CVE-2017-14511

An issue was discovered in SAP E-Recruiting aka ERECRUIT 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and...

Hiro: No Confirmation Email For Email Change

https://forum.blockstack.org/u/username/preferences/email Hello, it looks like there is a security flaw in this part. While changing email address from email1 to email2. A Confirmation email is sent to email2 not to email1 which is the main account. This can lead to account lost if someone has us...

Threat Outbreak Alert RuleID30545: Email Messages Distributing Malicious Software on September 8, 2017

Medium Alert ID: 55160 First Published: 2017 September 8 13:41 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30545 may contain the following files: Name |...

Multiple Vulnerabilities Found in NVIDIA, Qualcomm and Huawei's Bootloaders

Six exploitable flaws in chipsets used by Huawei, Qualcomm, MediaTek and NVIDIA were found in popular Android handsets, according to a report by University of California at Santa Barbara computer scientists. Each of the flaws exist in phones sold by Huawei, Sony and Google, and are tied to each o...

GSA Bounty: 2FA bypass - confirmation tokens don't expire

Hi there, Because of the limitation of the site, accounts may be locked down for 10 minutes. I found 2 ways to bypass this lock period. First one with the confirmation mail that we get when we sign on. If we get the token this way below, we can change account password and bypass the lock period a...

WakaTime: previous token seems to work even though it does not verify email

Hi there , Summery : --------------------- the same confirmation token can be reused for the email address , wheres the previous token and the new token are not same . while the user tries to confirm his email with previous token , it will be confirmed . which means that token does not expires...

CVE-2015-4082

attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file"...

Microsoft Edge Scripting Engine Information Disclosure Vulnerability(CVE-2017-8659)

There is an issue in Chakra JIT server that can be potentially exploited to compromise the JIT process from a compromised browser content process. Bugs like this could potentially be used to bypass ACG Arbitrary Code Guard in Microsoft Edge. The issue has been confirmed on a ChakraCore build from...

glenatlivres.com XSS vulnerability

Vulnerable URL: http://www.glenatlivres.com/inscription/ Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 02.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1566802 VIP website status:| No Check glenatlivres.com...

Coinbase: Device confirmation Flaw

Devices being auto-confirmed in an unexpected way looked like a security bug but was intended functionality...

Login Restriction Bypass

Moodle is vulnerable to login restrition bypasses. A malicious user with a suspended account is still able to login by confirming their email if they have yet to confirm it...

manicdepressionrecords.com XSS vulnerability

Vulnerable URL: http://www.manicdepressionrecords.com/catalog.php?lg=fr%22%27--!%3E%3Cscript%3EalertOPENBUGBOUNTY%3C/script/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 47376...

WakaTime: No rate limiting for confirmation email, can spam anyone with confirmation emails

Hello, there is no rate limiting implemented in sending the confirmation email. Thus, attacker can use this vulnerability to bomb out the email inbox of the victim. Proof of Concept : 1. Register a account in wakatime.com 2. Login to account and go to https://wakatime.com/settings/account 3. Unde...

poppler -- multiple denial of service issues

Poppler developers report: Poppler is prone to a stack-based buffer-overflow vulnerability. Successful exploits may allow attackers to crash the affected application, resulting in denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has n...

orsoft.net XSS vulnerability

Vulnerable URL: http://www.orsoft.net/confirmation Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 7184520 VIP website status:| No Check orsoft.net SSL connection:| Grade: B...

Nextcloud: IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email

Hi Team, I Was Looking around your website and then I found a subdomain newsletter.nextcloud.com on the main page it shows us 3 Options i choose 1st that was Subscribe to our newsletter , Then I click on this Option and I was Taken to https://newsletter.nextcloud.com/?p=subscribe&id=1 The page...

Shopify: Ability to verify any email address you don't own - accounts.shopify.com

Summary: During testing it's been found that in accounts.shopify.com it's possible to change your email address to any email address that you don't own and confirm that email due to the confirmation token being leaked. Steps to reproduce: 1. Login to https://accounts.shopify.com/account 2. Click...

Weblate: Login CSRF : Login Authentication Flaw

Hi Team, Domain: demo.weblate.org In this bug, i have found a way to login any person to the attackers account, therefor when any user login to attackers account, the attacker can see the victims activity inside attackers account such as sensitive information. The issue relies on registration...

naturespath.appbuilder.spredfast.com XSS vulnerability

Vulnerable URL: http://naturespath.appbuilder.spredfast.com/fbcontests/showentry/Gardens-For-Good-1/142107/%22'--!%3E%3CImage%0CSrcset%3DK%0COnerror%3Dconfirm%60OPENBUGBOUNTY%60%0C Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.09.2017 Vulnerability type:| XSS...

pittsburghpa.gov XSS vulnerability

Vulnerable URL: http://www.pittsburghpa.gov/controller/PAFR2015/bookContent.swf?currentHTMLURL=data:text/html;base64,PHNjcmlwdD5hbGVydCgnT1BFTiBCVUdCT1VOVFknKTwvc2NyaXB0Pg== Details: Description| Value ---|--- Patched:| Yes, at 01.06.2017 Latest check for patch:| 01.06.2017 14:29 GMT Vulnerabilit...