528 matches found
CVE-2023-6152
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verifyemailenabled" will only validate email only on sign up...
CVE-2023-6152
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verifyemailenabled" will only validate email only on sign up...
CVE-2023-6152
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verifyemailenabled" will only validate email only on sign up...
Email verification is not required after email change
Grafana is an open-source platform for monitoring and observability. A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option “verifyemailenabled” will only validate email only on sign up. This issue has been...
PYSEC-2023-271
Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect OIDC email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change...
PT-2023-8977 · Grafana +3 · Grafana +3
Name of the Vulnerable Software and Affected Versions: Grafana affected versions not specified Description: The issue is related to a weakness in the authentication mechanism of Grafana, specifically with the verify email enabled option. This option only validates email addresses during the sign-...
CVE-2023-40754
In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...
CVE-2023-40754
In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...
PT-2023-27619 · Phpjabbers · Phpjabbers Car Rental Script
Name of the Vulnerable Software and Affected Versions: PHPJabbers Car Rental Script version 3.0 Description: The issue allows remote attackers to take over accounts due to a lack of verification when changing an email address and/or password on the Profile Page. Recommendations: For PHPJabbers Ca...
PT-2023-21218 · Phplist · Phplist
Name of the Vulnerable Software and Affected Versions: phpList versions prior to 3.6.14 Description: An issue was discovered due to an access error, allowing manipulation and editing of the system's super admin data, which enables an account takeover of the user with super-admin permission...
CVE-2023-40260
EmpowerID before 7.205.0.1 allows an attacker to bypass an MFA multi factor authentication requirement if the first factor username and password is known, because the first factor is sufficient to change an account's email address, and the product would then send MFA codes to the new email addres...
CVE-2023-40260
EmpowerID before 7.205.0.1 allows an attacker to bypass an MFA multi factor authentication requirement if the first factor username and password is known, because the first factor is sufficient to change an account's email address, and the product would then send MFA codes to the new email addres...
CVE-2023-40260
EmpowerID before 7.205.0.1 allows an attacker to bypass an MFA multi factor authentication requirement if the first factor username and password is known, because the first factor is sufficient to change an account's email address, and the product would then send MFA codes to the new email addres...
PT-2023-27351 · Empowerid · Empowerid
Name of the Vulnerable Software and Affected Versions: EmpowerID versions prior to 7.205.0.1 Description: The issue allows an attacker to bypass a multi-factor authentication MFA requirement if the first factor, which includes the username and password, is known. This is possible because knowing...
CVE-2023-4277
The Realia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing nonce validation on the 'processchangeprofileform' function. This makes it possible for unauthenticated attackers to change user email via a forged request...
CVE-2023-4276
The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abprprofileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a...
Realia <= 1.4.0 - User Email Change via Cross-Site Request Forgery
Description The plugin does not protect its processchangeprofileform action against CSRF attacks, allowing an unauthenticated attacker to change a users email by tricking a logged in administrator to submit a crafted request...
CVE-2023-36139
In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts...