Design/Logic Flaw

An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. An attacker can submit a GET request to /api/register/:email, where :email is a base64 encoded e-mail address, to receive confirmation as to whether a user account exists in the system with the specifie...

CVE-2018-15656

CVE-2018-15656 affects 42Gears SureMDM prior to 2018-11-27, where an attacker can issue a GET request to /api/register/:email with a base64-encoded email and an ApiKey header to determine whether a user account exists. The underlying issue is information disclosure through the registration endpoi...

The vulnerability of the User Registration sub-component of the Oracle iStore component in the Oracle E-Business Suite, a system for automating business operations in enterprises, allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the User Registration sub-component of the Oracle iStore component in the Oracle E-Business Suite automation system is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain access to modify, add, or delete data using the HTTP...

Improper access control

Incorrect access control in miglaajaxfunctions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call...

CVE-2019-6703

CVE-2019-6703 affects the Total Donations WordPress plugin (up to 2.0.5/2.0.6) via an incorrect access control in migla_ajax_functions.php. This flaw allows unauthenticated attackers to call miglaA_update_me through wp-admin/admin-ajax.php and modify arbitrary WordPress option values, enabling ac...

The vulnerability of the Juniper ATP intrusion prevention system allows a intruder to elevate their privileges and execute arbitrary code.

The vulnerability of the Juniper ATP intrusion prevention system lies in the storage of pre-installed registration data in a file. Exploiting this vulnerability allows a remote attacker to increase their privileges and execute arbitrary code...

Anti-Spam by CleanTalk - Critical - Cross site scripting and SQL Injection - SA-CONTRIB-2019-010

Anti-spam module by CleanTalk to protect your Drupal sites from spambot registration and spam comments publications thru comment and contact forms. This module does not sufficiently filter submitted content in certain circumstances...

The vulnerability of the Juniper ATP intrusion prevention system allows a intruder to elevate their privileges and execute arbitrary code.

The vulnerability of the Juniper ATP intrusion prevention system lies in the use of pre-installed registration data. Exploiting this vulnerability allows a remote attacker to enhance their privileges and execute arbitrary code...

The vulnerability of the Juniper ATP intrusion prevention system allows a intruder to elevate their privileges and execute arbitrary code.

The vulnerability of the Juniper ATP intrusion prevention system lies in the use of identical passwords for several pre-installed registration records. Exploiting this vulnerability allows a malicious actor to gain increased privileges and execute arbitrary codes remotely...

Code injection

Spoofed SMS can be used to send a large number of messages to the device which will in turn initiate a flood of registration updates with the server in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 625, SD 636, SDA660, SDM630, SDM660, SDX20...

CVE-2018-11284

Spoofed SMS can be used to send a large number of messages to the device which will in turn initiate a flood of registration updates with the server in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 625, SD 636, SDA660, SDM630, SDM660, SDX20...

CVE-2018-11284

CVE-2018-11284 describes a vulnerability where spoofed SMS can trigger a flood of registration updates to the server on devices using Qualcomm Snapdragon mobile and Snapdragon Wear platforms (MDM9206, MDM9607, MDM9650, SD 210/212/205, SD 625, SD 636, SDA660, SDM630, SDM660, SDX20). The underlying...

Millions of Oklahoma Gov Files Exposed by Wide-Open Server

Millions of sensitive files on a storage server belonging to the Oklahoma Department of Securities were left exposed for a week – including credentials, internal docs and personal data stretching back decades. Researchers at UpGuard who discovered the data leak said that the publicly accessible...

CVE-2019-2400

Vulnerability in the Oracle iStore component of Oracle E-Business Suite subcomponent: User Registration. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with networ...

Wordpress Plugin UserPro Administrator Role Registration Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the Wordpress plugin UserPro. An attacker can exploit the vulnerability to register an...

WordPress User Registration plugin <= 1.5.5 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by "Mr Winst0n" in WordPress User Registration plugin versions = 1.5.5. Solution Update the WordPress User Registration plugin to the latest available version at least 1.5.6...

User Registration <= 1.5.5 - Authenticated Cross-Site Scripting (XSS)

The User Registration – Custom Registration Form, Login And User Profile For WordPress WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

WordPress User Registration 1.5.3 Cross Site Scripting

Exploit Title: Wordpress Plugin User Registration 1.5.3 - Cross Site Scripting Discovery by: Mr Winst0n Discovery Date: 2019-01-09 Vendor Homepage: https://wpeverest.com/ Software Link : https://wordpress.org/plugins/user-registration/ Tested Version: 1.5.3 Tested on: Kali linux, Windows 8.1 /...

User Registration <= 1.5.5 - Authenticated Cross-Site Scripting (XSS)

The User Registration – Custom Registration Form, Login And User Profile For WordPress WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. PoC...

WordPress UserPro Privilege Escalation

Exploit Title: Wordpress Plugin UserPro 4.9.21 User Registration With Administrator Role Google Dork: inurl:/wp-content/plugins/userpro/ Date: 3rd January, 2019 Exploit Author: Noman Riffat Vendor Homepage: https://userproplugin.com/ Software Link:...