CVE-2017-11422: Incorrect Permission Assignment for Critical Resource

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc...

Internet Bug Bounty: Roundcube virtualmin privilege escalation (CVE-2017-8114)

Description Password plugin in its virtualmin driver allows to an attacker, that has a valid username/password to login in his web panel, to execute malicious inputs. This could allow to an attacker to reset victim's password and in some scenarios getting a system shell. CVE CVE-2017-8114 Details...

CVE-2016-3084

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple...

CVE-2016-3084

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple...

CVE-2016-3084

CVE-2016-3084 affects the Cloud Foundry UAA password reset flow, vulnerable to brute force when using the internal UAA user store. The issue occurs due to multiple active reset codes at a given time and does not apply to deployments using SAML/LDAP. Affected products/versions include Cloud Foundr...

CVE-2016-3084

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple...

PT-2017-8327

Name of the Vulnerable Software and Affected Versions Cloud Foundry versions prior to v236 UAA versions prior to v3.3.0 UAA versions prior to v10 Login-server all versions Pivotal Elastic Runtime versions prior to 1.7.2 Description The UAA reset password flow is vulnerable to a brute force attack...

Weblate: Takeover of an account via reset password options after removing the account

Hi, The Reset password mechanism can't validate or authenticate an user properly. After removing a user account it's possible to takeover the user account by using reset password option. which is turn into takeover an account. Step to Reproduce: 1. Go to weblate 2. Remove your account from weblat...

Weblate: Spamming any user from Reset Password Function

It is possible to spam any user whose email-id is known. csrfmiddlewaretoken token can be used more than one. Users can be spammed heavily by just Brute force attack on password reset page. Implementtion: Implement a Captcha...

Trend Micro Threat Discovery Appliance 2.6.1062r1 logoff.cgi Directory Traversal Exploit

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a logoff.cgi directory traversal authentication bypass vulnerability. !/usr/local/bin/python """ Trend Micro Threat Discovery Appliance = 2.6.1062r1 logoff.cgi Directory Traversal Authentication Bypass Vulnerability...

Wallacepos Cross-Site Scripting Vulnerability

wallacepos is a web-based POS system. A cross-site scripting vulnerability exists in wallacepos version 1.4.1, which stems from the program's failure to adequately filter user data submitted to wallacepos-master/myaccount/resetpassword.php. A remote attacker can exploit this vulnerability to...

CVE-2016-9081: Undefined Security Weakness

Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via unspecified vectors...

Error session termination mechanisms lead to account hijacking-vulnerability warning-the black bar safety net

Error session termination mechanisms Session termination is to secure the session period in one important aspect. Security implementation session tokens can effectively reduce the session hijacking attack. The session is terminated as the number of attack control mechanisms, such asXSS（cross-site...

Boozt Fashion AB: Email link poisoning / Host header attack

Description ------------- It is possible to poison the link of the password reset email. This is generally done by altering the Host header, but in this case, the WAF is successfully blocking it. The trick here is to add an X-Forwarded-Host header in the request so the server is using this value...

CareMonkey - Reset Password Token Remote Vulnerability

Document Title: =============== CareMonkey - Reset Password Token Remote Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1926 Video: https://www.youtube.com/watch?v=cnwmQAUI7ik Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1873 Release Date:...

Bug Tracker 2.7.1 Information Disclosure

======================================================================== | Title : Bug Tracker V 2.7.1 database disclosure vulnerability | Author : indoushka | email : [email protected] | Tested on: windows 8.1 Français V.Pro | Vendor : https://www.twbsd.org/demo/...

Ladesk Agent Session Reset Password

Document Title: =============== Ladesk Agent 1 Bug Bounty - Session Reset Password Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1849 Release Date: ============= 2016-06-27 Vulnerability Laboratory ID VL-ID:...

Authorization

The RPC API in the RSCD agent in BMC BladeLogic Server Automation BSA 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure...

Facebook Fixes Instagram Vulnerability That Opened 1M Accounts to Compromise

Facebook was quick to fix an issue earlier this month that could’ve let an attacker break into four percent of all active, locked Instagram accounts, meaning it affected approximately one million users. Belgium-based IT security consultant Arne Swinnen discovered the issue two weeks ago when he...

Veris: Password(s) can be found via login process.

Hello security team, It is possible to find passwords of other users by enumerate the login process. The scenario is quiet simple: 1 Go to https://sandbox.veris.in/portal/login/ 2 Fill in 'Email ID' and 'Password' and click 'Log In' 3 Capture the request via burp suite and send it to intruder. 4...