CVE-2019-12784

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and...

Shopify: Shop admin can change external login services

'Login services' section in the Settings-Account is accessible only to the Account owners. However, shop admins full access users can escalate privileges and modify the login services. To verify, 1. Log into https://seclearn.myshopify.com as admin. 2. Navigate to settings-Account, notice that it...

Cross site scripting

The Janrain Engage formerly RPX module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting XSS attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login...