Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to api/v3/public/shares/downloads/, the 2 authType parameter to api/v3/auth/login, or the 3 login parameter to...

X (Formerly Twitter): URGENT : NICHE.co Account Take Over Vulnerability

Hello ! This is an urgent report that you should immediately take care of !! I found out an account take over vulnerability on your acquisition : niche.co Proof of concept code CSRF Attack Page: /get-started/complete s The authenticitytoken parameter is not properly validated by the end of the...

moneymappress.com XSS vulnerability

Vulnerable URL: http://www.moneymappress.com/reset-password/ Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 23:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 18766 Google Pagerank| 3 VIP website status:|...

mangocam.com XSS vulnerability

Vulnerable URL: https://www.mangocam.com/login/reset-password/ Details: Description| Value ---|--- Patched:| Yes, at 29.11.2015 Latest check for patch:| 29.11.2015 20:49 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 424433 Google Pagerank| 2 VIP website status...

phpyun 任意用户密码修改两处 (秒破/demo测试)

简要描述： 好久没看过php了。。。。 如题咯。 详细说明： 来看到找回密码的地方。 app/controller/forgetpwd/index.class.php function sendaction $username=yuniconv"utf-8","gbk",$POST'username'; if!$this-CheckRegUser$username&&!$this-CheckRegEmail$username $res'msg'=yuniconv"gbk","utf-8","用户名不符合规范！"; $res'type'='8'; echo...

Password retrieve logic vulnerability summary-vulnerability warning-the black bar safety net

0x00 background description Please note these two articles: Password retrieve function there may be a problem Password retrieve function there may be issues supplemented From the above two documents the past six months, recently finishing a password to get back to the mind map, open the collectio...

Vimeo: Full account takeover via Add a New Email to account without email verified and without password confirmation.

Description : This is especially important if the application is commonly used in shared computers such as cyber cafes or airport terminals Bug : Add a New Email to account without email verified and without password confirmation when the leaves open email ,Leading to the theft of account In less...

Vimeo: Securing "Reset password" pages from bots

I found a security issue on your "Reset password" page Google botnets are indexing some of your sensitive pages with tokens of accounts. For this you may like to add: For pages like "resetting your password" need to have this. Vulnerable url:...

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)

array 'method' = 'POST', 'header' = "Content-Type: application/x-www-form-urlencoded\r\n", 'content' = $postdata ; $ctx = streamcontextcreate$params; $data = filegetcontents$url . '?q=node&destination=node', null, $ctx; ifstristr$data, 'mbstrlen expects parameter 1 to be string' && $data echo...

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)

Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Creditz to https://www.reddit.com/user/fyukyuk EDB Note Updated version: https://github.com/kenorb/drupageddon/blob/master/drupal7.xsqlinjectionsa-core-2014-005.py import urllib2,sys from drupalpass import DrupalHas...

CVE-2014-5516 CSRF protection bypass in &quot;KonaKart&quot; Java eCommerce product

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-5516 =================== "Cross-Site Request Forgery CSRF protection bypass" CWE-352 vulnerability in "KonaKart Storefront Application" Enterprise Java eCommerce product Vendor =================== DS Data Systems UK Ltd. Product...

MTS MBlaze Ultra Wi-Fi / ZTE AC3633 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Author: Ajin Abraham - xboz http://opensecurity.in Product MTS MBlaze 3G Wi-Fi Modem System Version 107 Manufacturer ZTE Model AC3633 import requests import os import urllib2 print "MTS MBlaze Ultra Wi-Fi / ZTE AC3633 Exploit" print...

MTS MBlaze Ultra Wi-Fi / ZTE AC3633 - Multiple Vulnerabilities

Author: Ajin Abraham - xboz http://opensecurity.in Product MTS MBlaze 3G Wi-Fi Modem System Version 107 Manufacturer ZTE Model AC3633 import requests import os import urllib2 print "MTS MBlaze Ultra Wi-Fi / ZTE AC3633 Exploit" print "Vulnerabilities" print "Login Bypass | Router Credential Steali...

Memorial Web Site Script - Reset Password & Insecure Cookie Handling

No description provided by source. ----------------------------------------------------------------------- Memorial Web Site Script -- Reset Password & Insecure Cookie Handling ----------------------------------------------------------------------- Author : Chip D3 Bi0s Email :...

HackerOne: Account takeover

Hello, I found another bug on hackerone. This time it is very dangerous and creative. Hope you will definitely love it. Any valid account on hackerone can be hacked. eg Co-founders @jobert and @michiel can also be hacked. I tried this one on my account only. Lets go to the point ... Things requir...

HackerOne: Spamming any user from Reset Password Function

It is possible to spam any user whose email-id is known. This can be combined with csrf attack i.e automated to send 50 emails with a click. This is reset password form --- Forgot password To retrieve your password enter the email address you used to sign up. Here, authencity token can be used mo...

Default credentials

modules/Users/ForgotPassword.php in vTiger 6.0 before Security Patch 2 allows remote attackers to reset the password for arbitrary users via a request containing the username, password, and confirmPassword parameters...

IRCCloud: Leaking Referrer in Reset Password Link

I have found that you are leaking via the referrer the reset password link. I am attaching the photo as proof of concept that the site is indeed leaking the reset password link via the referrer. Thats when someone loads the reset password link and decided to click on external links. Its the time...

CVE-2013-4962

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

Using Tumblr app on iPhone ? Reset you Tumblr password now

Tumblr posted a blog post Tuesday night warning users to change their passwords and released a very important security update for iOS users after identifying a breach that compromised their passwords. It seems that, under certain circumstances, the prior versions of the iPhone and iPad apps would...