Legal Robot: Clickjacking in Legalrobot app

Dear Team, POC Please find attached screenshots Steps to reproduce: create index.html file with following content: Open index.html in browser Actual result: Legalrobot email verification page is viewed in iframe. Remediation: Frame busting technique is the better framing protection technique...

CVE-2017-14511

An issue was discovered in SAP E-Recruiting aka ERECRUIT 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and...

SAP E-Recruiting Email Verification Bypass Vulnerability

SAP E-Recruiting versions 605, 606, 616, and 617 suffer from an email verification bypass vulnerability. title: Email verification bypass product: SAP E-Recruiting vulnerable version: 605, 606, 616, 617 fixed version: see SAP security note number 2507798 impact: medium homepage: https://www.sap.c...

SAP E-Recruiting Email Verification Bypass

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Email verification bypass product: SAP E-Recruiting vulnerable version: 605, 606, 616, 617 fixed version: see SAP security note number 2507798 impact: medium homepage:...

Weblate: Add another email address without verification

Introduction In the normal case, to link another email address to the Weblate account, users need to own the email address and click the verification link. However, I found an issue, that allows adding another email address without clicking on the verification link. Description and PoC: Create a...

Legal Robot: Bypass email verification when register new account

Hi Legalrobot, I have found a way to ignore Activate your account in my mailbox. Here is my new acc: [email protected] and the activate link: https://app.legalrobot-uat.com/email-verify?v=1Y5wiWwcvGcxznjlUsO-TuyEZgFpVbxMmQdfpEKrVTp I never click on that link and i can still log in at...

Legal Robot: No alert in verify email address with wrong input

Hello team @legalrobot, In your verify email address sector, I got something different. in that sector if I click on "Resend verification email" option and see the request. There is a parameter named email. So when I input something in that parameter it's show me done on output. I have show all i...

arxius: No Email Verification and No email sent on Forget Pasword

I noticed that when i sign up on arxius.io,it didnt verify email and when i reset password,i didnt receive any email...

Legal Robot: Enhancement: email confirmation for 2FA recovery

While searching for other issues, a security researcher proposed an enhancement to our 2FA account recovery: require email verification for 2FA recovery use. We implemented this change and thank @goodhackonly for an excellent suggestion that makes Legal Robot even more secure...

Paypal bypass email verify logins Vulnerability

Bypass verification on paypal email verify logins. Usage Info just use the web This is private exploit. You can buy it at https://0day.today...

WakaTime: Session Duplication due to Improper Validation

Initially at the time of sign-up the user is able to enter any email-id and account is created without any verification. Later a pop-up arises for verification, but all functions are available without verification. Attacker can use victims email and create an account, he can work on wakatime as t...

WakaTime: IDOR create accounts and verify them with original account email

Good evening, Vulnerability I'm able to create accounts with the email verification that originates from the first account I created. After changing the confirmemail request body to a different email.. After I use that verification link that account is now under my control and bypasses...

Discourse: Any user with invite capabilities can take-over any account on Discourse

Description Users with a trust level of 2 and above on Discourse being a member for 15 days,reading more than 100 posts and more - can be seen on: https://github.com/discourse/discourse/blob/b7386958edfb8215c99d90fde04521b3312d2ccd/config/sitesettings.yml can invite new users to join discourse by...

Shopify: Ability to verify any email address you don't own - accounts.shopify.com

Summary: During testing it's been found that in accounts.shopify.com it's possible to change your email address to any email address that you don't own and confirm that email due to the confirmation token being leaked. Steps to reproduce: 1. Login to https://accounts.shopify.com/account 2. Click...

Weblate: Email verification over an unencrypted channel

Hey guys, When registered for an account, the confirmation email sent out, has a http link refer the attachment and allows a man-in-the-middle attacker to take over the account. He can do the following: - Obtain the confirmation tokens while transmitting to the weblate infra and redirect the user...

VX Search Enterprise 9.5.12 - Verify Email Buffer Overflow Exploit

Exploit for windows platform in category dos / poc author = ''' Created: ScrR1pTK1dd13 Name: Greg Priest Mail: email protected Exploit Title: VX Search Enterprise v9.5.12 email verify exploit Date: 2017.03.28 Exploit Author: Greg Priest Version: VX Search Enterprise v9.5.12 Tested on: Windows7 x6...

VX Search Enterprise 9.5.12 - 'Verify Email' Buffer Overflow

author = ''' Created: ScrR1pTK1dd13 Name: Greg Priest Mail: [email protected] Exploit Title: VX Search Enterprise v9.5.12 email verify exploit Date: 2017.03.28 Exploit Author: Greg Priest Version: VX Search Enterprise v9.5.12 Tested on: Windows7 x64 HUN/ENG Professional ''' import...

CVE-2017-6506

In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leading to remote code execution. The attack vector is a crafted SMTP daemon that sends a long 220 aka "Service ready" string...

Yelp: Verification of email addresses possible through https://www.yelp.com/signup/facebook

Hi, There is an issue with the https://www.yelp.com/signup/facebook endpoint which allows an attacker to validate whether a specific email address is registered on Yelp. There seems to be no rate limit nor a validation for already used CSRF tokens. Steps to reproduce: 1. Go to...

Internet Bug Bounty: 3 heap corruptions in PHP

73208 integer overflow in imap8bit caused heap corruption https://bugs.php.net/bug.php?id=73208 73082 string length overflow in mbencode function https://bugs.php.net/bug.php?id=73082 73174 heap overflow in phppcrereplaceimpl https://bugs.php.net/bug.php?id=73174 If you want to verify email...