1783 matches found
CVE-2020-0063
CVE-2020-0063 affects Android SurfaceFlinger, where the UI confirmation screen protected by the TEE can be overridden, enabling local elevation of privilege. Root cause: manipulation of the UI flow in SurfaceFlinger allows bypassing user interaction. Impact: local privilege escalation with high s...
cirugiaycirujanos.com Cross Site Scripting vulnerability
Security Researcher g0bl1nsec Helped patch 3608 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting cirugiaycirujanos.com website and its users. Following...
The vulnerability in the `createImageBitmap` function of Firefox browsers, Firefox ESR, and the Thunderbird email client, related to a data source confirmation error, allows attackers to disclose protected information.
The vulnerability of the createImageBitmap function in Firefox, Firefox ESR, and the Thunderbird email client involves reading images from various sources, which violates the company’s policies. Exploiting this vulnerability can allow an attacker to disclose protected information remotely...
Nord Security: Unauthorized User Can Delete Any User Account
DESCRIPTION: Your help desk allows creating tickets by email. Which means the user can send an email to the NordVPN support email to a add a new ticket to his activities. So when you send an email to [email protected] from your email address, this ticket will be created on the account that you...
Monero: Monero wallet password change is confirmed when not matching
Summary: If you change your wallet password in gui, the confirmation does not need to match the new password. Releases Affected: list each version and OS of the application affected list each version and OS of the application affected Steps To Reproduce: Open your wallet. Go to settings. Change...
tarcisiodelgadoblog.com.br Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1097332 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
ehome.co.za Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1095480 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
chemicalshoppe.com Cross Site Scripting vulnerability
Security Researcher ELProfesor Helped patch 2738 vulnerabilities Received 8 Coordinated Disclosure badges Received 105 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting chemicalshoppe.com website and its users. Following...
The vulnerability of the Firefox browser’s Upgrade-Insecure-Requests specification, related to a data source confirmation error, allows a hacker to access confidential data and compromise its integrity.
The vulnerability of the Upgrade-Insecure-Requests specification in the Firefox browser is related to a data source confirmation error. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...
The vulnerability of Firefox browser, related to incorrect application installation when pressing the ALT + a keys on the keyboard, allows the attacker to compromise data integrity.
The vulnerability of Firefox browsers is related to the incorrect installation of extensions when pressing the ALT + a keys on the keyboard. This allows extensions to be installed without user confirmation. Exploiting this vulnerability can enable an attacker to compromise data integrity remotely...
Shopify: Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation
Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation Summary This report is based on the scenario that email confirmation has been bypassed already, like shown in 791775. What happened in 791775 was, I was too excited and didn't take a step...
Shopify: [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation
Summary In 791775, I submitted a bug at Sunday 5pm Canada time, it was triaged two hours later, and I got the temp fix message at around 3am the next day in Canada time. Truly awesome, the next day I retested after the first fix, and found that I - Cannot receive the email confirmation in the ema...
Shopify: Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO
I told Pete I would take a look at Spotify, hi Pete. Summary It's possible to take over any store account through bypassing the email confirmation step in .myshopify.com. I found a way to confirm arbitrary emails, and after confirming arbitrary email in .myshopify.com, user is able to integrate...
TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot Vulnerability
Exploit for hardware platform in category web applications Exploit Title: TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot Exploit Author: PCEumel Vendor Homepage: https://www.tp-link.com/ Software Link: https://www.tp-link.com/us/support/download/tl-sg105e/Firmware Version: TP-Link...
CVE-2011-3582
A Cross-site Request Forgery CSRF vulnerability exists in Advanced Electron Forums AEF through 1.0.9 due to inadequate confirmation for sensitive transactions in the administrator functions...
Fedora 31 : phpMyAdmin (2020-a1b4afe7b5)
Version 5.0.1 2020-01-07 - issue 15719 Fixed error 500 when browsing a table when $cfg'LimitChars' used a string and not an int value - issue 14936 Fixed display NULL on numeric fields has showing empty string since 5.0.0 - issue 15722 Fix get Database structure fails with PHP error on replicated...
CVE-2011-2934
A Cross Site Request Forgery CSRF vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for sensitive transactions...
Yelp: No rate limiting for confirmation email lead to email flooding
Description: There is no rate limiting implemented in sending the confirmation email. Thus, attacker can use this vulnerability to bomb out the email inbox of the victim. Affected URL: https://biz.yelp.com/welcome/resendconfirmation with POST method Details: 1. Login to biz.yelp.com 2. Go to...
secure.reichelt.de Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1065381 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
sto-nemcev.ru Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1064294 Security Researcher geeknik Helped patch 8722 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting sto-nemcev.ru website and...