Shopify: Ability to bypass partner email confirmation to take over any store given an employee email

I told Pete I would take a look at Spotify, hi Pete. Summary It's possible to take over any store account through partners given an employee email address. This is possible because I found a way to confirm arbitrary emails. I don't know the Shopify ecosystem well enough to know the other...

Regular Expression Denial of Service in is-my-json-valid

Version of is-my-json-valid before 2.12.4 are vulnerable to regular expression denial of service ReDoS via the email validation function. Recommendation Update to version 2.12.4 or later...

GHSA-F522-FFG8-J8R6 Regular Expression Denial of Service in is-my-json-valid

Version of is-my-json-valid before 2.12.4 are vulnerable to regular expression denial of service ReDoS via the email validation function. Recommendation Update to version 2.12.4 or later...

Email address is not validated when updating user profile

On the view profile page /secure/ViewProfile.jspa it's possible to update your user profile /secure/EditProfile!default.jspa?username=admin to an invalid email address. See attached screenshots. !Screen Shot 2017-09-28 at 2.49.48 PM.png|thumbnail! !Screen Shot 2017-09-28 at 2.49.58...

Email Address Validation Bypass

Moodle is vulnerable to email address validation bypass. It does not validate the address allowing an authenticated user to launch attacks using this flaw...

Boozt Fashion AB: Bypass email validity in newsletter field

Hi, I think i've discovered a little vulnerability on your website i don't know if she is outside the bug bounty program. In the newsletter field, the incorrect email addresses for example with special characters it's not accpeted. But with a specific HTTP request it's possible to bypass this...

Security update for roundcubemail (important)

This update for roundcubemail fixes the following issues: - A maliciously crafted email could cause untrusted code to be executed cross site scripting using $lt;area href=javascript:... boo982003, CVE-2016-5103 - Avoid HTML styles that could cause potential click jacking boo1001856 - A maliciousl...

DCFM Blog 0.9.7 Blind SQL Injection

DCFM Blog Version 0.9.7 Blind SQL Injection Vulnerability time based-attack ================================================================================ Discovered by NA , NAattutanota.com ======================================== Description ============ Open-source blog project. Free blog...

Facebook (Law Enforcement) - Filter Bypass Vulnerability

Document Title: =============== Facebook Law Enforcement - Filter Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1774 Release Date: ============= 2016-10-02 Vulnerability Laboratory ID VL-ID: ==================================== 177...

Gratipay: prevent null bytes in email field

Hi, Zawad here. Description I recently visited gratipay.com and logged in. I found that invalid characters eg. null bytes were accepted in email field, which is obviously not an expected behavior. Steps to Reproduce 1. Go to https://gratipay.com/username/emails/ 2. Enter [email protected]\0 or...

PT-2016-5193

Name of the Vulnerable Software and Affected Versions is-my-json-valid versions prior to 2.17.2 is-my-json-valid versions prior to 1.4.1 Description The issue is related to an incorrect regular expression in the is-my-json-valid package, which can cause a denial of service blocked event loop via ...

Anghami: [https://www.anghami.com/updatemailinfo/] Sql Injection

Hi , I'd like to report a sql injection issue, first you need to be logged in in order to exploit this issue . The vulnerable parameter is validateemail . some tests [email protected]&phoneormail= = Please Check Your email to verify [email protected]'&phoneormail= =...

DigitalSellz: The email updates issues

The email message content at the https://www.digitalsellz.com/user//email-updates page contrary to the email customization one is not validated properly. So this form allows all the html tags and their parameters. For example, all the following tags are sent as is: Link Link alert3 and all their...

Coinbase: ByPassing the email Validation Email on Sign up process in mobile apps

Hi, According to the design When the new user sign up using mobile appsandroid,ios.It will ask for the confirmation of the email.It will send a confirmation mail to mail id and a screen will also appear in the mobile app. The user needs to open the email in the device then the screen will Off and...

Bugzilla < 4.0.15 / 4.2.11 / 4.4.6 / 4.5.6 Multiple Vulnerabilities

Binary data 8606.prm...

Bugzilla Privilege Escalation - Email Validation Bypass (CVE-2014-1572)

A privilege escalation vulnerability has been found in Bugzilla. The vulnerability is due to a flaw that allows a registering user alter his email address after token validation. Any authenticated remote attacker may leverage this vulnerability to gain administrative access to the vulnerable serv...

php云人才系统 小漏洞一步步getshell（后台）

简要描述： php云人才系统 小漏洞一步步getshell，这里包含了php与mysql交互时候的特性（也算一个漏洞），还有phpyun自身图片的验证机制问题，等等，步骤比较艰辛，本来想在这里搞一个csrf呢，找了半天没有找到，到时找到一大堆xss，这里就不利用xss了，且看分析 详细说明： 首先我们做一个小测试： 对于mysql存储来说，建站者都会给每一个字段设置长度，然后当我们插入进去的数据长度超过了设置的长度，那么mysql是不会报错，然而会自然截断存储，这个就给我们编写程序的人留下了隐患。 利用场景分析...

Ecmall Sql二次注入第二弹

简要描述： 验证了一处 却没有验证另一处。 已打20140618补丁。 详细说明： ecmall在注册的时候 您输入的邮件地址不正确，请重新输入 返回上一页 是验证了邮件地址是否正确。 可是在 修改email的时候却没有验证。 / 修改电子邮箱 @author Hyber @usage none / function email $userid = $this-visitor-get'userid'; if !ISPOST / 当前位置 / $this-curlocalLANG::get'membercenter', 'index.php?app=member',...

Concrete CMS: Bypass auth.email-domains

Email addresses are stored as VARCHAR64. the length is verified on client side only , using a proxytemper data attacker can add longer length email which can be further abused .Exploiting this is rather straightforward: get an email address of 128 characters long . Now register with your 128...

Invision Power Board Admin 帐号接管命令执行漏洞

Invision Power Board是一个非常流行的PHP论坛程序。 Invision Power Board没有正确验证注册页面User Email字段的输入内容，导致远程攻击者能够修改任意用户的登录密码。通过修改管理员帐户的密码，攻击者能够远程执行代码。成功利用该漏洞需要攻击者获得目标帐户的用户名和注册邮件地址。 0 Invision Power Board Invision Power Board 3.4.4 厂商补丁： Invision Power Board -------------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...