Logic flaw vulnerability in human capital management platform of P&L Software Co.

P&T Software is a large-scale enterprise management informatization solutions and IT integrated service provider, mainly for petroleum, chemical, construction, real estate, electric power, minerals, equipment manufacturing, banking, insurance, government and other industries, widely engaged in...

Rocket.Chat: account takeover on 3.0.1 version

I find user reset password hash info and other security info on "/api/v1/users.info" note : I login on rocketchat with ldap account my role : user note: in request "https://target/api/v1/users.info?username=xhttps://target/api/v1/users.info?username=%5Bx%5D" you should change usrname to userId 1-...

Unauthorized Access Vulnerability in moxa mb3180/mb3280/mb3480 Series Serial Communication Servers

MOXA MGate is a serial communication server produced by Taiwan moxa technology Co. An unauthorized access vulnerability exists in the moxa mb3180/mb3280/mb3480 series serial communication servers, which can be exploited by attackers to reset the system IP, password, and reboot the system...

Service Account Takeover

keycloak is vulnerable to service account takeover. The vulnerability exists as the service accounts reset password flow were using the placeholder.org domain...

Stripo Inc: Password token leak via Host header

Password token leak via Host header -------------- Vulnerability Description: Token will be leaked by the Server to that third party site and that token can be used by third parties to reset the password and take over the account & directly login in your account Steps To Reproduce: 1 Send reset...

Design/Logic Flaw

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password functi...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The CVE-2019-16669 issue concerns Pagekit 1.0.17, where Reset Password returns responses that differ depending on whether the entered e‑mail matches a valid user. This behavior enables user enumeration (information disclosure) by attackers, as described across multiple sources (CVE records, Red H...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

cPanel cross-site scripting vulnerability (CNVD-2019-30464)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the reset password interface in versions prior to cPanel 62.0.4. The vulnerability...

CVE-2017-18472

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...

Design/Logic Flaw

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...

CVE-2017-18472

Affected product: cPanel before 62.0.4. Vulnerability: reflected XSS in the reset-password interface (SEC-198). Root cause: lack of proper validation of client-side data in the reset-password flow. Impact: allows execution of client-side code in some contexts. Remediation: upgrade to cPanel 62.0....

CVE-2017-18472

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces SEC-198...

CVE-2019-14277

Axway SecureTransport 5.x through 5.3 or 5.x through 5.5 with certain API configuration is vulnerable to unauthenticated blind XML injection and XXE in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks i.e., SSRF...

Sql injection

DISPUTED Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid...

CVE-2019-12279

Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that...

Arbitrary Password Reset Vulnerability in Companion Life App

The Companion Life App is an app for opening neighborhood gates. An arbitrary password reset vulnerability exists in Companion Life APP, which can be exploited by an attacker to reset any password...

CVE-2019-10014

In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated...