Mageia: Security Advisory (MGASA-2019-0046)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-3735

Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmtrand in order to generate password reset tokens. mtrand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected]...

Default configuration

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. email protected wou...

CVE-2021-44692

The CVE describes a vulnerability in BuddyBoss Platform up to version 1.8.0 where user emails can be inferred and exposed. When a new user is created, a UID is generated for the profile, which encodes the user’s private email address (symbols removed, periods replaced with hyphens). The resulting...

Delta Rm Authorization Issue Vulnerability

Delta Rm is a simple and effective risk management from Delta Rm France. It is used to simplify risk management methods and save time. A security vulnerability exists in Delta RM 1.2, which could use this account ID to request a new password for any other account. Using the list DTsendmaildata ad...

Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure

The plugin allows any logged in user, such as subscriber, to extract any other user's email address. fetch"http://127.0.0.1:8001/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded" , "body": new URLSearchParams"action": "dilazmbqueryselect", "q": "@gma",...

WordPress Futurio Extra plugin <= 1.6.2 - User Email Address Leakage vulnerability

User Email Address Leakage vulnerability discovered by Krzysztof Zając in WordPress Futurio Extra plugin versions = 1.6.2. Solution Update the WordPress Futurio Extra plugin to the latest available version at least 1.6.3...

Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure

The plugin allows any logged in user, such as subscriber, to extract any other user's email address. PoC fetch"http://127.0.0.1:8001/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded" , "body": new URLSearchParams"action": "dilazmbqueryselect", "q": "@gma",...

Usoc SQL注入漏洞

Usoc is a useful and simple open source Cms by Aaron Junker, an individual developer in Switzerland. USOC suffers from a security vulnerability that stems from USOC's lack of effective filtering and escaping for SQL statements in register.php. In particular, the user-supplied username, e-mail...

OPENSUSE-SU-2021:1642-1 Security update for postrsd

postrsd was updated to release 1.11 boo1180251: Drop group privileges as well as user privileges Fixed: The subprocess that talks to Postfix could be caused to hang with a very long email address. CVE-2020-35573 - Update to release 1.6 Fix endianness issue with SHA-1 implementation Add dual stack...

GlFusion Cms Arbitrary User Registration Vulnerability

glFusion CMS is a content management and publishing system. glFusion CMS v1.7.9 is vulnerable to arbitrary user registration, which can be exploited by attackers to register using any user's email address...

Mail Login - Moderately critical - Access bypass - SA-CONTRIB-2021-047

This modules enables users to login via email address. This module does not sufficiently check user status when authenticating...

Code injection

Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token...

The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

...

Gumtree – leaking your data and not really listening

Sometimes finding vulnerabilities is as simple as… just looking. TL;DR 1. Gumtree is a UK-based site where users can advertise items for sale. 2. It leaked the PII of sellers to other users of the site within the HTML source of the adverts. Email address, postcode, GPS location, and the seller’s...

CVE-2021-43833: Improper Authentication

eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows any authenticated user to gain access to arbitrary accounts by setting a specially crafted email address. This vulnerability impacts all instances that have not set a...

GlFusion Cms 授权问题漏洞

glFusion CMS is a content management and publishing system. glFusion CMS v1.7.9 is vulnerable to arbitrary user registration, which can be exploited by attackers to register using any user's email address...

CVE-2021-39934

Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2...