Kiteworks MFT 安全漏洞

Kiteworks Mft is a software for securely managing internal and external data transfers from Kiteworks USA. A security vulnerability exists in Kiteworks MFT that could allow an unauthorized user to reset another user's password. This issue is fixed in version 7.6 and later...

Ping Identity PingFederate 安全漏洞

Ping Identity PingFederate is a flagship software-based federation server in the United States. It is used for identity management. PingFederate has a security vulnerability that stems from a faulty password reset process in the software. When a password reset or password modification process wit...

BRATA Android malware factory resets phones after stealing funds

By Waqas The new variant of BRATA malware is also capable of GPS tracking and keylogging. A malware that was… This is a post from HackRead.com Read the original post: BRATA Android malware factory resets phones after stealing funds...

GitLab 授权问题漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. An authorization issue vulnerability exists in GitLab Community Edition, which...

GSD-2021-1002350 clk: sunxi-ng: Unregister clocks/resets when unbinding

clk: sunxi-ng: Unregister clocks/resets when unbinding This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.5 by commit...

UVI-2021-1002350 clk: sunxi-ng: Unregister clocks/resets when unbinding

clk: sunxi-ng: Unregister clocks/resets when unbinding This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.5 by commit...

PT-2021-8177 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the clk component of the Linux kernel, where unbinding a CCU driver unmaps the device's MMIO region but leaves its clocks/resets and their providers registered...

CVE-2021-39204

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versio...

Indexhibit 跨站请求伪造漏洞

Indexhibit is a web-based content management system. indexhibit version 2.1.5 is vulnerable to cross-site request forgery. An attacker can use this vulnerability to arbitrarily reset the account password...

Cross-Site Request Forgery (CSRF) in babybuddy/babybuddy

✍️ Description You don't check CSRF token in following endpoint /timers/1/restart/ with PoC.html attacker able to reset timer with id equal to 1. 🕵️‍♂️ Proof of Concept // PoC.html history.pushState'', '', '/' 💥 Impact This vulnerability is capable of reset any timer...

ZOHO ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

ManageEngine ADSelfService Plus is a web-based self-service application that allows end-users to perform tasks such as password resets, account unlocks, profile information updates, etc. without relying on a help desk.Zoho ManageEngine ADSelfService Plus 6101 and earlier versions are vulnerable t...

Recycle Your Phone, Sure, But Maybe Not Your Number

Many online services allow users to reset their passwords by clicking a link sent via SMS, and this unfortunately widespread practice has turned mobile phone numbers into de facto identity documents. Which means losing control over one thanks to a divorce, job termination or financial crisis can ...

PT-2021-18027 · Unknown · Invoiceplane

Name of the Vulnerable Software and Affected Versions: InvoicePlane version 1.5.11 Description: The issue concerns a lack of rate-limiting for password reset and the use of a weak mechanism to generate reset tokens, making them predictable. Recommendations: For InvoicePlane version 1.5.11, consid...

Actively exploited vulnerability found in Pulse Connect Secure

A vulnerability has been found in Pulse Connect Secure. The vulnerability allows an unauthenticated remote malicious person able to bypass authentication and execute arbitrary code execute arbitrary code on the Pulse Connect Secure system. The vulnerability has a CVSS3.1 score of 10. Pulse Secure...

CVE-2020-13421

OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions...

How to Vaccinate Against the Poor Password Policy Pandemic

Data breaches remain a constant threat, and no industry or organization is immune from the risks. From Fortune 500 companies to startups, password-related breaches continue to spread seemingly unchecked. As a result of the volume of data breaches and cybersecurity incidents, hackers now have acce...

西门子 Mendix 安全漏洞

Mendix Forgot Password Appstore module allows users to register applications or reset their own passwords without administrator involvement. An improper access control vulnerability exists in the Siemens Mendix Forgot Password Appstore module. An attacker could exploit the vulnerability to take...

CVE-2021-21352 Predictable tokens used for password resets

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess...

Beijing Yilong Information Technology Co., Ltd Yilong Travel Network has a Logic Flaw Vulnerability

Yilong.com Information Technology Beijing Co., Ltd. is an enterprise that operates, researches, develops and produces computer hardware and software. Ltd. eLong Travel Network has a logic flaw vulnerability that can be exploited by attackers to cause arbitrary user registrations and reset arbitra...

Spotify Suffers Second Credential-Stuffing Cyberattack

Spotify streaming music aficionados are in the crosshairs of yet another credential-stuffing cyberattack, just three months after the last one. The service has forced password resets for impacted users. Cybercriminals carrying out credential-stuffing take advantage of people who reuse the same...