253 matches found
GitLab Community Edition (CE) 13.10.3 - (Sign_Up) User Enumeration Vulnerability
Exploit Title: GitLab Community Edition CE 13.10.3 - 'SignUp' User Enumeration Exploit Author: @4D0niiS https://github.com/4D0niiS Vendor Homepage: https://gitlab.com/ Version: 13.10.3 Tested on: Kali Linux 2021.1 INFO: An unauthenticated attacker can remotely enumerate the existence of different...
MTN Group: Email verification bypassed during sing up (https://developers.mtn.com/profile)
Summary: Normally https://developers.mtn.com ask users to verify their email during registration but i found a way to bypass this so than an attacker can create accounts with emails that are not his own abusing the intigrity of MTN. Steps To Reproduce: 1. Create an account with you owned email,...
h1-ctf: 12 Days of CTF Walkthroughs
h1-ctf: 12 Days of Hacky Holidays This is my writeup for 12 Days of Hacky Holidays. The report is written such that beginners to CTFs will be able to learn the tricks of the trade. The Mission: The Grinch has gone hi-tech this year with the intention of ruining the holidays đ±We need you to...
Damn-Vulnerable-Bank - Vulnerable Banking Application For Android
Damn Vulnerable Bank Android Application aims to provide an interface for everyone to get a detailed understanding with internals and security aspects of android application. How to Use Application Clone the repository and run the Backend Server as per instructions in the link. We have released t...
EvilDLL - Malicious DLL (Reverse Shell) Generator For DLL Hijacking
Read the license before using any part from this code : Malicious DLL Win Reverse Shell generator for DLL Hijacking Features: Reverse TCP Port Forwarding using Ngrok.io Custom Port Forwarding option LHOST,LPORT Example of DLL Hijacking included Half-Life Launcher file Tested on Win7 7601, Windows...
Gitlab -- Multiple Vulnerabilities
Gitlab reports: User Email Verification Bypass OAuth Flow Missing Email Verification Checks Notification Email Verification Bypass Undisclosed Vulnerability on a Third-Party Rendering Engine Group Sign-Up Restriction Bypass Mirror Project Owner Impersonation Missing Permission Check on Fork...
WordPress Official MailerLite Sign Up Forms plugin <= 1.4.3 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability found by Dave WebARX in WordPress Official MailerLite Sign Up Forms plugin versions = 1.4.3. Solution Update the WordPress Official MailerLite Sign Up Forms plugin to the latest available version at least 1.4.4...
Official MailerLite Sign Up Forms < 1.4.4 - Unauthenticated SQL Injection
Most methods in the MailerLite plugin do not sanitize user input data which causes SQL injection. Also no single method checks for a nonce token which causes a CSRF issue everywhere. PoC One example would be to inject the payload 1 union all select database,2,3,1,5 into the formid GET parameter o...
Official MailerLite Sign Up Forms < 1.4.5 - Multiple CSRF Issues
Despite fixing the SQL injection, the plugin was still affected by CSRF issues, which could allow an attacker to make a logged in administrator edit, add, and delete arbitrary signup form views...
Official MailerLite Sign Up Forms < 1.4.4 - Unauthenticated SQL Injection
Most methods in the MailerLite plugin do not sanitize user input data which causes SQL injection. Also no single method checks for a nonce token which causes a CSRF issue everywhere. One example would be to inject the payload 1 union all select database,2,3,1,5 into the formid GET parameter of th...
UBUNTU-CVE-2019-14880
A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email address changes require additional verification during sign-up to reduce the risk of account compromise...
CVE-2020-10535
GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address...
PT-2020-12191 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 12.8.x through 12.8.5 Description: The issue allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconfirmed email address when sign-up is enabled. Recommendations: For GitLab...
Gitlab -- Vulnerability
Gitlab reports: Email Confirmation not Required on Sign-up...
CVE-2019-13190
In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page...
CVE-2016-10903
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF...
CVE-2016-10903
CVE-2016-10903 is a CSRF vulnerability in the GoDaddy WordPress plugin GoDaddy Email Marketing Sign-Up Forms, affected in versions before 1.1.3. Multiple sources (NVD, Red Hat, CNVD, PRION, CVE lists, and WPVulndb) consistently identify the issue as cross-site request forgery within this plugin. ...
Nextcloud: SignUp using Fake Email
In this trial I used the email '[email protected]' and after pressing the SIGN UP button it will automatically redirect to https://ppp.woelkli.com/apps/preferredproviders/password/set/emailfakeforregister/H2qlEWHxQ3yiJgCsEXkR8, not through the account verification process first. For full the link Po...
Hacker Breaks Into French Government's New Secure Messaging App
A white-hat hacker found a way to get into the French government's newly launched, secure encrypted messaging app that otherwise can only be accessed by officials and politicians with email accounts associated with the government identities. Dubbed "Tchap ," the end-to-end encrypted, open source...
