CVE-2018-6903

PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registered e-mail address by removing the validation code...

CVE-2018-6879

PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registered e-mail address by removing the validation code...

Regular Expression Denial Of Service (ReDoS)

is-my-json-valid is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a string through the email field to cause a ReDoS during email validation...

Node.js third-party modules: Regular Expression Denial of Service (ReDoS)

The issue was already fixed. Module: is-my-json-valid Summary: Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS attacks. It used a regular expression /^\S+@\S+$/ in order to validate emails. This can cause an impact of about 10 seconds matching time f...

Sandstorm Security Bypass Vulnerability

Sandstorm is a personal cloud platform. The platform features file storage, application management, task and project management, and more. A security vulnerability exists in versions prior to Sandstorm build 0.203, which stems from the program failing to adequately validate email addresses. A...

Shopify: Ability to bypass partner email confirmation to take over any store given an employee email

I told Pete I would take a look at Spotify, hi Pete. Summary It's possible to take over any store account through partners given an employee email address. This is possible because I found a way to confirm arbitrary emails. I don't know the Shopify ecosystem well enough to know the other...

GHSA-F522-FFG8-J8R6 Regular Expression Denial of Service in is-my-json-valid

Version of is-my-json-valid before 2.12.4 are vulnerable to regular expression denial of service ReDoS via the email validation function. Recommendation Update to version 2.12.4 or later...

Regular Expression Denial of Service in is-my-json-valid

Version of is-my-json-valid before 2.12.4 are vulnerable to regular expression denial of service ReDoS via the email validation function. Recommendation Update to version 2.12.4 or later...

Email address is not validated when updating user profile

On the view profile page /secure/ViewProfile.jspa it's possible to update your user profile /secure/EditProfile!default.jspa?username=admin to an invalid email address. See attached screenshots. !Screen Shot 2017-09-28 at 2.49.48 PM.png|thumbnail! !Screen Shot 2017-09-28 at 2.49.58...

Email Address Validation Bypass

Moodle is vulnerable to email address validation bypass. It does not validate the address allowing an authenticated user to launch attacks using this flaw...

Boozt Fashion AB: Bypass email validity in newsletter field

Hi, I think i've discovered a little vulnerability on your website i don't know if she is outside the bug bounty program. In the newsletter field, the incorrect email addresses for example with special characters it's not accpeted. But with a specific HTTP request it's possible to bypass this...

Security update for roundcubemail (important)

This update for roundcubemail fixes the following issues: - A maliciously crafted email could cause untrusted code to be executed cross site scripting using $lt;area href=javascript:... boo982003, CVE-2016-5103 - Avoid HTML styles that could cause potential click jacking boo1001856 - A maliciousl...

DCFM Blog 0.9.7 Blind SQL Injection

DCFM Blog Version 0.9.7 Blind SQL Injection Vulnerability time based-attack ================================================================================ Discovered by NA , NAattutanota.com ======================================== Description ============ Open-source blog project. Free blog...

Facebook (Law Enforcement) - Filter Bypass Vulnerability

Document Title: =============== Facebook Law Enforcement - Filter Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1774 Release Date: ============= 2016-10-02 Vulnerability Laboratory ID VL-ID: ==================================== 177...

Gratipay: prevent null bytes in email field

Hi, Zawad here. Description I recently visited gratipay.com and logged in. I found that invalid characters eg. null bytes were accepted in email field, which is obviously not an expected behavior. Steps to Reproduce 1. Go to https://gratipay.com/username/emails/ 2. Enter [email protected]\0 or...

Anghami: [https://www.anghami.com/updatemailinfo/] Sql Injection

Hi , I'd like to report a sql injection issue, first you need to be logged in in order to exploit this issue . The vulnerable parameter is validateemail . some tests [email protected]&phoneormail= = Please Check Your email to verify [email protected]'&phoneormail= =...

DigitalSellz: The email updates issues

The email message content at the https://www.digitalsellz.com/user//email-updates page contrary to the email customization one is not validated properly. So this form allows all the html tags and their parameters. For example, all the following tags are sent as is: Link Link alert3 and all their...

Coinbase: ByPassing the email Validation Email on Sign up process in mobile apps

Hi, According to the design When the new user sign up using mobile appsandroid,ios.It will ask for the confirmation of the email.It will send a confirmation mail to mail id and a screen will also appear in the mobile app. The user needs to open the email in the device then the screen will Off and...

Bugzilla < 4.0.15 / 4.2.11 / 4.4.6 / 4.5.6 Multiple Vulnerabilities

Binary data 8606.prm...

Bugzilla Privilege Escalation - Email Validation Bypass (CVE-2014-1572)

A privilege escalation vulnerability has been found in Bugzilla. The vulnerability is due to a flaw that allows a registering user alter his email address after token validation. Any authenticated remote attacker may leverage this vulnerability to gain administrative access to the vulnerable serv...