Uber: Issue with Password reset functionality

Dear Team, There are password change issues with uber. there are two issues: 1User is not receiving notification when he reset password via password reset link. 2Password reset link is not expiring after used once. Good thing: when user change his info like profile update, password change. User g...

Devellion CubeCart Password Reset Vulnerability

Devellion CubeCart is a free and open source e-commerce shopping cart software. The classes/admin.class.php script in Devellion CubeCart fails to properly validate that a password reset request is occurring, allowing a remote attacker to change the administrator password by sending a specially...

CVE-2015-6928

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...

CVE-2015-6928

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the...

CVE-2015-6928

CubeCart is affected by a password-reset validation flaw in admin.class.php affecting 5.2.12–5.2.16 and 6.x (before 6.0.7). The issue allows a remote attacker to change the administrator password by sending a recovery request with a space character in the validate parameter and the administrator ...

Shopify: create staff member without owner access

Hi as you mentioned in 56726 "Only the the store owner is allowed to create new staff members" admins can't create new staff members! but with this vulnerability admins can use api to create user! steps: - get access token for one full access admin you can send request to xauth or sniff it from...

Apple iOS iOS Backup Password Reset Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. Apple iOS has a security vulnerability that allows physically accessible local users to be able to reset passwords for failed iOS backup attempts...

Seagate BlackArmor NAS device static adminstrator Password Reset vulnerability

Seagate BlackArmor NAS 路由器可以在没有任何授权下复位管理员密码，并且可以在新手引导下重置为任意密码 可以直接访问 http://目标IP地址/d41d8cd98f00b204e9800998ecf8427e.php 这个文件，然后就可以重置管理员密码。...

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server allows a intruder to bypass the passwords of unauthorized users.

The vulnerability in the web-based administration interface of Cisco TelePresence Video Communication Server software is related to errors in managing registration data. Exploiting this vulnerability could allow a malicious actor to reset the passwords of arbitrary users remotely...

Mantis Bug Tracker 1.2.19 - Host Header

Mantis Bug Tracker 1.2.19 - Host Header Exploit Title: MantisBT 1.2.19 - Host header attack vulnerability Date: 07-09-2015 Exploit Author: Pier-Luc Maltais Centre opérationnel de sécurité informatique gouvernemental COSIG Vendor Homepage: https://www.mantisbt.org/ Software Link:...

Mantis Bug Tracker 1.2.19 - Host Header

Exploit Title: MantisBT 1.2.19 - Host header attack vulnerability Date: 07-09-2015 Exploit Author: Pier-Luc Maltais Centre opérationnel de sécurité informatique gouvernemental COSIG Vendor Homepage: https://www.mantisbt.org/ Software Link:...

74cms最新版重置任意账号密码

简要描述： 密码重置机制可以绕过，同时可重置任意账号密码 demo测试成功 详细说明： 先看下 \user\usergetpass.php $act = !empty$REQUEST'act' ? trim$REQUEST'act' : 'enter'; $smarty-assign'headernav',"getpass"; if $act=='enter' $smarty-assign'title','找回密码 - '.$CFG'sitename'; $token=substrmd5mtrand100000, 999999, 8,16; //生成token...

Edimax PS-1206MF - Web Admin Authentication Bypass

Edimax PS-1206MF - Web Admin Authentication Bypass Title: Edimax PS-1206MF - Web Admin Auth Bypass Date: 30.08.15 Vendor: edimax.com Firmware version: 4.8.25 Author: Smash Contact: smash at devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi, remote...

Edimax PS-1206MF - Web Admin Authentication Bypass

Title: Edimax PS-1206MF - Web Admin Auth Bypass Date: 30.08.15 Vendor: edimax.com Firmware version: 4.8.25 Author: Smash Contact: smash at devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi, remote attacker is able to change specific settings or eve...

Edimax PS-1206MF - Web Admin Auth Bypass Vulnerability

Exploit for hardware platform in category web applications Title: Edimax PS-1206MF - Web Admin Auth Bypass Date: 30.08.15 Vendor: edimax.com Firmware version: 4.8.25 Author: Smash Contact: smash at devilteam.pl HTTP authorization is not being properly verified while sendind POST requests to .cgi,...

CVE-2015-4319

CVE-2015-4319 affects Cisco TelePresence Video Communication Server (VCS) Expressway; the Password Change function in the Administrative Web Interface fails to properly enforce authorization, enabling an authenticated, remote attacker to reset arbitrary active-user passwords via crafted packets. ...

Symantec Endpoint Protection Manager < 12.1 RU6 MP1 Multiple Vulnerabilities (SYM15-007)

The version of Symantec Endpoint Protection Manager SEPM running on the remote host is prior to 12.1 RU6 MP1. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the password reset functionality that allows a remote attacker, using a crafted password reset action, to...

Symantec Endpoint Protection Manager Authentication Bypass Vulnerability

Symantec Endpoint Protection Manager SEPM is a suite of enterprise-grade virus protection software from Symantec USA. The software protects against malicious attacks such as viruses, worms, and Trojan horses. SEPM 12.1-RU6-MP1 A security vulnerability exists in the management console of previous...

Authentication flaw

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action that triggers a new administrative session...

The vulnerability of the Cisco Unified Meetingplace Web Conferencing control program allows a intruder to bypass arbitrary passwords.

The vulnerability of the password-changing subsystem of the Cisco Unified Meetingplace Web Conferencing control software is related to errors in managing registration data. Exploiting this vulnerability could allow a malicious actor to reset arbitrary passwords due to the lack of additional check...