Stripo Inc: Bypass email verification and create email template with the editor

Description : The main goal to use the Stripo is to create an email templates with the editor that is available in the account. And you're not allowed to open it until you validate your email address. But by modifying the response , i was able to bypass the email verification. Steps To Reproduce:...

Trint Ltd: SSO bypass in zendesk using trint organization able to leak internal ticket information

Summary hello there because in app.trint.com there's no email verification i able to login in your zendesk SSO using your organization your organization using domain @trint.com because there's no email verification i able to read and takeover + claim this email [email protected] and i able to...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b17c86b9-e52e-11e9-86e9-001b217b3468)

SO-AND-SO reports : XSS in Markdown Preview Using Mermaid Bypass Email Verification using Salesforce Authentication Account Takeover using SAML Uncontrolled Resource Consumption in Markdown using Mermaid Disclosure of Private Project Path and Labels Disclosure of Assignees via Milestones Disclosu...

Gitlab -- Multiple Vulnerabilities

The GitLab Team reports: XSS in Markdown Preview Using Mermaid Bypass Email Verification using Salesforce Authentication Account Takeover using SAML Uncontrolled Resource Consumption in Markdown using Mermaid Disclosure of Private Project Path and Labels Disclosure of Assignees via Milestones...

Akaunting 1.3.17 Cross Site Scripting

Title: Stored XSS In akaunting compnay name alt Affected Version: 1.0.0 - 1.3.17 Tested on: Chrome, Firefox, Opera Latest version Author: Rudra Sarkar @rudr4sarkar 1. Affected "alt" attribute 2. Create account, Confirm Email Verification 3. Create Company name with "alertdocument.domain; 4. It wi...

Omise: Signup with any email and enable 2FA without verifying email

Description : When i signup, i can enable 2FA without verification my email. Attack Scenario : 1. The Attacker signup with the victim email. 2. Go to Two factor authetication and enable 2FA Impact when the victim want to register in this site, they can't, because they email claims by attacker. an...

DRUPAL-CONTRIB-2019-066

This module enables you to have a separate permission only for creating users. The module doesn't respect Drupal's setting for "Who can register accounts?" when set to "Visitors, but administrator approval is required". When this option is chosen, the module overrides the setting, and makes it...

CVE-2019-5473

An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4...

CVE-2019-5473

An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4...

CVE-2019-5473

An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4...

CVE-2019-5473

GitLab CVE-2019-5473: an authentication issue allows bypassing email verification. Affected deployments prior to GitLab 12.0.4/12.1.2; remediation is to upgrade to GitLab 12.0.4 or 12.1.2 (or later). Multiple advisories and reports (Red Hat, Ubuntu, Debian, OSV, CVE lists, and a HackerOne writeup...

CVE-2019-5473

An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4...

CVE-2019-5473

Removed by vendor...

PT-2019-17695 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 12.0.4 GitLab versions prior to 12.1.2 Description: An authentication issue was discovered that allowed a bypass of email verification. Recommendations: For versions prior to 12.0.4, update to version 12.0.4 or later...

FreeBSD : Gitlab -- Multiple Vulnerabilities (1cd89254-b2db-11e9-8001-001b217b3468)

Gitlab reports : GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...

Nextcloud: SignUp using Fake Email

In this trial I used the email '[email protected]' and after pressing the SIGN UP button it will automatically redirect to https://ppp.woelkli.com/apps/preferredproviders/password/set/emailfakeforregister/H2qlEWHxQ3yiJgCsEXkR8, not through the account verification process first. For full the link Po...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...

Moneybird: Enable 2FA without verifying the email

Description : I able to add 2FA to my account without verifying my email Attack scenario : 1. Attacker sign up with victim email Email verification will be sent to victim email. 2. Attacker able to login without verifying email. 3. Attacker add 2FA. Impact the victim can't register an account wit...

Liberapay: Reauthentication for changing password bypass

Hello There So Libra Pay has this security system because of which if a malicious user tries to change the password of a logged in account, whether by session hijack or anything else he will be asked to re-enter the password before he can change it. But this loop hole I found in the system using...

Verification Process Spoofing

django-rest-registration is vulnerable to verification process spoofing. The misuse of django signing API and just relying on static string for signatures leads to easily guessable signatures used for email verification...