CVE-2025-48187

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting...

CVE-2025-48187

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting...

CVE-2024-41256

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack...

Security Vulnerability of Switzerland’s E-Voting System

Online voting is insecure, period. This doesnt stop organizations and governments from using it. And for low-stakes elections, its probably fine. Switzerland--not low stakes--uses online voting for national elections. Andrew Appel explains why its a bad idea: Last year, I published a 5-part serie...

CVE-2023-42820

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...

Design/Logic Flaw

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...

CVE-2023-42820 Random seed leakage in Jumpserver

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...

CVE-2023-42820 Random seed leakage in Jumpserver

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...

PT-2023-5833 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 2.28.19 JumpServer versions prior to 3.6.5 Description: The issue is related to the exposure of the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, whi...

Google Exposure Notifications Verification Server 安全漏洞

Google Exposure Notifications Verification Server is an open source Covid-19 Exposure Notifications verification component from Google USA. A security vulnerability exists in versions prior to Google Exposure Notifications Verification Server V1.1.2, which can be exploited by an attacker to...

GHSA-WX8Q-RGFR-CF6V Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server

Impact Users or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID. Patches v1.1.2+ Workarounds There are no workarounds, and there are no indications this has been exploited in the wild. Verification codes can on...

Telegram-powered bots circumvent 2FA

Two-factor authentication is a great way to protect your online accounts, and we always recommend you turn it on. But where users put up walls, you can be sure there are cybercriminals trying to break them down. Yesterday, security intelligence firm, Intel 147, revealed it had noticed an uptick o...

Nanjing Ironbound Network Technology Co., Ltd. 114 Ticketing APP has logic flaws and vulnerabilities

Nanjing Tiehang Network Technology Co., Ltd, referred to as Tiehang.com, was founded in 2011, the use of IT technology and Internet thinking, the national train tickets online shopping one-stop service, is the domestic train tickets online shopping platform. Nanjing Ironbound Network Technology...

Guangdong Provincial Transportation Group Limited Guangdong Expressway APP has information leakage vulnerability

Guangdong Expressway app is a mobile application for highway traffic information service launched by Guangdong Provincial Transportation Group Company Limited Highway Monitoring Center for the public. There is an information leakage vulnerability in Guangdong Expressway App of Guangdong Provincia...

Casual Borrowing Loan App Has Logic Flaw Vulnerability

Casual Loan App is a professional mobile loan software for quick loans. Casual Loan APP has a logic flaw vulnerability, attackers can use packet grabbing tools to blast the verification code in the packet and utilize the vulnerability to cause information leakage...

Beijing Joyful Growth Technology Co., Ltd. new growth APP there are arbitrary cell phone number registration vulnerability

New Growth APP is an application to record the growth of parents and children developed by Beijing Joyful Growth Technology Co. Ltd. There is an arbitrary cell phone number registration vulnerability in the New Growth APP. Due to the small number of verification code digits and the lack of checks...

Shanghai Jumo Information Technology Co., Ltd. radish borrowing APP has information leakage vulnerability

Radish Borrowing APP is a small borrowing money fast installment loan software. Shanghai Jumo Information Technology Co. Radish Borrowing APP has information leakage vulnerability. Attackers can register any account and reset any password by grabbing packets to get verification code...

Logic design flaws in Direct Marketing Mastermind App

The Direct Marketing Everything App is a live streaming platform that focuses on education and training. There is a logic design vulnerability in the Direct Marketing Master App. Attackers can log into other people's accounts and obtain sensitive information by grabbing packets to obtain...

Rimet Wifi Smart Temperature Control Android APP is vulnerable to reset arbitrary account passwords

Rimet Wifi Smart Temperature Control Android APP is a management platform for smart hardware devices. Rimet Wifi Android APP is vulnerable to reset any account password. Attackers can reset any password and enter the device management interface to remotely operate various temperature control, gas...

Top Smart Android APP has logic design flaws

Top Smart Android APP is a marketing management software for the majority of users. The software can help users keep abreast of information developments and activities in the smart home industry. There is a logic design vulnerability in Top Smart Android APP. Attackers can log in to any account b...