PT-2020-16172 · Alfresco +1 · Alfresco Reset Password Add-On +1

Name of the Vulnerable Software and Affected Versions: Alfresco Reset Password add-on versions prior to 1.2.0 Description: The issue allows a malicious user to inject a query within the email input field, utilizing CMIS-SQL Injection. Recommendations: For versions prior to 1.2.0, update the Reset...

Exploit for OS Command Injection in Webmin

CVE-2019-15107 Webmin RCE Error - Perl execution Failed Your...

How to Reset Password in Veeam Backup for Microsoft Azure Appliance

Purpose This article documents methods to reset the password of the Veeam Backup for Microsoft Azure service account. Solution Reset Password via The Microsoft Azure portal 1. Open the Microsoft Azure portal. 2. Log in using your Microsoft Azure credentials. 3. Select the virtual machine with Vee...

Evenroute IQrouter has an unspecified vulnerability (CNVD-2020-25368)

Evenroute IQrouter is a smart router from Evenroute USA. A security vulnerability exists in the 'resetpassword' function in the web panel in Evenroute IQrouter 3.3.1 and earlier versions. A remote attacker can exploit this vulnerability to arbitrarily change the password of the root account...

PT-2020-12957 · Linux +2 · Linux +2

Name of the Vulnerable Software and Affected Versions: IQrouter versions 3.3.1 and earlier Description: The issue allows remote attackers to change the root password arbitrarily using the Lua function reset password in the web-panel. This can occur on a brand-new network that has not been...

Logic flaw vulnerability in human capital management platform of P&L Software Co.

P&T Software is a large-scale enterprise management informatization solutions and IT integrated service provider, mainly for petroleum, chemical, construction, real estate, electric power, minerals, equipment manufacturing, banking, insurance, government and other industries, widely engaged in...

Rocket.Chat: account takeover on 3.0.1 version

I find user reset password hash info and other security info on "/api/v1/users.info" note : I login on rocketchat with ldap account my role : user note: in request "https://target/api/v1/users.info?username=xhttps://target/api/v1/users.info?username=%5Bx%5D" you should change usrname to userId 1-...

Unauthorized Access Vulnerability in moxa mb3180/mb3280/mb3480 Series Serial Communication Servers

MOXA MGate is a serial communication server produced by Taiwan moxa technology Co. An unauthorized access vulnerability exists in the moxa mb3180/mb3280/mb3480 series serial communication servers, which can be exploited by attackers to reset the system IP, password, and reboot the system...

Service Account Takeover

keycloak is vulnerable to service account takeover. The vulnerability exists as the service accounts reset password flow were using the placeholder.org domain...

Stripo Inc: Password token leak via Host header

Password token leak via Host header -------------- Vulnerability Description: Token will be leaked by the Server to that third party site and that token can be used by third parties to reset the password and take over the account & directly login in your account Steps To Reproduce: 1 Send reset...

Design/Logic Flaw

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password functi...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The CVE-2019-16669 issue concerns Pagekit 1.0.17, where Reset Password returns responses that differ depending on whether the entered e‑mail matches a valid user. This behavior enables user enumeration (information disclosure) by attackers, as described across multiple sources (CVE records, Red H...

cPanel cross-site scripting vulnerability (CNVD-2019-30464)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the reset password interface in versions prior to cPanel 62.0.4. The vulnerability...

CVE-2017-18472

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...

Design/Logic Flaw

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...

CVE-2017-18472

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...

CVE-2017-18472

Affected product: cPanel before 62.0.4. Vulnerability: reflected XSS in the reset-password interface (SEC-198). Root cause: lack of proper validation of client-side data in the reset-password flow. Impact: allows execution of client-side code in some contexts. Remediation: upgrade to cPanel 62.0....