@keystone-6/core's bundled cuid package known to be insecure

Summary The cuid package used by @keystone-6/ and upstream dependencies is deprecated and marked as insecure by the author. As reported by the author Cuid and other k-sortable and non-cryptographic ids Ulid, ObjectId, KSUID, all UUIDs are all insecure. Use @paralleldrive/cuid2 instead. What are...

Design flaws at fast breakfast app login

Fast Breakfast APP is a mobile service software. There is a design vulnerability in the login of Fast Breakfast App, which uses a timestamp to verify whether a user is logged in, and takes the MD5 value of the first 10 digits of the timestamp to mark whether the user is logged in or not; and ther...

金蝶云之家博客任意用户密码重置

简要描述： 详细说明： 地址： http://kdweibo.com/home 依次点击： 登陆--忘记登陆密码 然后登陆邮箱查看重置链接是否存在缺陷 上图中可看到，请求链接存在u和t的参数： 尝试数次后可观察到，u是固定不变的，大概是userName相关的串，而t是有规律的递增。 紧接着尝试重置密码的操作，发现u这个参数是无用的，post请求只发送一个t参数和表单中的新密码，如下图： 好了，现在我们开始研究这个t参数。在找回密码的第一个页面，连续数次提交我的邮箱地址，获取到5个重置密码的链接，把他们列在下面观察一下： 可以看出，t参数只有5-8位...