ManageEngine Desktop Central < 9 Build 90135 Unauthenticated Admin Password Reset

The version of ManageEngine Desktop Central running on the remote host is prior to 9 build 90135. It is, therefore, affected by an authentication bypass vulnerability due to a flaw in the addOrModifyUser method in the 'DCOperationsServlet' servlet. An unauthenticated, remote attacker can exploit...

Updated drupal packages fix security vulnerabilities

Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password CVE-2015-2559. Under certain circumstances, malicious users can construct a URL that will trick users into being redirected to a 3rd...

MGASA-2015-0121 Updated drupal packages fix security vulnerabilities

Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password CVE-2015-2559. Under certain circumstances, malicious users can construct a URL that will trick users into being redirected to a 3rd...

Manage Engine Desktop Central 9 Unauthorized Administrative Password Reset

A vulnerability exists in the Manage Engine Desktop Central 9 application that affects version build 90130. This may affect earlier releases as well. The vulnerability allows a remote unauthenticated user to change the password of any Manage Engine Desktop Central user with the ‘Administrator’ ro...

Mapbox: Logging a user into attacker's account using password reset link

On March 26th, 2015 @shahmeer-amir reported an issue with the password reset flow for www.mapbox.com that required social engineering to exploit. We patched the issue and awarded a bounty on April 7th, 2015. Please note that this was not related to denial of service or the institution of an accou...

Drupal Password Reset Vulnerability

Drupal is a developmental CMF Content Management Framework written in the PHP language. A security vulnerability exists in Drupal that allows a remote attacker to exploit the vulnerability by using a specially crafted password hash and submitting a password reset URL that can reset the password o...

CVE-2015-2559

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL...

Default credentials

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL...

UBUNTU-CVE-2015-2559

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL...

CVE-2015-2559

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL...

CVE-2015-2559

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL...

CVE-2015-2559

CVE-2015-2559 affects Drupal 6.x before 6.35 and 7.x before 7.35, enabling a remote authenticated user to reset another user’s password by exploiting a crafted password‑reset URL and matching password hashes. Connected advisories confirm this as part of broader Drupal fixes and, in some records (...

CVE-2015-2559

Removed by vendor...

Drupal 6.x < 6.35 / 7.x < 7.35 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 6.x prior to 6.35 or 7.x prior to 7.35. It is, therefore, potentially affected by the following vulnerabilities : - An access bypass vulnerability exists in which password reset URLs can be forged. This allows a remote attacker to gain...

drupal: multiple issues

CVE-2015-2559 access bypass Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. In Drupal 7, this vulnerability is mitigated by the fact that it can only be exploited on sites where...

Drupal Patches Critical Password-Reset Vulnerability

Drupal, one of the widely used open source content management system is recommending its users to update their software to the latest versions 6.35 and 7.35 after the company discovered two moderately critical vulnerabilities that may allow an attacker to hack Drupal websites. According to a...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001

Access bypass Password reset URLs - Drupal 6 and 7 Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. In Drupal 7, this vulnerability is mitigated by the fact that it can only be...

WordPress 3.7 < 3.7.5 / 3.8 < 3.8.5 / 3.9 < 3.9.3 / 4.x < 4.0.1 Multiple Vulnerabilities

Binary data 8584.prm...

帝友P2P任意密码支付密码重置让我超越马云爸爸不再是梦想

简要描述： 本屌为穷逼，买不起贵司10+W的而且代码质量高到可怕的产品，所以下了一个D版系统看源码。在网贷之家随机挑了几个站点测试，发现问题都存在…… 详细说明： 听说P2P借贷火成狗，然后看了看几家P2P借贷的站点，长得都差不多，看起来好像就是一个妈生的。本来想吐槽一下，关乎钱的事情，就不能认真点吗？但是，转念一想，艾玛，这不是一个通用程序么……赶紧脱掉裤子爽一发。 听说这货的产品卖得死贵（15W），翻阅了一下写的代码，质量实在对不起这个价格。之前在乌云上厂商还会接点bug打发打发白帽，现在听说弄了个绿M的检测报告之后屌都不屌乌云一下。 扯蛋完毕，本屌是小白一个，还请各位看官海涵。...

Vimeo: CSRF bypass

Dear Team, Once again i'm here. During research of vimeo.com I found that you are using anti-csrf token against csrf attack. but it's not going to validate on server side. let's see Step 1: go to https://vimeo.com/forgotpassword Step 2: write your email and click on help me. Step 3: Now before...