1792 matches found
Lack Of E-Mail Verification
sylius/sylius suffers from a lack of e-mail verification. A registered and verified user in a shop is able to change it to another e-mail, without the need to re-verify on the new e-mail address...
Fedora: Security Advisory for seamonkey (FEDORA-2020-15999f707a)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Oracle Linux 8 : dovecot (ELSA-2020-3713)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3713 advisory. - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts 1866755 - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation...
Mail.ru: read new emails from any inbox IOS APP in notification center
IDOR vulnerability in notification center API as used by Mail.ru Mail application for iOS allowed to request notifications for arbitrary e-mail address...
Chamber Dashboard Business Directory < 3.3.1 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise user input when creating or editing a business in the dashboard, allowing high privilege users Editor+ to set XSS payloads in various fields. Login as an editor or admin, then add/edit a business and set the phone number as " The payload will then be executed in the...
Denial Of Service (DoS)
dovecot is vulnerable to denial of service DoS. The vulnerability exists through an uncontrolled recursion in submission, lmtp, and lda via a crafted e-mail message with deeply nested MIME parts...
CVE-2020-12100
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service resource consumption via a crafted e-mail message with deeply nested MIME parts...
CVE-2020-12100
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service resource consumption via a crafted e-mail message with deeply nested MIME parts...
Design/Logic Flaw
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service resource consumption via a crafted e-mail message with deeply nested MIME parts...
CVE-2020-12100
In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service resource consumption via a crafted e-mail message with deeply nested MIME parts...
Mail.ru: Возможность изменить поле "E-Mail для доступа в личный кабинет" у другого пользователя [corporate.city-mobil.ru]
It was possible to change e-mail address of the user via corporate.city-mobil.ru. An award for this report was distributed evenly between 956791 and 971422. Report 956791 demonstrated the vector for corporate.city-mobil.ru, 971422 demonstrated this vulnerability may have higher impact besides the...
CVE-2020-13292
In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow...
Design/Logic Flaw
In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow...
CVE-2020-13292
In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow...
CVE-2020-13292
Removed by vendor...
CVE-2020-15562
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns aka XML namespace attribute of a HEAD element when an SVG element exists...
Design/Logic Flaw
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns aka XML namespace attribute of a HEAD element when an SVG element exists...
CVE-2020-15562
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns aka XML namespace attribute of a HEAD element when an SVG element exists...
CVE-2020-15562
CVE-2020-15562 affects Roundcube Webmail and enables cross-site scripting (XSS) via a crafted HTML e-mail that uses the xmlns attribute of a HEAD element when an SVG is present. Affected releases include Roundcube Webmail < 1.2.11, 1.3.x < 1.3.14, and 1.4.x
Cross site scripting
An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users, and on the page to edit users. This is present in both the User field and the E-Mail field. On the Edit user page, the XSS is only triggered via the E-Mail field;...