Design/Logic Flaw

The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page...

OPENSUSE-SU-2020:0003-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird was updated to 68.3esr MFSA 2019-38 bsc1158328 Security issues fixed: - CVE-2019-17008: Fixed a use-after-free in worker destruction bmo1546331 - CVE-2019-13722: Fixed a stack corruption due to incorrect number of...

Security update for MozillaThunderbird (important)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2020:0003-1 Rating: important References: Affected Products: openSUSE Leap 15.1 An update that contains security fixes can now be installed. Description: This update for MozillaThunderbird fixes the...

CVE-2015-4039

Multiple cross-site scripting XSS vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified 1 profile fields or 2 new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmatio...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified 1 profile fields or 2 new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmatio...

CVE-2019-8772

An issue existed in the handling of links in encrypted PDFs. This issue was addressed by adding a confirmation prompt. This issue is fixed in macOS Catalina 10.15. An attacker may be able to exfiltrate the contents of an encrypted PDF...

camping-app.info Cross Site Scripting vulnerability

Security Researcher IAMMUSTAFA Helped patch 521 vulnerabilities Received 9 Coordinated Disclosure badges Received 51 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting camping-app.info website and its users. Following...

Privilege escalation

When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device may be able to interact with the phone. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2019-2225

When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device may be able to interact with the phone. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is...

Stripo Inc: No CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email address

Summary: There's no CSRF protection in confirmation email resending feature as a result of which an attacker can trick the victim to receive a confirmation email unknowingly. In other features of the website, the content-type must be "application/json", and there is same-origin policy, which...

tiapepa.playfun.tv Cross Site Scripting vulnerability

Security Researcher devl00p Helped patch 2581 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting tiapepa.playfun.tv website and its users. Following...

OpenBSD Multiple Privilege Escalation and Authentication Bypass Vulnerabilities

Description OpenBSD is prone to multiple privilege-escalation and authentication-bypass vulnerabilities. An attacker may leverage these issues to bypass the authentication mechanism and gain elevated privileges. This may aid in further attacks. OpenBSD 6.6 version is vulnerable; other versions ma...

The vulnerability of Google Chrome’s CustomHandlers component, which allows a hacker to execute cross-site scripting attacks

The vulnerability of Google Chrome’s CustomHandlers component relates to the ability to bypass the user’s confirmation dialog. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created HTML page...

kocaeliolay.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1026681 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting kocaeliolay.com website a...

new-england-service.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1022959 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

72nnv.pw Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1013957 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Magento Security Bypass Vulnerability (CNVD-2019-40829)

Magento is an open source PHP e-commerce system from the U.S. company Magento. A security bypass vulnerability exists in Magento. An attacker can exploit this vulnerability to bypass the email confirmation mechanism via a GET request capturing the relevant account data obtained from the POST...

CVE-2019-8112

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation...

CVE-2019-8113

Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code for customer registration...

CVE-2019-8112

CVE-2019-8112 affects Magento Open Source/Commerce: unauthenticated attackers can bypass email confirmation via a GET request, leveraging data from the POST response during new user creation. Affected versions are Magento 2.2 prior to 2.2.10 and Magento 2.3 prior to 2.3.3 or 2.3.2-p1. The documen...