Input validation

An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as...

CVE-2020-26034

An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as...

CVE-2020-26034

CVE-2020-26034 affects Zammad before 3.4.1, where the Create User feature enables account enumeration: an anonymous user can guess valid email addresses because the app’s responses differ based on whether the input is associated with a valid user. This is confirmed across multiple sources in the ...

Facebook bug exposed email addresses of Instagram users

By Deeba Ahmed According to the researcher, the private information of Instagram users was just a DM away. This is a post from HackRead.com Read the original post: Facebook bug exposed email addresses of Instagram users...

Command Injection

nodemailer is vulnerable to command injection. An attacker can inject malicious command flag via recipient email addresses in sendmail transport due to lack of validation for invalid email addresses...

CVE-2020-7769 Command Injection

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails...

Ubuntu 20.04 LTS : netqmail vulnerabilities (USN-4556-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4556-1 advisory. It was discovered that netqmail did not properly handle certain input. Both remote and local attackers could use this vulnerability to cause netqmail to...

Fedora 31 : roundcubemail (2020-b1e023936e)

RELEASE 1.4.8 - Security: Fix potential XSS issue in HTML editor of the identity signature input 7507 - Managesieve: Fix too-small input field in Elastic when using custom headers 7498 - Fix support for an error as a string in messagebeforesend hook 7475 - Elastic: Fix redundant scrollbar in plai...

Fedora 32 : roundcubemail (2020-d0f8f20cfc)

RELEASE 1.4.8 - Security: Fix potential XSS issue in HTML editor of the identity signature input 7507 - Managesieve: Fix too-small input field in Elastic when using custom headers 7498 - Fix support for an error as a string in messagebeforesend hook 7475 - Elastic: Fix redundant scrollbar in plai...

GHSA-9XGP-HFW7-73RQ Authentication Weakness in keystone

There is an authentication weakness vulnerability in keystone before version 0.3.16. Due to a bug in the the default sign in functionality, incomplete email addresses could be matched. A correct password is still required to complete sign in...

CVE-2020-3472

A vulnerability in the contacts feature of Cisco Webex Meetings could allow an authenticated, remote attacker with a legitimate user account to access sensitive information. The vulnerability is due to improper access restrictions on users who are added within user contacts. An attacker on one...

CVE-2020-3472 Cisco Webex Meetings User Email Address Information Disclosure Vulnerability

A vulnerability in the contacts feature of Cisco Webex Meetings could allow an authenticated, remote attacker with a legitimate user account to access sensitive information. The vulnerability is due to improper access restrictions on users who are added within user contacts. An attacker on one...

350 million email addresses exposed on misconfigured AWS S3 bucket

By Sudais Asif It is still unclear who owned the misconfigured Amazon S3 bucket. This is a post from HackRead.com Read the original post: 350 million email addresses exposed on misconfigured AWS S3 bucket...

CVE-2020-15132 Reset Password / Login vulnerability in Sulu

In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a 400 error code is returned, along with a error message saying that this user...

CVE-2020-15132

Sulu CMS vulnerability CVE-2020-15132 affects Sulu versions prior to 1.6.35, 2.0.10, and 2.1.1. The Forget Password flow reveals whether a username exists by returning a 400 with a message when the user is not found, enabling user enumeration. Additionally, a successful Forgot Password request re...

Mail.ru: Disclosure of personal support email addresses on 'support-fleet.city-mobil.ru'

IDOR vulnerability in support-fleet.city-mobil.ru allowed to disclose the support staff e-mail addresses...

Commit Stream - OSINT Tool For Finding Github Repositories By Extracting Commit Logs In Real Time From The Github Event API

commit-stream drinks commit logs from the Github event firehose exposing the author details name and email address associated with Github repositories in real time. OSINT / Recon uses for Redteamers / Bug bounty hunters: Uncover repositories which employees of a target company is commiting code...

OkCupid Dating App Flaws Could've Let Hackers Read Your Private Messages

Cybersecurity researchers today disclosed several security issues in popular online dating platform OkCupid that could potentially let attackers remotely spy on users' private information or perform malicious actions on behalf of the targeted accounts. According to a report shared with The Hacker...

NewStart CGSL MAIN 6.01 : python3 Multiple Vulnerabilities (NS-SA-2020-0030)

The remote NewStart CGSL host, running version MAIN 6.01, has python3 packages installed that are affected by multiple vulnerabilities: - http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into...

Mattermost Server Information Disclosure Vulnerability (CNVD-2020-41498)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.7. An attacker can exploit the vulnerability to bypass security restrictions and discover email addresses...