1830 matches found
kocaeliolay.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1026681 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting kocaeliolay.com website a...
new-england-service.org Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1022959 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
72nnv.pw Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1013957 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Magento Security Bypass Vulnerability (CNVD-2019-40829)
Magento is an open source PHP e-commerce system from the U.S. company Magento. A security bypass vulnerability exists in Magento. An attacker can exploit this vulnerability to bypass the email confirmation mechanism via a GET request capturing the relevant account data obtained from the POST...
CVE-2019-8112
A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation...
CVE-2019-8113
Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code for customer registration...
CVE-2019-8112
A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation...
CVE-2019-8112
CVE-2019-8112 affects Magento Open Source/Commerce: unauthenticated attackers can bypass email confirmation via a GET request, leveraging data from the POST response during new user creation. Affected versions are Magento 2.2 prior to 2.2.10 and Magento 2.3 prior to 2.3.3 or 2.3.2-p1. The documen...
services.scielo.org Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1004255 Security Researcher logindenied Helped patch 7927 vulnerabilities Received 8 Coordinated Disclosure badges Received 76 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting services.scielo.org...
X (Formerly Twitter): http request smuggling in twitter.com
Summary: the same vulnerability reported in other domain , see this report here Description: the Description of HTTP request smuggling attacks : here Detect HTTP request smuggling attack subdomains vulnerable: -to detect HTTP request smuggling attack with add header Transfer-Encoding: chunked and...
CVE-2019-10320
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS12 certificate...
PRODSECBUG-2465: Bypass of user confirmation mechanism
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
ca.theofficejob.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-973086 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Command injection
In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run MobaXterm to handle the link. If accepted, another popup appears asking for further confirmation. If this is also accepted, command executio...
GHSA-FCJW-8RHJ-GWWC Authentication Bypass in Devise
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmationtoken, if a database record has a blank value in the confirmationtoken column. However, there is no scenario within Devise itself in which such database records wou...
QIWI: hard-use account takeover qiwi.com
It was possible to brute force guessable confirmation token id due to an auth flaw...
Insecure Account Confirmation Mechanism
devise contains an insecure account confirmation mechanism. When an account has a blank string in the confirmationtoken field in the database, the application would confirm the first account after receiving a request with a blank confirmationtoken parameter...
CVE-2019-16109
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmationtoken, if a database record has a blank value in the confirmationtoken column. However, there is no scenario within Devise itself in which such database records wou...
UBUNTU-CVE-2019-16109
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmationtoken, if a database record has a blank value in the confirmationtoken column. However, there is no scenario within Devise itself in which such database records wou...
CVE-2019-16109
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmationtoken, if a database record has a blank value in the confirmationtoken column. However, there is no scenario within Devise itself in which such database records wou...