PT-2024-35079

Name of the Vulnerable Software and Affected Versions Password Pusher versions v1.41.1 through v1.48.0 Description A cross-site scripting XSS vulnerability was identified in the Password Pusher application. The issue arises from an un-sanitized parameter which could allow attackers to inject...

BIT-MOODLE-2021-36402

In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...

Moodle < 3.9.24, 3.11.x < 3.11.17, 4.0.x < 4.0.11, 4.1.x < 4.1.6, 4.2.x < 4.2.3 Multiple Vulnerabilities

Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

GHSA-GV8F-43PG-C5QW Moodle Improper Input Validation vulnerability

In affected versions of Moodle, users' names require additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. This issue has been patched in versions 3.9.8, 3.10.5 and 3.11.1...

Design/Logic Flaw

In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...

UBUNTU-CVE-2021-36402

In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...

CVE-2021-36402

In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...

CVE-2021-36402

In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...

CVE-2021-36402

In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...

CVE-2021-36402

Technical details (affected Moodle versions, remediation, exploitability) are not provided in the connected documents. Monitor for updates from official advisories; current entries reiterate a sanitization risk in Moodle account confirmation emails without further specifics.

CVE-2021-36402: Improper Input Validation

In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...

SUSE CVE-2015-3176

The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote attackers to obtain sensitive full-name information by attempting to self-register...

GHSA-FQRG-VMVJ-JV3X Moodle allows attackers obtain full-name information

The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote attackers to obtain sensitive full-name information by attempting to self-register...

PT-2021-3692

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.9.8 Moodle versions prior to 3.10.5 Moodle versions prior to 3.11.1 Description The issue in Moodle is related to insufficient input validation, which may allow a remote attacker to obtain confidential information...

Acronis: Account Confirmation bypass leads to acess some fucntionality

STEPS: 1. Go to the URL https://account.acronis.com//auth/signup 2. Create a Business Account 3. Intercept the request using burp suite 4. Now intercept the response of given HTTP REQUEST below 5. Change the field "confirmed":false to true 6. Even you can bypass Accept term condition by changing...

Authorization Bypass

strapi is vulnerable to authorization bypass. The vulnerability exists as the email templates are improperly stored in a global variable, allowing the password reset and account confirmation email templates to be updated...

UBUNTU-CVE-2019-16109

An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmationtoken, if a database record has a blank value in the confirmationtoken column. However, there is no scenario within Devise itself in which such database records wou...

CVE-2019-16109

CVE-2019-16109 affects Plataformatec Devise before 4.7.1. The flaw allows account confirmation when a request carries a blank confirmation_token and a database record has a blank token, though there is no scenario within Devise where such records would exist. Red Hat/NVDOSV/Nessus attest to the s...

CVE-2019-16109

An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmationtoken, if a database record has a blank value in the confirmationtoken column. However, there is no scenario within Devise itself in which such database records wou...

PT-2019-14515

Name of the Vulnerable Software and Affected Versions Plataformatec Devise versions prior to 4.7.1 Description An issue was discovered that confirms accounts upon receiving a request with a blank confirmation token, if a database record has a blank value in the confirmation token column. However,...