CVE-2018-8916

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification...

CVE-2018-9934

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...

CVE-2018-9934

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...

Design/Logic Flaw

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...

MetInfo Arbitrary Password Change Vulnerability

MetInfo using PHP + Mysql architecture, is a very SEO-friendly, full-featured, support for multi-language, responsive display, extremely suitable for business, corporate website construction cms station-building system. The reset password function in MetInfo 6.0 has an arbitrary password change...

CVE-2018-9934: Undefined Security Weakness

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...

PT-2018-19097

Name of the Vulnerable Software and Affected Versions MetInfo version 6.0 Description The issue concerns the reset-password feature, which allows remote attackers to change arbitrary passwords. This is achieved through vectors involving a modified Host HTTP header that specifies a web server unde...

PrestaShop User Enumeration Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A security vulnerability exists in PrestaShop version 1.7.2.4. An attacker can exploi...

CVE-2018-5682

PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message...

Design/Logic Flaw

PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message...

CVE-2018-5682

PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message...

PT-2018-17081

Name of the Vulnerable Software and Affected Versions: PrestaShop version 1.7.2.4 Description: The issue allows user enumeration via the Reset Password feature. This is achieved by noticing which reset attempts do not produce a "This account does not exist" error message. Recommendations: For...

CVE-2018-5682: Exposure of Sensitive Information to an Unauthorized Actor

PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message...

DeDeCMS v5.7 SP2 official version of the foreground any user password change vulnerability

DedeCms woven dream content management system is a PHP open source website management system. DeDeCMS v5.7 SP2 official version of the foreground there are arbitrary user password change vulnerability. The vulnerability is due to the foreground resetpassword.php on the acceptance of the parameter...

Sendroid < 6.5.0 - SQL Injection

Exploit Title: Sendroid - Bulk SMS Portal, Marketing Script 5.0.0 - 6.5.0 - SQL Injection Google Dork: "welcome to SMS portal" Date: 22/12/2017 Exploit Author: Onwuka Gideon Contact: http://twitter.com/@gideononwuka Vendor Homepage: http://ynetinteractive.com/ Software Buy:...

PT-2017-18160

Name of the Vulnerable Software and Affected Versions Huawei Honor 5S versions prior to TAG-TL00C01B173 Description The issue is due to the improper design of some components, leading to an authentication bypass. This allows an attacker to install malicious apps on a user's smart phone, enabling...

CVE-2017-8151: Improper Authentication

Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have an authentication bypass vulnerability due to the improper design of some components. An attacker can get a user's smart phone and install malicious apps in the mobile phone, allowing the attacker to reset the...

Legal Robot: Add arbitrary value in reset password cookie

I recently discovered that we can add arbitery value in reset pass token and compromise the life time unlimitedly .. After opening a reset password link I got these cookies ....for token expires timeout . "domain": ".app.legalrobot.com", "expirationDate": 1504618468.82726, "hostOnly": false,...

CVE-2017-11422

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc...

CVE-2017-11422

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc...