1605 matches found
CVE-2023-41367 Missing Authentication check in SAP NetWeaver (Guided Procedures)
Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver Guided Procedures - version 7.50, can gain access to admin view of specific function anonymously. On successful exploitation of vulnerability under specific circumstances, attacker can view user’s...
EmploLeaks - Finding Leaked Employees Info for the Win
Developed by Faraday security researchers, this cutting-edge tool utilizes the power of OpenSource Intelligence techniques. EmploLeaks extracts valuable insights by scouring various platforms, to compile a comprehensive list of employees associated with a given company and cross-reference these...
Spyware Vendor Hacked
A Brazilian spyware app vendor was hacked by activists: In an undated note seen by TechCrunch, the unnamed hackers described how they found and exploited several security vulnerabilities that allowed them to compromise WebDetetive’s servers and access its user databases. By exploiting other flaws...
Human Resource PMS 1.4 Database Disclosure
==================================================================================================================================== | Title : Human Resource PMS v1.4 Database Disclosure Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...
CVE-2023-40754
In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...
Default credentials
In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...
CVE-2023-40754
In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...
CVE-2023-40754
In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...
CVE-2023-40182
CVE-2023-40182 describes a timing-based information disclosure in the Recovery form of Silverware Games, where response time differed depending on whether the provided email exists in the database. The issue affects versions prior to 1.3.7 and is fixed by upgrading to 1.3.7. Connected sources (Re...
CVE-2023-40182 silverware-io-issue-tracker server responds in a noticeably different amount of time depending if a given email address exists or not
Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes depending of whether the specified email address presents in our database or not. This has been fixed in version 1.3.7...
Jupiter X Core Premium < 3.4.3 - Unauthenticated Privilege Escalation
Description The plugin does not properly validate users during the Facebook login process, allowing unauthenticated users to login as any user by knowing their email address...
Workspace Error: "Your account cannot be added using this server address"
When adding account with NetScaler Gateway FQDN in Workspace, you may have below error prompt: "Your account cannot be added using this server address. Make sure you entered it correctly. You may need to enter your email address instead."...
Obfusticated Email Address Exfiltration
moq is vulnerable to Email Address Exfiltration. The vulnerability is due to including the SponsorLink.dll in version 4.20.0, which secretly exfiltrates the email address set in the user.email config parameter of git. This email address is hashed and sent to devlooped.com over TLS. The hidden...
Authentication flaw
EmpowerID before 7.205.0.1 allows an attacker to bypass an MFA multi factor authentication requirement if the first factor username and password is known, because the first factor is sufficient to change an account's email address, and the product would then send MFA codes to the new email addres...
Moq v4.20.0-rc to 4.20.1 share hashed user data
Moq v4.20.0-rc to 4.20.1 include support for SponsorLink, which runs an obfuscated DLL at build time that scans local git config data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this. Moq v4.20.2 has removed this functionality...
Cross-site Scripting (XSS)
gitlab is vulnerable to Cross-site Scripting XSS. An attacker can inject and execute malicious javascript through the email address for certain instances...
Information Disclosure
gitlab is vulnerable to Information Disclosure. An attacker could exploit this vulnerability to obtain the service desk email address for a GitLab project. This could then be used to contact the service desk impersonating a project member, or to send phishing emails to project members. This could...
Authorization Bypass
gitlab is vulnerable to Authorization Bypass. An attacker can exploit this vulnerability to obtain the email address of the pipeline creator by injecting malicious code into the email address field...
Remote Code Execution (RCE)
gitlab is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to a flaw in the way that GitLab handles group SAML SSO. An attacker can exploit this vulnerability to invite arbitrary users to a group, and then change the user's email address to an attacker-controlled address. Th...