230 matches found
The vulnerability of the PJSIP driver of the Asterisk IP-telephony system allows a hacker to trigger a service failure.
The vulnerability of the PJSIP driver of the Asterisk IP-telephony system is related to the improper handling of repeated INVITES after sending a BYE request. Exploiting this vulnerability allows an attacker who operates remotely to cause service failure...
CVE-2022-26779
Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate...
8x8 Bounty: connect.8x8.com: admin user can send invites on behalf of another admin user via POST /api/v1/users/<User ID>/invites
Vulnerability description not provided...
FetLife: Race condition in endpoint POST fetlife.com/users/invitation, allow attacker to generate unlimited invites
This report describes the same bug as 1455487. I rewrite this bug here to make the report clearer. I will self-close 1455487 right now. Description The Invite Your Friend to Join FetLife feature is vulnerable to race condition. By sending many requests at the same time to endpoint POST...
PT-2022-15035 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.7.13 Discourse version 2.8.0.beta11 in beta and tests-passed Description: The issue allows some users to log in to a community before they should be able to do so. A user invited via email to a forum with must...
matrix-server-isenguard (>=0.1.1 <=0.2.0), matrix-temp-mail-checker (>=0.1.2 <=0.1.5) +6 more potentially affected by CVE-2021-21394 via matrix-synapse (>=0.33.9 <=1.154.0)
matrix-synapse PYPI version =0.33.9, =0.1.1, =0.1.2, =0.100.2, =0.1.0, =0.1.0, =0.8.0, =0.8.4 Source cves: CVE-2021-21394 Source advisory: OSV:GHSA-W9FG-XFFH-P362...
PT-2021-18753 · Valve · Valve Steam +1
Name of the Vulnerable Software and Affected Versions: Valve Steam through 2021-04-10 Description: The issue allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click when a Source engine game is installed. This is...
Slack hurries to fix direct message flaw that allowed harassment
The enormous work messaging platform Slack quickly reversed course yesterday, promising to revise a brand-new direct message feature that could have been misused for harassment. Added to the company’s “Slack Connect” product—which lets enterprise users share messages with contract workers and...
matrix-server-isenguard (>=0.1.1 <=0.2.0), matrix-temp-mail-checker (>=0.1.2 <=0.1.5) +5 more potentially affected by CVE-2021-21274 via matrix-synapse (=1.154.0)
matrix-synapse PYPI version =1.154.0 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-synapse and may be impacted: - matrix-server-isenguard =0.1.1, =0.1.2, =0.1.0, =0.1.0, =0.8.0, =0.8.4 Source cves: CVE-2021-21274 Source advisory:...
DEBIAN-CVE-2021-21273
Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key...
UBUNTU-CVE-2021-21273
Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key...
CVE-2020-24364
MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. Could lead to RCE via meeting invite...
CVE-2020-11737
A cross-site scripting XSS vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring including the quotes followed...
Spam In your Calendar? Here’s What to Do.
Many spam trends are cyclical: Spammers tend to switch tactics when one method of hijacking your time and attention stops working. But periodically they circle back to old tricks, and few spam trends are as perennial as calendar spam, in which invitations to click on dodgy links show up unbidden ...
WordPress: Add users to groups who have restricted group invites
Description: WordPress version: 5.2 BuddyPress version: 4.2.0 Through this vulnerability, an attacker could add users to groups who have set : I want to restrict Group invites to my friends only. There is no proper validation of the personal settings of the user and thus the users with such priva...
HackerOne: Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature
Hi HackerOne, Summary: I have found a way that it is possible to harvest all private invitation using the new Leave Program feature together with the security@ email forwarding feature without any user interaction. --- Description: First, when the program activated the security@ email forwarding ...
CVE-2018-6394
SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invitetype parameter in a view=invites action...
Gratipay: Unauthorized access to the slack channel via inside.gratipay.com/appendices/chat
Summary It is possible to force send invites for gratipay slack channel to arbitary email ids with no bruteforce limit. This is done by modifying the coc parameter to 1 in the POST data sent from https://inside.gratipay.com/appendices/chat Description Sending a post request with coc parameter set...
Box.com Plugs Account Data Leakage Flaw
Box.com has changed the way it handles publicly shared accounts and folders after a researcher found confidential documents and data belonging to Box.com users via Google, Bing and other search engines. While Box.com maintains this is a case of its customers unintentionally over-sharing, it says ...