HackerOne: People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed

Summary: It's possible to gather basic information on potential employees at the very least who interviewed via old sample reports not being removed from the program Description: This report is meant to provide awareness of potentially private data being accessed by potential candidates. When giv...

Vanilla: disclosure of email by sending a message.

Summary: When you send a message, the E-mail field is created. Thus, through the format of json, we can see the email of the user to whom we sent the letter Description: Steps to reproduce: 1. Create a message, select the user whose mail we want to open. F273484 F273485 2. Send a message and add...

FreeBSD : GitLab -- multiple vulnerabilities (e72a8864-e0bc-11e7-b627-d43d7e971a1b)

GitLab reports : User without access to private Wiki can see it on the project page Matthias Burtscher reported that it was possible for a user to see a private Wiki on the project page without having the corresponding permission. E-mail address disclosure through member search fields Hugo Geoffr...

GitLab -- multiple vulnerabilities

GitLab reports: User without access to private Wiki can see it on the project page Matthias Burtscher reported that it was possible for a user to see a private Wiki on the project page without having the corresponding permission. E-mail address disclosure through member search fields Hugo Geoffro...

HackerOne: Emails of invited collaborators are disclosed in full in payload for report participants

Summary: Hackerone added new feature in which hackers can add collaborators to their reports. this can be done using two ways: 1. by email address 2. by user name adding hackers using their email address doesn't disclose the email address of the hacker and every participant will see something lik...

Tulpar - Web Vulnerability Scanner

Tulpar is a open source web vulnerability scanner for written to make web penetration testing automated. Features Sql Injection GET Method XSS GET Method Crawl E-mail Disclosure Credit Card Disclosure Whois Command Injection GET Method Directory Traversal GET Method File Include GET Method Server...

WakaTime: Users with member privilege are able to see emails and membership information of other users

Description: According to the rules of Leaderboard Teams only Owners and admins have access to other team members' personal information like email address, roles etc. Users whose role set as "Member" can't see other users' details. But through API it is possible for a user with member role to...

U.S. Dept Of Defense: Sensitive Email disclosure Due to Insecure Reactivate Account field

Summary: An attacker could discover the emails of accounts on ██████ through the reset field. Description: https://████/███/accounts/requestreactivation/ This password reset field has no rate limiting, it additionally allows an attacker to guess at user accounts such as admin and it will then...

Informatica: [marketplace.informatica.com] User email disclosure

Researcher has identified a vulnerability in one of our domain "marketplace.informatica.com" where anyone can see email ID of any user which is marked as "private"...

Paragon Initiative Enterprises: Directory Disclose,Email Disclose Zendmail vulnerability

i found three vulnerability Directory information disclose,Email address disclose, and possible Remote code execution in Zendmail during signup your code accept username with ',",/,@ while all of the special character must be forbidden or encoded in username Directory Disclose: 1. goto sign-up pa...

Weblate: Already Registered Email Disclosure

Hello, In the registration at https://hosted.weblate.org/accounts/register/ , I found that trying an already used email would inform the register that you are trying used one, so with a dictionary of emails a hacker can determine the emails of all users in database and use that in phishing. Note:...

GitLab exposed high-risk vulnerability that can be caused by the private token and other sensitive information disclosure-vulnerability warning-the black bar safety net

! GitLab yesterday released a 8. 17. 4 and 8.16. 8 and 8. 15. 8 version of the Community Edition and Enterprise Edition, fix multiple high-risk vulnerabilities, including one for a critical information disclosure vulnerability Update Patch for SSRF attack protection, as well as for can lead to th...

Coinbase: Requestor Email Disclosure via Email Notification

When a Coinbase user requests money from another coinbase user, the user that receives the request sees an email that says, in part: John Smith [email protected] sent you a request to pay 1 BTC using Coinbase. Where John Smith is the sending account's display name meaning you can make it whatever you...

HackerOne: Disclose any user's private email through API

Description: I have found a security vulnerability that allows an attacker to disclose any user's private email. An attacker can disclose any user's private email by creating a sandbox program then adding that user to a report as a participant. Now if the attacker issued a request to fetch the...

Pi-Hole Web Interface 2.8.1 - Persistent Cross-Site Scripting in Whitelist/Blacklist

Exploit Title: Pi-Hole Web Interface Stored XSS in White/Black list file Author: loneferret from Kioptrix Product: Pi-Hole Version: Web Interface 1.3 Web Interface software: https://github.com/pi-hole/AdminLTE Version: Pi-Hole v2.8.1 Discovery date: July 20th 2016 Vendor Site: https://pi-hole.net...

Nextcloud: Email ID Disclosure.

Hey There When A User Share Link With EMAIL TO A PERSON Option. Screenshot Reveals User's Email Address. Steps To Repro: 1 Type Any Username Their that Exists. Screenshot 2 You Will See Email Disclosed. Thanks :...

Moodle < 2.7.13 / 2.8.x < 2.8.11 / 2.9.x < 2.9.5 / 3.0.x < 3.0.3 Multiple Vulnerabilities

Binary data 9194.prm...

Moodle Design Bugs

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in Moodle version 2.8.x prior to 2.8.11, which stems...

WordPress Easy Author Image Plugin <= 1.5 - Email Disclosure

This plugin is prone to an email disclosure vulnerability. Solution There is no fixing, because plugin is no longer be maintained...

Easy Author Image 1.5 - Email Disclosure

When the plugin, "Easy Author Image" is used in a Wordpress site to handle user comments, what it does is put the email address of the commentator in the "alt" field of the user's avatar...