CVE-2020-7245

Affected software : CTFd (open-source CTF platform). Vulnerable versions : 2.0.0–2.2.2. Root cause : Incorrect username validation in the registration process. Impact : Allows an attacker to take over an arbitrary account when emails are enabled, via username collision created by inserting whites...

CVE-2020-7245: Weak Password Recovery Mechanism for Forgotten Password

Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd instance. To exploit the vulnerability, one must register with a username identical to the victim's...

Input validation

A vulnerability in the REST API of Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network Manager EPNM could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system. The vulnerability is due to insufficient input...

Design/Logic Flaw

Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS...

CVE-2019-1922 Cisco IP Phone 7800 and 8800 Series Session Initiation Protocol Denial of Service Vulnerability

A vulnerability in Cisco SIP IP Phone Software for Cisco IP Phone 7800 Series and 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected phone. The vulnerability is due to insufficient validation of input Session Initiation Protocol S...

CVE-2019-1887 Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerability

A vulnerability in the Session Initiation Protocol SIP protocol implementation of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient validation of input SIP traffic. An attacker...

PT-2019-2653

Name of the Vulnerable Software and Affected Versions Cisco IP Phone Software for Cisco IP Phone 7800 Series and 8800 Series affected versions not specified Description The issue is related to insufficient validation of input Session Initiation Protocol SIP packets, which could allow an...

InnoGames: Race condition in activating email resulting in infinite amount of diamonds received

There was a race condition, in the registration process, that might have given the attacker an advantage in the game by gaining additional premium in-game currency without paying for it. Summary: This is an interesting critical race condition that might give the attacker an advantage in the game ...

Remotely controlled EV home chargers – the threats and vulnerabilities

We are now seeing signs of a possible shift in the field of personal transport. Recent events such as the 'dieselgate' scandal undermine customer and government confidence in combustion engines and their environmental safety. At the same time there has been a big step forward in the development o...

Joomla! < 3.8.13 ACL Violation Vulnerability

If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CVE-2018-17855

An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself...

CVE-2018-17855

CVE-2018-17855 affects Joomla! before 3.8.13. It describes an ACL/verification flaw in com_users: if an attacker gains access to a user’s mail account who can approve admin verifications during registration, they can activate themselves. The vulnerability is documented across multiple sources (NV...

CVE-2018-17855: Improper Privilege Management

An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself...

Use the password reset functions to achieve account-hijacking-vulnerability warning-the black bar safety net

Recently, I attended a platform to invite vulnerability testing project, in which the discovery of a unique account hijacking vulnerability, the entire vulnerability discovery process very unexpected but also very lucky, by the password reset function can be achieved account hijacking, and I will...

CVE-2018-6223: Missing Authentication for Critical Function

A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to manipulate the registration process of the product to reset configuration parameters...

CVE-2018-2684

Vulnerability in the Oracle User Management component of Oracle E-Business Suite subcomponent: Registration Process. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows high privileged attacker with network access via...

CVE-2018-2684

Vulnerability in the Oracle User Management component of Oracle E-Business Suite subcomponent: Registration Process. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows high privileged attacker with network access via...

CVE-2018-2684: Undefined Security Weakness

Vulnerability in the Oracle User Management component of Oracle E-Business Suite subcomponent: Registration Process. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows high privileged attacker with network access via...

PT-2018-15726

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 Description The issue affects the Oracle User Management component, specifically the Registration Process subcomponent. It allows a high-privileged attacker with...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2018-02402)

Oracle E-Business Suite is based on the original Application ERP expansion, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management, and so on a variety of management software collection, is a seamless integration of a management suite. An...