moodle validation error vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle has a security vulnerability in which a user can be created to authenticate an account without access to a verification email...

CVE-2021-20282

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...

Moodle 安全漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle has a security vulnerability in which a user can be created to authenticate an account without access to a verification email...

Kubernetes: KOPS documentation references domains which were not registered

Summary: While researching the kubernetes documentation, I found that the KOPS project's Route53 configuration references dangling DNS servers. I was able to register 3 / 4 of these domain names. I was also able to verify that some companies have been using this configuration, making them...

Algolia: email verification bypass

An issue in the way email modification was handled during the email verification process allowed the creation of account with arbitrary email address, bypassing the email verification step. A logical flaw resulting in email verification bypass! :D...

Sharing eBook With Your Kindle Could Have Let Hackers Hijack Your Account

Amazon has addressed a number of flaws in its Kindle e-reader platform that could have allowed an attacker to take control of victims' devices by simply sending them a malicious e-book. Dubbed "KindleDrip," the exploit chain takes advantage of a feature called "Send to Kindle" to send a...

Doppler VDP: Bypass Email Verification.

steps to reproduce:- 1- sign up into doppler here https://dashboard.doppler.com/register. 2- then it will go to this page https://dashboard.doppler.com/confirm and ask you to confirm your email. 3- go to source code and search for tagsconfirmemail . 4- you will find the email Verification token...

Bumble: Misconfigured oauth leads to Pre account takeover

Summary While testing badoo i have noticed that users can use SMAL Google,MSN,VKontakte,Odnoklassniki,Yandex Mail.Ru to create and login to badoo accounts. Now there are two ways of registering into badoo By email registration Google,MSN,VKontakte,Odnoklassniki,Yandex,Mail.Ru oauth login Now here...

MOSINT - OSINT Tool For Emails

MOSINT is an OSINT Tool for emails. It helps you gather information about the target email.  Features: Verification Service Check if email exist Check social accounts with Socialscan Check data breaches need API Find related emails Find related phone numbers Find related domains Scan Pastebin...

Automattic: Email Verification bypass on signup

Summary: This bug is related to wordpress.com. There is feature in wordpress.com which allow users to invite people. We have to enter email address to invite that particular person but the invite link and invite key is also available to the person who invited. This allow attackers to create the...

Design/Logic Flaw

In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email email protected, verify it, change it to the mail email protected and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this w...

CVE-2020-15245 Email verification bypass in Sylius

In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that th...

GHSA-6GW4-X63H-5499 Ability to switch customer email address on account detail page and stay verified

Impact The user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any...

DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Session Expiration - Previously issued email change tokens do not expire upon issuing a new email change token

The email verification code was not expired when a new one was generated. It was fixed. Summary When a user changes their email, they can receive a verification code in the changed email. This verification code will be used when changing your email. but, drive2.ru can reuse a corrupted verificati...

Acronis: Ticket Trick at https://account.acronis.com

Summary Hello dear team, I found a serious issue in Acronis This vulnerability is called ticket trick vulnerability which comes under critical category. Which can allow me to login on websites like atlassian,github,clouflare,choopa,..etc on behalf of [email protected] . Steps To Reprodu...

Nextcloud: Recently change email but still login with old email

Hi team, I have been found vulnerability on email verification which can be account takeover Authentication bypass Recently I have been change my email [email protected] but still login with old email [email protected] --https://efss.qloud.my/index.php/settings/user Impact Impact If victim's email...

New Relic: removed user can still join the organization

hi, i would like to report an issue i have found that allow attacker to join organization even if the attacker is removed. i found out that when adding new user, if you add a new user without verifying the email address, you change the email of the user, the email address you initially send the...

CVE-2020-13292

In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow...

UBUNTU-CVE-2020-13292

In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow...

CVE-2020-13292

In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow...