856 matches found
UBUNTU-CVE-2020-13292
In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow...
CVE-2020-13292
GitLab vulnerability CVE-2020-13292 affects GitLab before 13.0.12, 13.1.6, and 13.2.3, where it is possible to bypass E-mail verification required for the OAuth flow. This is a logic/authentication bypass in the OAuth setup, not a general service outage. The issue is documented across multiple so...
CVE-2020-13292
In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow...
PT-2020-13433 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.0.12 GitLab versions prior to 13.1.6 GitLab versions prior to 13.2.3 Description: The issue allows bypassing E-mail verification required for OAuth Flow. Recommendations: For versions prior to 13.0.12, update to...
FreeBSD : Gitlab -- Multiple Vulnerabilities (a003b74f-d7b3-11ea-9df1-001b217b3468)
Gitlab reports : Arbitrary File Read when Moving an Issue Memory Exhaustion via Excessive Logging of Invite Email Error Denial of Service Through Project Import Feature User Controlled Git Configuration Settings Resulting in SSRF Stored XSS in Issue Reference Number Tooltip Stored XSS in Issues...
Gitlab -- Multiple Vulnerabilities
Gitlab reports: Arbitrary File Read when Moving an Issue Memory Exhaustion via Excessive Logging of Invite Email Error Denial of Service Through Project Import Feature User Controlled Git Configuration Settings Resulting in SSRF Stored XSS in Issue Reference Number Tooltip Stored XSS in Issues Li...
Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass
The plugin is affected by a loose comparison issue, which could allow any user to log in as administrator. An attacker can manipulate $GET'algwcevverifyemail' and set this payload: eyJpZCI6MSwiY29kZSI6MH0= Example: https://example.com/my-account/?algwcevverifyemail=eyJpZCI6MSwiY29kZSI6MH0= after...
WordPress Email Verification for WooCommerce plugin <= 1.8.1 - Bypass vulnerability
Bypass vulnerability discovered by WordPress Email Verification for WooCommerce plugin versions = 1.8.1. Solution Update the WordPress Email Verification for WooCommerce plugin to the latest available version at least 1.8.2...
GitLab: Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd parties
Summary There's a limitation that requires a validated email before going through the OAuth flow, however this is bypassable. Bypassing this means the target site assumes your email is validated, and actually ends up signing you in with an non-validated email. This behavior can frequently lead to...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-35344)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.8.2, prior to 3.7.5, and prior to 3.6.7, which stems from the program's use of weak hashing algorithms for email invitations,...
CVE-2020-13275
A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...
CVE-2020-13265
User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...
CVE-2020-13265
User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...
Design/Logic Flaw
User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...
CVE-2020-13265
User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification...
CVE-2020-13275
CVE-2020-13275 affects GitLab EE versions 12.2–13.0.1. The vulnerability is an authorization issue where a user with an unverified email address could request access to domain‑restricted groups. The connected documents corroborate the affected versions and the access impact; no remediation detail...
CVE-2020-13275
Removed by vendor...
CVE-2020-13265
CVE-2020-13265 affects GitLab CE/EE, specifically versions 12.5 through 13.0.1, where a flaw allows bypassing email verification. The connected documents (Red Hat, OSV, NVD, CNVD, Nessus NASL, and others) consistently describe this as a user email verification bypass vulnerability in GitLab. The ...