Mozilla: Bypass Email verification for monitoring at `monitor.mozilla.org`

The email verification at monitor.mozilla.org was bypassed by leveraging a leaked verification token from the /api/v1/user/breaches endpoint. The verification token was then used to bypass the email verification process and gain access to monitor the email without the owner's permission...

GitLab: Login email verification bypass via `/oauth/token`.

Vulnerability description not provided...

GHSA-MPVX-WHPP-99XJ Filestash skips TLS certificate verification process when sending out email verification codes

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack...

CVE-2024-41256

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack...

filestash 安全漏洞

filestash is a Dropbox-like file manager from the individual developer Mickael. A security vulnerability exists in filestash version v0.4, which stems from a default configuration in the ShareProofVerifier feature that causes the application to skip the TLS certificate validation process when...

CVE-2024-41256

CVE-2024-41256 concerns filestash v0.4, where default configurations in the ShareProofVerifier can skip TLS certificate verification when sending email verification codes. This creates a potential for a man-in-the-middle to access sensitive data through tampered or intercepted email communication...

Google Workspace Vulnerability Allowed Hackers to Access 3rd-Party Services

A Google Workspace vulnerability exposed thousands of accounts after hackers bypassed email verification. Learn how to protect your…...

Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services

Google says it recently fixed an authentication weakness that allowed crooks to circumvent the email verification required to create a Google Workspace account, and leverage that to impersonate a domain holder at third-party services that allow logins through Googles "Sign in with Google" feature...

ProductBoard, Inc.: Insecure Invitation Link Handling

The invitation link handling process of satismeter.com was found to have a critical security vulnerability. The issue allowed unauthorized users to join an organization using invitation links sent to different email addresses, bypassing the email verification process. The vulnerability occurred...

CVE-2024-38366 CoacoaPods trunk RCE in email verification system rfc-822

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX...

CVE-2024-38366 CoacoaPods trunk RCE in email verification system rfc-822

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX...

CVE-2024-38366 CoacoaPods trunk RCE in email verification system rfc-822

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX...

Critical Flaws in CocoaPods Expose iOS and macOS Apps to Supply Chain Attacks

A trio of security flaws has been uncovered in the CocoaPods dependency manager for Swift and Objective-C Cocoa projects that could be exploited to stage software supply chain attacks, putting downstream customers at severe risks. The vulnerabilities allow "any malicious actor to claim ownership...

CVE-2024-5868

The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification...

CVE-2024-5868

The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification...

CVE-2024-5868 WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness

The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification...

CVE-2024-5868

The CVE-2024-5868 entry concerns the WooCommerce - Social Login plugin for WordPress. Affected versions (

CVE-2024-5868 WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness

The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification...

WordPress WooCommerce - Social Login plugin <= 2.6.2 - Email Verification Bypass vulnerability

WordPress WooCommerce - Social Login plugin = 2.6.2 - Email Verification Bypass vulnerability discovered by István Márton in WordPress Plugin WooCommerce Social Login versions = 2.6.2...

WooCommerce - Social Login < 2.6.3 - Email Verification due to Insufficient Randomness

Description The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification...