302 matches found
JetBrains TeamCity Cross-Site Scripting Vulnerability (CNVD-2021-89061)
TeamCity is a Java-based build management and continuous integration server from JetBrains. A cross-site scripting vulnerability exists in versions of JetBrains TeamCity prior to 2021.1.2. The vulnerability stems from an email notification that may contain unescaped HTML, which can be exploited b...
Jetbrains JetBrains TeamCity 跨站脚本漏洞
TeamCity is a Java-based build management and continuous integration server from JetBrains. A cross-site scripting vulnerability exists in versions of JetBrains TeamCity prior to 2021.1.2. The vulnerability stems from an email notification that may contain unescaped HTML, which can be exploited b...
Axis Os 缓冲区错误漏洞
Axis Os is an edge device operating system from Axis of Sweden. A security vulnerability exists in AXIS OS 6.40 or later that stems from not properly validating control parameters related to SMTP notifications. This could lead to a buffer overflow and data leakage...
Improper Privilege Management in circuitverse/circuitverse
✍️ Description subscribe to any private project 🕵️♂️ Proof of Concept There is two different user called user-A and user-B.\ 1. User-A created a private project .\ 2. Now User-B sent bellow request to subscribe to above private project PUT /commontator/threads/496401/subscribe HTTP/2 Host:...
CVE-2021-24527
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such...
CVE-2021-2404
Vulnerability in the PeopleSoft Enterprise HCM Candidate Gateway product of Oracle PeopleSoft component: e-mail notification. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...
CVE-2021-2404
Vulnerability in the PeopleSoft Enterprise HCM Candidate Gateway product of Oracle PeopleSoft component: e-mail notification. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...
CVE-2021-2404
Vulnerability in the PeopleSoft Enterprise HCM Candidate Gateway product of Oracle PeopleSoft component: e-mail notification. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...
CMS Made Simple 跨站脚本漏洞
CMS Made Simple CMSMS is an open source content management system that provides developers, programmers, and website owners with a web-based version of the development and management interface. A stored cross-site scripting vulnerability exists in CMS Made Simple version 2.2.14, which can be...
CVE-2020-27831
CVE-2020-27831 affects Red Hat Quay: a flaw in how the system handles the authorization token when authorizing email addresses for repository notifications allows an attacker to add email addresses they do not own to notifications. The root cause is improper protection of the authorization token ...
Slack email asking Android app users to change their passwords
By Deeba Ahmed Android users of the popular chat app Slack have received an email from the company requesting them to reset their password. This is a post from HackRead.com Read the original post: Slack email asking Android app users to change their passwords...
Shopify: [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserTfaEnforcement
Summary: There is an access control issue that happens when a Shopify Plus user tries to update the 2FA requirement of a user in another organisation. While the response shows an error message, an email is sent to the user with the 2FA status, first name, last name, email address, and shop id fro...
archive.org Cross Site Scripting vulnerability OBB-1722213
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| archive.org ---|--- Open Bug Bounty...
Red Hat Quay Access Control Error Vulnerability
Red Hat Quay is a distributed container image repository from Red Hat, Inc. that is used to build, distribute and deploy containers. An access control error vulnerability exists in Red Hat Quay versions prior to 3.3.3, which stems from an email notification authorization bypass...
Taken - Takeover AWS Ips And Have A Working POC For Subdomain Takeover
Takeover AWS ips and have a working POC for Subdomain Takeover. Idea is simple Get subdomains. Do reverse lookups to only save AWS ips. Restart EC2 instance every min. and public ip gets rotated on each restart. Match it with your existing list of subdomain ips and you have a working subdomain...
exionth.com Cross Site Scripting vulnerability OBB-1319156
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-25121
The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options...
CVE-2020-25121
The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options...
Design/Logic Flaw
The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options...
HackerOne: Recently added 'Country' field doesn't send email notification when changed
Summary: Hi team, This is a small bug report. Actually I think there is no important security issue but I wanted to report it ¯\ツ/¯ If you change your 'Country' information on account settings, HackerOne doesn't send Your profile was recently changed email. Description: There is an email...