrator ...