CVE-2022-31185

CVE-2022-31185 affects the mprweb hosting platform (makedeb Package Repository). The issue is an information-disclosure where email addresses were not hidden as configured, potentially leaking user emails. The vulnerability is mitigated for official mprweb instances, while self-hosted deployments...

mprweb 信息泄露漏洞

mprweb is a makedeb package repository MPR hosting platform open-sourced by makedeb. An information disclosure vulnerability exists in previous versions of mprweb d13e3f2f5a9c0b0f6782f35d837090732026ad77, which stems from an email address that is not hidden...

CVE-2022-37010

In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed...

CVE-2022-37010

CVE-2022-37010 affects JetBrains IntelliJ IDEA prior to 2022.2, due to missing email address validation in the "Git User Name Is Not Defined" dialog. Root cause: absence of validation in that dialog as described in multiple sources (NVD/Red Hat/CVE records, PT-2022-23755). Reported impact is low ...

WordPress OAuth Single Sign On plugin authorization issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

CVE-2022-2133

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address...

Stripe: Mass account takeover!

@akashhamal0x01 discovered an Organization Owner could update the email address of a member of their organization in TaxJar. This could have allowed an attacker to take over a victim’s account if the victim belonged to the attacker’s organization. The vulnerability was caused by the ability to ed...

ILIAS <= 7.23 Account Takeover Vulnerability

ILIAS is prone to an account takeover vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ilias:ilias"; if description...

PYSEC-2022-43186

In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through...

PT-2022-20538 · Unknown · Canarytokens

Name of the Vulnerable Software and Affected Versions: Canarytokens affected versions not specified Description: A Cross-Site Scripting vulnerability was identified in the history page of triggered Canarytokens. This permits an attacker who recognised an HTTP-based Canarytoken a URL to execute...

CVE-2022-31266

In ILIAS through 7.10, lack of verification when changing an email address on the Profile Page allows remote attackers to take over accounts...

Default credentials

In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address...

Design/Logic Flaw

In ILIAS through 7.10, lack of verification when changing an email address on the Profile Page allows remote attackers to take over accounts...

CVE-2022-31266

In ILIAS through 7.10, lack of verification when changing an email address on the Profile Page allows remote attackers to take over accounts...

CVE-2022-31266

CVE-2022-31266 affects ILIAS up to version 7.10. The issue is a lack of verification when changing the email address on the Profile Page, which allows remote attackers to take over accounts. The vulnerability is documented across multiple sources (Red Hat, NVD, OSV, OpenVAS, CNNVD) with consisten...

CVE-2022-31266

In ILIAS through 7.10, lack of verification when changing an email address on the Profile Page allows remote attackers to take over accounts...

Nagios XI 访问控制错误漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A security vulnerability exists in Nagios XI version 5.8.5 and prior versions. An attacker can exploit the...

OAuth Single Sign On < 6.22.6 - Authentication Bypass

The plugin doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address. PoC POST / HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type:...

OAuth 2.0 client for SSO < 1.11.4 - Authenticated Bypass

The plugin allows attackers to login as any user by just knowing their email address PoC POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded [email protected]...

CVE-2022-1761

The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more...