209 matches found
Zulip 竞争条件问题漏洞
Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, a contention issue vulnerability exists in Zulip versions 4.0 and prior to 4.11, which stems from the fact that Zul...
8x8 Bounty: connect.8x8.com: deactivated users remain access to /api/v1/users/UUID/roles
Vulnerability description not provided...
JVN#49047921: Jimoty App for Android uses a hard-coded API key for an external service
Jimoty App for Android provided by Jimoty, Inc. uses a hard-coded API key for an external service CWE-798. Impact API key for an external service may be obtained by analyzing data in the app. Note that a user is not directly affected by this vulnerability. Solution Update the Application Update t...
Cross-Site Request Forgery (CSRF) in changeweb/unifiedtransform
✍️ Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
FreeBSD : Gitlab -- Multiple Vulnerabilities (8ba8278d-db06-11eb-ba49-001b217b3468)
Gitlab reports : DoS using Webhook connections CSRF on GraphQL API allows executing mutations through GET requests Private projects information disclosure Denial of service of user profile page Single sign-on users not getting blocked Some users can push to Protected Branch with Deploy keys A...
Gitlab -- Multiple Vulnerabilities
Gitlab reports: DoS using Webhook connections CSRF on GraphQL API allows executing mutations through GET requests Private projects information disclosure Denial of service of user profile page Single sign-on users not getting blocked Some users can push to Protected Branch with Deploy keys A...
GitLab: A deactivated user can access data through GraphQL
Summary A deactivated user should not be able to access information through the API. This rule is not enforced when making requests through the GraphQL endpoint. When reading through the changelog for 13.11.2 i noticed that the rule for a deactivated user allows for :login as it should but it is...
PT-2023-12545 · Odoo +1 · Odoo Community +2
Name of the Vulnerable Software and Affected Versions: Odoo Community versions 13.0 and earlier Odoo Enterprise versions 13.0 and earlier Description: The issue is related to improper access control, allowing users with deactivated accounts to access the system using their deactivated account and...
Acronis: Clickjacking on cas.acronis.com login page
Steps To Reproduce: Create a new HTML file Source code: I Frame Clickjacking Vulnerability Save the file as whatever.html Open document in browser Reference: https://hackerone.com/reports/591432 FIX- The vulnerability can be fixed by adding "frame-ancestors 'self';" to the CSP...
Top Echelon Software: able to login into login.topechelon.com
The support login for our administrative account was using insecure credentials, allowing access to our administrative account. These credentials are not used, so we chose to deactivate the login to prevent access...
Bitbucket sends email notifications to unlicensed users for pushed commits in a repository
h3. Issue Summary An unlicensed user will continue to receive email notifications for pushed commits for repositories that the user was watching and receiving notifications when active. h3. Steps to Reproduce User1 enables email repository email notifications to be sent immediately User1 watches...
Bitbucket sends email notifications to unlicensed users for pushed commits in a repository
h3. Issue Summary An unlicensed user will continue to receive email notifications for pushed commits for repositories that the user was watching and receiving notifications when active. h3. Steps to Reproduce User1 enables email repository email notifications to be sent immediately User1 watches...
MGASA-2018-0234 Updated libpam4j package fixes security vulnerability
It was discovered that libpam4j, a Java library wrapper for the integration of PAM did not call pamacctmgmt during authentication. As such a user who has a valid password, but a deactivated or disabled account could still log in CVE-2017-12197...
Shopify: Order notifications being sent for a deactivated staff account
Hi, Steps to reproduce : - - Have a staff account with settings permission - The staff account can go to notifications & add himself so as to get new order notifications - Now,deactivate the staff account via the admin. - Create a new order,you shall see that the staff still receives the order...
Soundy Audio Playlist <= 4.6 - XSS
Plugin is still affected and has been closed...
Filter Subscription emails should not be sent to deactivated users.
h3. Summary Email Filter Subscriptions are still sent after an user is marked as deactivated. h3. Steps to Reproduce Create a user belonging to jira-users group Deactivate the user Create a filter and subscribed to jira-users group Filter used: issuekey in issueHistory ORDER BY lastViewed DESC...
Shopify: Able to Login deactivated staff account in shopify app mobile
Hi Shopify, Deactivated staff account is able to login in shopify mobile app. STEPS 1. Login your owner account 2. Go to Staff Accounts and deactivate your staff account 3. Login to your staff account in your shopify mobile app As you can see you were able to login even the staff account was...
Vishing Attacks Targeting Dozens of Banks, Users' Card Data
A recent VoIP-based phishing campaign has been netting the payment card information of up to 250 Americans per day. Voice over IP phishing, or vishing, is a form of phishing that relies on users getting tricked into giving up their payment card information after receiving phone or SMS messages –...
CVE-2013-5039
The CVE-2013-5039 entry concerns the HOTBOX router (SAGEMCOM HOTBOX F@st 3184) with firmware 2.1.11. It describes a CSRF flaw in goform/wlanBasicSecurity that lets an attacker hijack administrator authentication to set WifiSecurity to Deactivated. Public material (e.g., exploit-db, packetstorm, 0...
