383 matches found
The vulnerability of the FILTER_VALIDATE_EMAIL function in the phpMyFAQ web application, which allows a hacker to execute arbitrary code.
The vulnerability of the FILTERVALIDATEEMAIL function in the phpMyFAQ web application is related to the lack of security measures for the structure of the web page. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
phpMyFAQ stored Cross-site Scripting at user email
Summary The email field in phpMyFAQ's user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP's FILTERVALIDATEEMAIL function, which only validates the email format, not its content. This vulnerability enables an attacker to execute arbitrary client-side JavaScript...
GHSA-Q7G6-XFH2-VHPX phpMyFAQ stored Cross-site Scripting at user email
Summary The email field in phpMyFAQ's user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP's FILTERVALIDATEEMAIL function, which only validates the email format, not its content. This vulnerability enables an attacker to execute arbitrary client-side JavaScript...
PT-2024-2374 · Phpmyfaq · Phpmyfaq
Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.6 Description: The issue is related to the inadequacy of PHP's FILTER VALIDATE EMAIL function, which only validates the email format, not its content. This allows an attacker to execute arbitrary client-side...
Authentication flaw
Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not in the...
BIT-MATTERMOST-2021-37862
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token...
WordPress Plugin Event Tickets and Registration Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
GHSA-3HV4-R2FM-H27F Email Validation Bypass And Preventing Sign Up From Email's Owner
Summary Email validation can easily be bypassed because verifyemailenabled option enable email validation at sign up only. A user changing it's email after signing up and verifying it can change it without verification in /profile. This can be used to prevent legitimate owner of the email address...
Email Validation Bypass And Preventing Sign Up From Email's Owner
Summary Email validation can easily be bypassed because verifyemailenabled option enable email validation at sign up only. A user changing it's email after signing up and verifying it can change it without verification in /profile. This can be used to prevent legitimate owner of the email address...
Default configuration
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verifyemailenabled" will only validate email only on sign up...
Improper Authentication
Overview omniauth-microsoftgraph is an omniauth provider for new Microsoft Graph API. Affected versions of this package are vulnerable to Improper Authentication due to missing validation of the email attribute. An attacker can take over accounts by exploiting the trust placed in the email as a...
CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)
omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...
PT-2024-18984 · Rubygems · Omniauth-Microsoft Graph
Name of the Vulnerable Software and Affected Versions: omniauth-microsoft graph versions prior to 2.0.0 Description: The implementation did not validate the legitimacy of the email attribute of the user nor did it give or document an option to do so, making it susceptible to nOAuth misconfigurati...
SUSE CVE-2020-7754
This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters...
Design/Logic Flaw
Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...
CVE-2023-45150
CVE-2023-45150 concerns Nextcloud Calendar. The Red Hat/Reddit/GHSA and CVE records describe a flaw in the Nextcloud Calendar app where missing precondition checks allow handling of arbitrarily long strings (e.g., overly long email addresses), leading to a busy, unresponsive server and potential ...
CVE-2023-45150 Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive
Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...
Zod denial of service vulnerability during email validation
Impact API servers running express-zod-api having: - version of express-zod-api below 10.0.0-beta1, - and using the following or similar validation schema in its implementation: z.string.email, are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in zod versions up t...
GHSA-MVRP-3CVX-C325 Zod denial of service vulnerability during email validation
Impact API servers running express-zod-api having: - version of express-zod-api below 10.0.0-beta1, - and using the following or similar validation schema in its implementation: z.string.email, are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in zod versions up t...