CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

UBUNTU-CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

CVE-2017-5493: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

secure.docusign.com XSS vulnerability

Vulnerable URL: https://secure.docusign.com/signup/free?tgr=com-freeplan-netlogincouponcode=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VI...

New Relic: Moniter Failed Sends too many emails

Hello, While i was testing your program i found one vulnerabilty in your program, Steps To Reproduce 1. Go here https://newrelic.com/, and click on signup button. 2.Then put Javascript alert in Name field You can try any name too 3. Then put javascript:alertdocument.domain in You company field Yo...

jbvideo.com XSS vulnerability

Vulnerable URL: http://jbvideo.com/signup?vopt=alert'OPENBUGBOUNTY';...

DCFM Blog 0.9.7 Blind SQL Injection Vulnerability

DCFM Blog version 0.9.7 suffers from a remote blind SQL injection vulnerability. DCFM Blog Version 0.9.7 Blind SQL Injection Vulnerability time based-attack ================================================================================ Description ============ Open-source blog project. Free blo...

Yelp: CSRF on signup endpoint (auto-api.yelp.com)

Sign up request on https://auto-api.yelp.com/account/createsecure endpoint processes without any checking headers without cookies, csrf tokens and even user-agent. This is sample HTML form: --- Maybe when you will check it the signature will be expired, but it is not very difficult to generate th...

Brave Software: [website] Script injection in newsletter signup https://brave.com/brave_youth_program_signup.html

go to https://brave.com/braveyouthprogramsignup.html click become an ambasador insert malicious payloads in the fields YOU JUST WON 1m$ you will receive a mail like in the image attached. You can send phising emails and do other bad stuff. If you need more details i'm here...

WebSummit: Subdomain take over signup.websummit

Subdomain take over Hi, You have a subdomain aka signup.websummit.net that point to a third party service hosted on Heroku: wsv1.herokuapp.com. The nslookup command shows the DNS configuration. $ nslookup signup.websummit.net 8.8.8.8 Server: 8.8.8.8 Address: 8.8.8.853 Non-authoritative answer:...

mechaero.ir XSS vulnerability

Vulnerable URL: http://mechaero.ir/users/signup.php?utype=admin" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4975205 VIP website status:| No Check mechaero.ir SSL connection:|...

ncsrm.shirazu.ac.ir XSS vulnerability

Vulnerable URL: http://ncsrm.shirazu.ac.ir/users/signup.php?utype=admin" Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 18:51 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP websi...

ncca.ir XSS vulnerability

Vulnerable URL: http://ncca.ir/users/signup.php?utype=admin" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6418046 VIP website status:| No Check ncca.ir SSL connection:| Grade: A Coordinated Disclosure Timeline...

neconf.ir XSS vulnerability

Vulnerable URL: http://www.neconf.ir/users/signup.php?utype=admin" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 12527931 VIP website status:| No Check neconf.ir SSL connection:|...

mdconf.ir XSS vulnerability

Vulnerable URL: http://mdconf.ir/users/signup.php?utype=admin" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3390821 VIP website status:| No Check mdconf.ir SSL connection:| Grade...

webhr.co XSS vulnerability

Vulnerable URL: https://webhr.co/signup.php?package=Basica75iy"...

frontendmasters.com XSS vulnerability

Vulnerable URL: https://frontendmasters.com/signup/confirmed/?email=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FOPENBUGBOUNTY%2F%29%3E%22=%22%3E%3Cimg%20src=x%20onerror=prompt%28/OPENBUGBOUNTY/%29%3E%22 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability...

weibo.com XSS vulnerability

Open Bug Bounty ID: OBB-166991 Description| Value ---|--- Affected Website:| weibo.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

ck12.org XSS vulnerability

Vulnerable URL: https://www.ck12.org/auth/signup/student?requestor='-alert'OPENBUGBOUNTY'-' Details: Description| Value ---|--- Patched:| Yes, at 21.03.2017 Latest check for patch:| 21.03.2017 22:47 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5833 VIP websit...

Keybase: Register multiple users using one invitation (race condition)

Hi, It is possible to create multiple accounts using a single invitationid due to a race condition bug in //api/1.0/signup.json. I have successfully created 8 accounts using invitation with id = 37c5a121adf23e90b875500d The account usernames: novijosiptest1,2,4,5,6,8,9,10 you can delete them, I...