CVE-2021-36402

In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...

CS Money: Html injection on subscription email

Vulnerability description not provided...

CVE-2020-13342

An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email...

CVE-2020-13342

An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email...

CVE-2020-13342

An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email...

CVE-2020-13342

An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email...

CVE-2020-13342

Removed by vendor...

CVE-2020-13342

CVE-2020-13342 affects GitLab prior to 13.2.10, 13.3.7, and 13.4.2 due to a lack of rate limiting on re-sending confirmation emails. This could enable abuse of the email-sending flow. The documented impact is LOW (CVSS 3.1: 2.7; NETWORK / HIGH privileges required; user interaction NONE). Remediat...

CVE-2020-13342: Allocation of Resources Without Limits or Throttling

An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email...

Nextcloud: No rate limiting for confirmation email lead to huge Mass mailings

Issue Description No rate limit means their is no mechanism to protect against the requests you made in a short frame of time. If the repetition doesn't give any error after 50, 100, 1000 repetitions then their will be no rate limit set. vulnerable has registred in 297359 774050 922470 URL Effect...

InnoGames: Stored XSS on recruit.innogames.de

Summary: When applying for a Supporter/Moderator job at recruit.innogames.de the drop-down field "Position" is vulnerable to a stored XSS as the content is not validated. Description: Steps To Reproduce: 1. Visit https://recruit.innogames.de/staemme/de/index/page/show/apply 2. Fill out all requir...

Yelp: No rate limiting for confirmation email lead to email flooding

Description: There is no rate limiting implemented in sending the confirmation email. Thus, attacker can use this vulnerability to bomb out the email inbox of the victim. Affected URL: https://biz.yelp.com/welcome/resendconfirmation with POST method Details: 1. Login to biz.yelp.com 2. Go to...

Stripo Inc: No CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email address

Summary: There's no CSRF protection in confirmation email resending feature as a result of which an attacker can trick the victim to receive a confirmation email unknowingly. In other features of the website, the content-type must be "application/json", and there is same-origin policy, which...

WordPress woo-confirmation-email plugin has unspecified vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. woo-confirmation-email is a plugin used in it to send email verification code. A security vulnerability exists in the WordPress...

CVE-2018-21007

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...

CVE-2018-21007

The CVE-2018-21007 entry affects the WordPress plugin woo-confirmation-email before version 3.2.0 . The vulnerability is an authorization flaw: the plugin does not block direct access to supportive files/folders inside the WordPress uploads directory, exposing potentially sensitive uploaded conte...

CVE-2018-21007: Improper Access Control

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads...

Woo Confirmation Email < 3.2.0 - Missing Access Controls to View Uploaded files

The User Email Verification for WooCommerce WordPress plugin was affected by a Missing Access Controls to View Uploaded files security vulnerability...

Weblate: 2nd issue>>> flood of email no rate limit on delete account confirmation email >>

There was no rate limit on delete account confirmation email, leading to user being able to send himself flood of emails...

WakaTime: No rate limiting for confirmation email, can spam anyone with confirmation emails

Hello, there is no rate limiting implemented in sending the confirmation email. Thus, attacker can use this vulnerability to bomb out the email inbox of the victim. Proof of Concept : 1. Register a account in wakatime.com 2. Login to account and go to https://wakatime.com/settings/account 3. Unde...