CVE-2019-14277

Axway SecureTransport 5.x through 5.3 or 5.x through 5.5 with certain API configuration is vulnerable to unauthenticated blind XML injection and XXE in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks i.e., SSRF...

Sql injection

DISPUTED Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid...

CVE-2019-12279

Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that...

Arbitrary Password Reset Vulnerability in Companion Life App

The Companion Life App is an app for opening neighborhood gates. An arbitrary password reset vulnerability exists in Companion Life APP, which can be exploited by an attacker to reset any password...

CVE-2019-10014

In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated...

Default credentials

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csresetpass function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account...

JobCareer < 2.4.1 - User enumeration & Reset password

The theme used a vulnerable version of the WP-jobhunt plugin affected by the issues below: CVE-2018-19487: The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csemployerajaxprofile function through the admin-ajax.php file, which allows remote...

CVE-2018-19555

tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password...

CVE-2018-17298

An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password...

Arbitrary User Password Recovery Vulnerability in Smart Campus Platforms

Smart Campus Platform is a set of smart campus system developed by Guangdong ZhiNai Internet of Things Technology Co. The system involves a number of functional modules such as teaching scheduling, class transfer, class time statistics, teacher leave, student big data management platform,...

CVE-2018-8916

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification...

CVE-2018-9934

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...

CVE-2018-9934

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...

Design/Logic Flaw

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...

MetInfo Arbitrary Password Change Vulnerability

MetInfo using PHP + Mysql architecture, is a very SEO-friendly, full-featured, support for multi-language, responsive display, extremely suitable for business, corporate website construction cms station-building system. The reset password function in MetInfo 6.0 has an arbitrary password change...

PrestaShop User Enumeration Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A security vulnerability exists in PrestaShop version 1.7.2.4. An attacker can exploi...

Design/Logic Flaw

PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message...

CVE-2018-5682

PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message...

CVE-2018-5682

PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message...

DeDeCMS v5.7 SP2 official version of the foreground any user password change vulnerability

DedeCms woven dream content management system is a PHP open source website management system. DeDeCMS v5.7 SP2 official version of the foreground there are arbitrary user password change vulnerability. The vulnerability is due to the foreground resetpassword.php on the acceptance of the parameter...