1615 matches found
Flyspray stored cross-site scripting vulnerability (CNVD-2017-30492)
Flyspray is a lightweight, web-based, bug tracking system written in PHP to assist in software development and project management. Flyspray suffers from a stored cross-site scripting vulnerability that allows authenticated users to gain administrator privileges by injecting JavaScript into...
Gratipay: Adding Used Primary Email Address to attacker account and Account takeover
Summary I just found that the Gratipay is vulnerable for adding used Primary Email Address to attacker account and Account takeover of the Gratipay. Description I was looking at the source code of the application and I found that, "If the email address [email protected] is already added in the X...
Email address is not validated when updating user profile
On the view profile page /secure/ViewProfile.jspa it's possible to update your user profile /secure/EditProfile!default.jspa?username=admin to an invalid email address. See attached screenshots. !Screen Shot 2017-09-28 at 2.49.48 PM.png|thumbnail! !Screen Shot 2017-09-28 at 2.49.58...
Legal Robot: I cant login to my account
hey sir , new issue found when i reset my pass to my mail address [email protected] its done. but when i try to signin it says password is not same as mail address. i have changed my password successfully as my mailaddress , but it wont let me to login...
Cross-Site Scripting (XSS)
swiftmailer/swiftmailer is vulnerable to cross-site scripting XSS. The vulnerability exists because \lib\classes\Swift\Mime\Headers\MailboxHeader.php uses unfiltered email address to print in the error message...
CVE-2017-12646
XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address...
CVE-2017-11726
services/systemio/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery CSRF, as demonstrated by changing an e-mail address setting...
Legal Robot: [UX] Notify user on likely email address typo
A security researcher let us know about a useful enhancement to our user experience: notify users when we find a likely typo in an email address, for example, [email protected] likely has a transposition of the a and the m in gmail.com. While it is impossible to check every domain, we can catch a...
PHPMailer XSS Vulnerability
PHPMailer is prone to a cross-site scripting vulneragility in the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
Cross site scripting
PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of codegenerator.php...
DEBIAN-CVE-2017-11503
PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of codegenerator.php...
CVE-2017-11503
PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of codegenerator.php...
CVE-2017-11503
PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of codegenerator.php...
CVE-2017-11503
PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of codegenerator.php...
CVE-2017-11503
PHPMailer 5.2.x contains a cross-site scripting vulnerability tracked as CVE-2017-11503 in the code_generator.php example, where user input was not properly filtered in the From Email Address and To Email Address fields. Affected release cited: PHPMailer 5.2.23. Public references in multiple juri...
Zomato: Login to any account with the emailaddress
Introduction An attacker just needs to supply an email address to gain a valid access token for the Zomato applications. Thus any account on Zomato can be fully accessed with just the email address. Endpoint /v2/auth.json Impact Critical, without any user interaction an attacker can access any...
arxius: Missing Rate Limit for Password Reset Verification - Vulnerable to brute force
Description The password reset verification do not seem to contain rate limit which is implemented in the email verification on sign up. The password reset link looks like this: https://arxius.io/password/EMAIL%40DOMAIN.COM/RESTTOKEN On clicking the link, it prompts to enter a new password. When...
Debian DSA-3882-1 : request-tracker4 - security update
Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-6127 It was discovered that Request Tracker is vulnerable to a cross-site scripting XSS...
Cuvva: Verification code for Underwriter dashboard can be brute-forced
Hi Cuvva, On the page of Underwriter dashboard https://underwriter.partner.cuvva.com/login/verify, the first option is to enter the email address of the person having the access to dashboard. I entered the email address of the guy whose email address was getting displayed in the bug:...
Error: "Your account cannot be added using this server address" When Adding a Store on Receiver
The following error is seen whileadding a store on Citrix Receiver: "Your account cannot be added using this server address. Make sure you entered it correctly. You may need to enter your email address instead."...