The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username.
Monthly Archives: December 2015
Re: Executable installers are vulnerable^WEVIL (case 15): F-SecureOnlineScanner.exe allows arbitrary (remote) code execution and escalation of privilege
Posted by NaxoneZ . on Dec 23
I think like Shawn, this is a SO problem:
https://msdn.microsoft.com/es-es/library/windows/desktop/ff919712(v=vs.85).aspx
Anyway the developers can mitigate this issue following the guidelines
described in article.
Regards.
2015-12-23 16:32 GMT+01:00 Shawn McMahon <syberghost () gmail com>:
Vuln: Multiple Adobe Products CVE-2015-5255 Server Side Request Forgery Security Bypass Vulnerability
Multiple Adobe Products CVE-2015-5255 Server Side Request Forgery Security Bypass Vulnerability
Vuln: Xen 'pt-msi.c' Heap Memory Corruption Vulnerability
Xen ‘pt-msi.c’ Heap Memory Corruption Vulnerability
Vuln: Xen CVE-2015-8555 Information Disclosure Vulnerability
Xen CVE-2015-8555 Information Disclosure Vulnerability
Vuln: Linux Kernel CVE-2015-8104 Denial of Service Vulnerability
Linux Kernel CVE-2015-8104 Denial of Service Vulnerability
Arastta 1.1.5 SQL Injection
Arastta version 1.1.5 suffers from a remote SQL injection vulnerability.
Grawlix 1.0.3 Code Execution
Grawlix version 1.0.3 suffers from a code execution vulnerability.
Grawlix 1.0.3 Cross Site Request Forgery
Grawlix version 1.0.3 suffers from a cross site request forgery vulnerability.
Grawlix 1.0.3 Cross Site Scripting
Grawlix version 1.0.3 suffers from a cross site scripting vulnerability.