CVE-2024-56136 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server

Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclose attack, where, if a Zulip server is hosting multiple organizations, an unauthenticated user can make a request and determine if an emai...

CVE-2024-56136

Zulip Server 7.0 and above are affected by an information disclosure vulnerability that allows an unauthenticated attacker to determine whether an email address exists for a user on a server hosting multiple organizations (CVE-2024-56136). The issue is resolved in Zulip Server 9.4 and in the main...

Zulip server 信息泄露漏洞

Zulip server is an open source team chat application from Zulip, Inc. in the United States. An information disclosure vulnerability exists in Zulip server versions 7.0 through prior to 9.4, which stems from susceptibility to an information disclosure attack in which an unauthenticated user could...

PT-2025-3194 · Zulip · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip Server versions 7.0 through 9.3 Description: The issue concerns an information disclosure attack where an unauthenticated user can determine if an email address is in use by a user on a Zulip server hosting multiple organizations. There...

CVE-2024-43927

Cross-Site Request Forgery CSRF vulnerability in Till Krüss Email Address Encoder email-address-encoder allows Cross Site Request Forgery.This issue affects Email Address Encoder: from n/a through = 1.0.23...

CVE-2024-43927 WordPress Email Address Encoder plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Till Krüss Email Address Encoder email-address-encoder allows Cross Site Request Forgery.This issue affects Email Address Encoder: from n/a through = 1.0.23...

CVE-2024-43927

CVE-2024-43927 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Till Krüss Email Address Encoder WordPress plugin, affecting Email Address Encoder versions from n/a up to 1.0.23. The issue enables CSRF, with no public exploit details provided in the sources. Remediation guidance...

CVE-2024-43927 WordPress Email Address Encoder plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Till Krüss Email Address Encoder email-address-encoder allows Cross Site Request Forgery.This issue affects Email Address Encoder: from n/a through = 1.0.23...

WordPress plugin Email Address Encoder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2025-2671 · Unknown · Till Krüss Email Address Encoder

Name of the Vulnerable Software and Affected Versions: Till Krüss Email Address Encoder versions 1.0.23 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by...

Important: python3.9

Issue Overview: Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. CVE-2007-4559...

GHSA-7CWC-FJQM-8VH8 Drupal core Access bypass

Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 befo...

CVE-2024-11935

The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-11935 Email Address Obfuscation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter

The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-11935

The CVE CVE-2024-11935 affects the WordPress Email Address Obfuscation plugin. It is a Stored XSS via the class parameter in all versions up to 1.0.1, requiring an authenticated attacker with Contributor-level access or higher to inject scripts that execute when users load the affected page. A re...

WordPress Email Address Obfuscation plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via class Parameter vulnerability discovered by theviper17y in WordPress Plugin Email Address Obfuscation versions = 1.0.1...

Mattermost Input Validation Error Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an input validation error vulnerability that stems from failing to properly validate an email address, no details of the vulnerability are provided at this time...

PT-2024-17352 · WordPress · Email Address Obfuscation

Name of the Vulnerable Software and Affected Versions: Email Address Obfuscation plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Stored Cross-Site Scripting via the class parameter due to insufficient input sanitization and output escaping. This allo...

CVE-2024-11024 AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possibl...

CVE-2024-50671

Incorrect access control in Adapt Learning Adapt Authoring Tool = 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get users" feature. The vulnerability occurs due to a flaw in permission verification logic, where the wildcard character in permitted URLs...