Cross site scripting

Cross Site Scripting XSS in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of the victim by sending a malicious URL or directing the victim to a malicious site...

CVE-2021-26832

Cross Site Scripting XSS in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of the victim by sending a malicious URL or directing the victim to a malicious site...

Priority Software Priority Enterprise Management System 跨站脚本漏洞

Priority Software Priority Enterprise Management System is an application from Priority Software, Inc. An intelligent ERP platform for managing organizations in the cloud. A cross-site scripting vulnerability exists in Priority Enterprise Management System version v8.00, which originates from the...

Shopify: Password reset token leak via "Host header" on third party website

Hi Security Team, Product / URL https://your-store.wholesale.shopifyapps.com/ Description It has been identified that the application is leaking Token to third party sites. In this case it was found that the Token is being leaked to third party sites which is a issue knowing the fact that it can...

CVE-2020-28874

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...

CVE-2020-28874

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered an invalid token parameter...

Weblate: Reset password cookie leads to account takeover

Hi There are 3 issues on this report lead to account takeover. 1- When the user requests a reset password link, server sends a link for the user via email, whenever the user click on the link for the first time redirects to Reset password page but if the user close browser or tab and click again ...

CVE-2020-26061

ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. An unauthenticated, remote attacker can send a crafted...

Alfresco Access Control Error Vulnerability

Alfresco is an open source enterprise content management system. The platform page using Freemarker development , the main features include document management , collaboration , records management , knowledge base management , Web content management and so on. A security vulnerability exists in...

CVE-2020-15181

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0...

CVE-2020-15181

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0...

Design/Logic Flaw

The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0...

CVE-2020-15181

CVE-2020-15181 affects the Alfresco Reset Password add-on prior to version 1.2.0. The issue stems from relying on untrusted inputs when making a security decision, allowing an attacker to gain administrator access to the system on affected servers. The vulnerability is fixed in version 1.2.0. In ...

CVE-2020-25728

The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm involving an increment that allows a malicious user to change any user's account password include the admin account...

CVE-2020-25727

The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input field...

Sql injection

The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input field...

Default credentials

The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm involving an increment that allows a malicious user to change any user's account password include the admin account...

CVE-2020-25727

CVE-2020-25727 affects the Alfresco Reset Password add-on prior to 1.2.0. The vulnerability is a CMIS-SQL Injection that lets an attacker inject a CMIS SQL query through the email input field. Public details in connected items confirm the issue and the affected component, but no patch/version rem...

CVE-2020-25728

The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm involving an increment that allows a malicious user to change any user's account password include the admin account...

CVE-2020-25728

The CVE pertains to the Alfresco Reset Password add-on prior to version 1.2.0, which uses a broken increment-based algorithm that lets a malicious user change any user’s password, including the admin account. Exploitation details are not provided in the connected documents beyond this description...