374 matches found
CVE-2024-46242
An issue in the validateemail function in CTFd/utils/validators/init.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service ReDoS via supplying a crafted string as e-mail address during registration...
Mattermost Server 9.5.x < 9.5.12, 9.11.x < 9.11.4, 10.0.x < 10.0.2, 10.1.x < 10.1.2, 10.2.0 (MMSA-2024-00386)
The version of Mattermost Server installed on the remote host is prior to 9.5.12, 9.11.4, 10.0.2, 10.1.2 or 10.2.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00386 advisory. - Mattermost versions 10.0.x = 10.0.1, 10.1.x = 10.1.1, 9.11.x = 9.11.3, 9.5.x = 9.5.11...
CVE-2024-9654
The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verifyguestemail' function to ensure the requesting user is the intended recipient of the purchase receipt. This...
Content Injection
sp-php-email-handler is vulnerable to Content Injection. The vulnerability is due to improper validation of email recipients and lack of sanitization of user-provided content in confirmation emails, allows attackers to specify arbitrary email addresses and inject malicious content...
Drupal core Access bypass
Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 befo...
CVE-2024-11599
Mattermost versions 10.0.x = 10.0.1, 10.1.x = 10.1.1, 9.11.x = 9.11.3, 9.5.x = 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration...
CVE-2024-11599
CVE-2024-11599 affects Mattermost where input-based email validation failure allows an unauthenticated user to bypass email domain restrictions during registration. Affected versions include 9.5.x (<= 9.5.11), 9.11.x (<= 9.11.3), 10.0.x (<= 10.0.1), and 10.1.x (9.5.11, >9.11.3, >10...
CVE-2024-11599 Domain Restriction Bypass on Registration
Mattermost versions 10.0.x = 10.0.1, 10.1.x = 10.1.1, 9.11.x = 9.11.3, 9.5.x = 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an input validation error vulnerability that stems from failing to properly validate an email address, no details of the vulnerability are provided at this time...
PT-2024-17129 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.11 Mattermost versions 9.11.x through 9.11.3 Mattermost versions 10.0.x through 10.0.1 Mattermost versions 10.1.x through 10.1.1 Description: The issue is related to the improper validation of email...
PT-2024-30574 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions 0.80 through 10.0.16 Description: The issue allows an unauthenticated user to use an application endpoint to check if an email address corresponds to a valid GLPI user. Recommendations: For versions 0.80 through 10.0.16, update ...
CVE-2024-9637 School Management System – WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.10. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it...
CVE-2024-9289 WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation
The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwaploginrequestcallback function not properly validating a user's identity prior to authenticating them to the site. This...
PT-2024-5205 · Cocoapods · Cocoapods
Name of the Vulnerable Software and Affected Versions: CocoaPods affected versions not specified Description: The issue concerns the CocoaPods dependency manager, specifically the authentication server trunk.cocoapods.org. A problem was found in the part of the trunk that verifies whether a user...
CVE-2024-5755
In lunary-ai/lunary versions =v1.2.11, an attacker can bypass email validation by using a dot character '.' in the email address. This allows the creation of multiple accounts with essentially the same email address e.g., '[email protected]' and '[email protected]', leading to incorrect...
CVE-2024-5755
In lunary-ai/lunary versions =v1.2.11, an attacker can bypass email validation by using a dot character '.' in the email address. This allows the creation of multiple accounts with essentially the same email address e.g., '[email protected]' and '[email protected]', leading to incorrect...
CVE-2024-5755 Email Validation Bypass in lunary-ai/lunary
In lunary-ai/lunary versions =v1.2.11, an attacker can bypass email validation by using a dot character '.' in the email address. This allows the creation of multiple accounts with essentially the same email address e.g., '[email protected]' and '[email protected]', leading to incorrect...
CVE-2024-5755 Email Validation Bypass in lunary-ai/lunary
In lunary-ai/lunary versions =v1.2.11, an attacker can bypass email validation by using a dot character '.' in the email address. This allows the creation of multiple accounts with essentially the same email address e.g., '[email protected]' and '[email protected]', leading to incorrect...
CVE-2024-5755
Summary: Lunary-ai/lunary versions ≤ v1.2.11 contain an input validation bypass where a dot in the email address can create multiple accounts that map to the same mailbox, causing synchronization and security concerns. Affected software: lunary-ai/lunary (≤ v1.2.11). Root cause (as described): em...
PT-2024-37122 · Lunary Ai · Lunary
Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions =v1.2.11 Description: The issue allows an attacker to bypass email validation by using a dot character '.' in the email address, enabling the creation of multiple accounts with essentially the same email address. Thi...