Shopify: Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation

Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation Summary This report is based on the scenario that email confirmation has been bypassed already, like shown in 791775. What happened in 791775 was, I was too excited and didn't take a step...

Shopify: [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation

Summary In 791775, I submitted a bug at Sunday 5pm Canada time, it was triaged two hours later, and I got the temp fix message at around 3am the next day in Canada time. Truly awesome, the next day I retested after the first fix, and found that I - Cannot receive the email confirmation in the ema...

Shopify: Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO

I told Pete I would take a look at Spotify, hi Pete. Summary It's possible to take over any store account through bypassing the email confirmation step in .myshopify.com. I found a way to confirm arbitrary emails, and after confirming arbitrary email in .myshopify.com, user is able to integrate...

Magento Security Bypass Vulnerability (CNVD-2019-40829)

Magento is an open source PHP e-commerce system from the U.S. company Magento. A security bypass vulnerability exists in Magento. An attacker can exploit this vulnerability to bypass the email confirmation mechanism via a GET request capturing the relevant account data obtained from the POST...

CVE-2019-8112

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation...

CVE-2019-8112

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation...

CVE-2019-8112

CVE-2019-8112 affects Magento Open Source/Commerce: unauthenticated attackers can bypass email confirmation via a GET request, leveraging data from the POST response during new user creation. Affected versions are Magento 2.2 prior to 2.2.10 and Magento 2.3 prior to 2.3.3 or 2.3.2-p1. The documen...

Shopify: Add store to new partner account without confirming email address.

Details When a someone signs up for a new account on partners.shopify.com they are asked to confirm their email address before they can do anything and by anything I mean add stores, invite members, use affiliate tools and so on. Apparently they can leverage an issue on partners.shopify.com to...

foilChat Sign Up Email PIN Confirmation Bypass

foilChat sign up email PIN confirmation bypass ============================================== https://sintonen.fi/advisories/foilchat-signup-email-pin-confirmation-bypass.txt Overview -------- foilChat https://www.foilchat.com/ allows anyone to register with any email address due to a...

QIWI: https://fundl.qiwi.com CSRF на подтверждении sms

Доброго времени суток. Я тут нашел достаточно серьезную CSRF, как мне кажется. Она позволяет привязать номер телефона злоумышленника - угнать деньги. И основана она отчасти на старой CSRF, которую я репортил совсем недавно https://hackerone.com/reports/300676 Так вот, тогда я не доглядел еще одну...

Code injection

An issue was discovered in SAP E-Recruiting aka ERECRUIT 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and...

CVE-2017-14511

An issue was discovered in SAP E-Recruiting aka ERECRUIT 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and...

CVE-2017-14511

CVE-2017-14511 affects SAP E-Recruiting (ERECRUIT) versions 605 through 617. An external applicant who registers receives an email verification link, but the verification mechanism can be bypassed, allowing attackers to register and confirm email addresses they do not own. The underlying issues c...

CVE-2017-14511

An issue was discovered in SAP E-Recruiting aka ERECRUIT 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and...

WakaTime: previous token seems to work even though it does not verify email

Hi there , Summery : --------------------- the same confirmation token can be reused for the email address , wheres the previous token and the new token are not same . while the user tries to confirm his email with previous token , it will be confirmed . which means that token does not expires...

Login Restriction Bypass

Moodle is vulnerable to login restrition bypasses. A malicious user with a suspended account is still able to login by confirming their email if they have yet to confirm it...

PornHub: Email Confirmation Bypass

Reporter : Vaxo Dai @0x00 After signing up client needs to verify his email address to further use but the confirmation can be bypassed and can put any email address to confirm the user account idname&code=code Here, user can get this id name using pornhub.com/users/username and viewing the sourc...

New Relic: no email confirmation on signup

the email confirmation is not taken anyone can make newrelic account from any email address...

Legal Robot: Rate limiting on Email confirmation link

Security researcher discovered a potential issue where no rate limiting was applied to sensitive functions, like email reconfirmation links...

Coinbase: New Device Confirmation, token is valid until not used.

New Device Confirmation token sends to the logged in user from unconfirmed device. Now If Click on Account or Settings or Profile email of new token will send to that person and same if user click multiple times, more and more confirmation emails user received. On each reload each confirmation...