X (Formerly Twitter): Improper Verification of email address while saving Account Settings

Signup for Ads on twitter and navigate to "Account Settings" on ads.twitter.com/accounts Enter any email address and save Account Settings. Notice that the email address gets updated successfully. There is no verification email that is sent out to confirm that the email account updated actually...

CVE-2014-4963

Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action...

CVE-2014-4963

Shopizer 1.1.5 and earlier is affected by CVE-2014-4963: remote attackers can modify account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action. This occurs in the web-facing register/profile flow and enables partial confidentiality/integrity impact ...

Seattle Lab Software Emurl 2.0 Email Account Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1203/info Emurl software creates a unique identifier for each user, based on their account name. This identifier is encoded using the ascii value of each character in the account name and augmented by its position. By usi...

IceWarp Web Mail 5.3 accountsettings_add.html accountid Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/12396/info Multiple remote vulnerabilities reportedly affect IceWarp Web Mail. The underlying issues are due to input and access validation errors. Multiple cross-site scripting and HTML injection vulnerabilities affect t...

Localize: Stored XSS

Hey!! Steps to reproduce : 1 while making account add xss payload in username like : " 2 login using this . 3 Go to settings tab http://www.localize.io/pages/settings 4 XSS ll get executed . Attached PoC . Daksh...

Slack: CSRF vulnerability on https://sehacure.slack.com/account/settings

Hi, The CSRF token is not getting expired for a user.This can led to username change and many other account change information as well. To reproduce the issue: 1 Login into your Slack.com account 2 Go to this URl https://sehacure.slack.com/account/settings 3 Inspect element Copy your anti CSRF...

HackerOne: Logical issues with account settings

earlier email was not allowed to change ,but now there is no verification on changing email. when user try to change the password , they were asked to verify the request by entering old password. For the same reason a verification should be there on changing email.The worst part is hackone send...

CVE-2012-5898

Cross-site request forgery CSRF vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for requests that change account settings...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for requests that change account settings...

CVE-2012-5898

Cross-site request forgery CSRF vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for requests that change account settings...

CVE-2012-5898

The CVE-2012-5898 entry describes a CSRF vulnerability in SAMEDIA LandShop 0.9.2 that can allow an attacker to hijack an administrator’s session to issue requests that change account settings. The connected documents confirm the affected product/version and the nature of the vulnerability but do ...

CVE-2012-1901

Multiple cross-site request forgery CSRF vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to 1 hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or 2 hijack the authentication of administrators for requests...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to 1 hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or 2 hijack the authentication of administrators for requests...

CVE-2012-1901

Multiple cross-site request forgery CSRF vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to 1 hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or 2 hijack the authentication of administrators for requests...

How to troubleshoot CIM hardware monitoring

Challenge The CIM API allows Veeam products to receive up-to-date information without requesting hardware refreshes, but this requires a separate connection, and if that connection cannot be made, the hardware data will be collected as it was in earlier versions, and request periodic hardware...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin/settings/update in DClassifieds 0.1 final allows remote attackers to hijack the authentication of administrators for requests that modify account settings such as the administrator password or email via certain Settings parameters...

SeoPanel (v.3.0.0-Released) Multiple XSRF Vulnerabilities

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

seoPanel 2.2.1 Cross Site Request Forgery

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

Wolf CMS (v.0.7.5) Multiple CSRF Vulnerabilities

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...