[20181004] - Core - ACL Violation in com_users for the admin verification

In case that an attacker gets access to the mail account of an user who can approve admin verifications in the registration process he can activate himself...

PT-2017-13497

Name of the Vulnerable Software and Affected Versions SAP E-Recruiting versions 605 through 617 Description An issue in the registration process of SAP E-Recruiting allows attackers to bypass email confirmation and register email addresses they do not have access to. This is due to the...

account.venyoo.ru XSS vulnerability

Vulnerable URL: https://account.venyoo.ru/register?email=%22%3E%3Csvg%20onload=alert%27XSSPOSED%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...

Bugzilla Privilege Escalation Security Patch

Developers and organizations that use the Bugzilla open source bug-tracking system should upgrade to current versions after the disclosure of details of a vulnerability in its email-based permissions process. The flaw, CVE-2015-4499, was patched last week in versions 4.2.15, 4.4.10 and 5.0.1 afte...

SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities

Exploit for multiple platform in category web applications Document Title: =============== SevenIT SevDesk 3.10 - Multiple Web Vulnerabilities Product & Service Introduction: =============================== The integrated customer management, digital customer file is the central record for a sing...

HackerOne: Enumeration of users

As I can see, you prevent enumeration of users actually e-mails of registered users in Sign In https://hackerone.com/users/signin and Forgot password https://hackerone.com/users/password/new functionalities. However, the users can be enumerated in Sign Up https://hackerone.com/users/signup - just...

Design/Logic Flaw

The Push Notifications subsystem in Apple iOS before 7 provides the push-notification token to an app without user approval, which allows attackers to obtain sensitive information via an app that employs a crafted push-notification registration process...

Twitter Account 'Classifier' Detects Fraudulent Accounts

Fraudulent Twitter accounts are a booming business, accounting for significant underground money for spammers, fake antivirus scams, drive-by downloads and phishing schemes. But research presented at USENIX yesterday proposes a means for driving up the cost for attackers to get these campaigns of...

Jackie CMS (<=1.7) SQL injection vulnerability analysis-vulnerability warning-the black bar safety net

Jackie CMS Jieqi CMS is a novel system based CMS, currently the latest version is 1. 7, in the novel class of station use rate is still relatively high, these days took some time to look at his code, but quite interesting, to share with you a bit. The entire system of the core code is zend...

SiteServer 3.4.4 logical vulnerabilities lead to SQL injection-vulnerability warning-the black bar safety net

Author: blue girl The problem is in the UserCenter. Pages. DLL in the Register, the registration process is logical to have problems, as follows: 1. The program put the user name into the database query, if the user name is not repeated, into the second step; 2. Then in the remote detection of th...

Website vulnerability 2 5 $ 8 $ 8 the genuine card bar-vulnerability warning-the black bar safety net

Two days ago on the Internet to see someone using Kaspersky official sales site of vulnerability, spending 2 to 5 Yuan to buy a value of 8 is 8 yuan a year genuine Kaspersky. Try holding the mood, according to the above steps to try it out. 1, Click on the Enter Kaspersky old users to upgrade pag...

Scribe 0.2 - PHP Remote Code Execution

--------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg --------------------------------------------------------------- Scribe...