CVE-2024-9654

The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verifyguestemail' function to ensure the requesting user is the intended recipient of the purchase receipt. This...

Content Injection

sp-php-email-handler is vulnerable to Content Injection. The vulnerability is due to improper validation of email recipients and lack of sanitization of user-provided content in confirmation emails, allows attackers to specify arbitrary email addresses and inject malicious content...

Drupal core Access bypass

Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 befo...

CVE-2024-11599

Mattermost versions 10.0.x = 10.0.1, 10.1.x = 10.1.1, 9.11.x = 9.11.3, 9.5.x = 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration...

CVE-2024-11599

CVE-2024-11599 affects Mattermost where input-based email validation failure allows an unauthenticated user to bypass email domain restrictions during registration. Affected versions include 9.5.x (<= 9.5.11), 9.11.x (<= 9.11.3), 10.0.x (<= 10.0.1), and 10.1.x (9.5.11, >9.11.3, >10...

CVE-2024-11599 Domain Restriction Bypass on Registration

Mattermost versions 10.0.x = 10.0.1, 10.1.x = 10.1.1, 9.11.x = 9.11.3, 9.5.x = 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration...

PT-2024-17129 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.11 Mattermost versions 9.11.x through 9.11.3 Mattermost versions 10.0.x through 10.0.1 Mattermost versions 10.1.x through 10.1.1 Description: The issue is related to the improper validation of email...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an input validation error vulnerability that stems from failing to properly validate an email address, no details of the vulnerability are provided at this time...

PT-2024-30574 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.80 through 10.0.16 Description: The issue allows an unauthenticated user to use an application endpoint to check if an email address corresponds to a valid GLPI user. Recommendations: For versions 0.80 through 10.0.16, update ...

CVE-2024-9637 School Management System – WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.10. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it...

CVE-2024-9289 WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation

The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwaploginrequestcallback function not properly validating a user's identity prior to authenticating them to the site. This...

PT-2024-5205 · Cocoapods · Cocoapods

Name of the Vulnerable Software and Affected Versions: CocoaPods affected versions not specified Description: The issue concerns the CocoaPods dependency manager, specifically the authentication server trunk.cocoapods.org. A problem was found in the part of the trunk that verifies whether a user...

CVE-2024-5755

In lunary-ai/lunary versions =v1.2.11, an attacker can bypass email validation by using a dot character '.' in the email address. This allows the creation of multiple accounts with essentially the same email address e.g., '[email protected]' and '[email protected]', leading to incorrect...

CVE-2024-5755

In lunary-ai/lunary versions =v1.2.11, an attacker can bypass email validation by using a dot character '.' in the email address. This allows the creation of multiple accounts with essentially the same email address e.g., '[email protected]' and '[email protected]', leading to incorrect...

CVE-2024-5755 Email Validation Bypass in lunary-ai/lunary

In lunary-ai/lunary versions =v1.2.11, an attacker can bypass email validation by using a dot character '.' in the email address. This allows the creation of multiple accounts with essentially the same email address e.g., '[email protected]' and '[email protected]', leading to incorrect...

CVE-2024-5755

Summary: Lunary-ai/lunary versions ≤ v1.2.11 contain an input validation bypass where a dot in the email address can create multiple accounts that map to the same mailbox, causing synchronization and security concerns. Affected software: lunary-ai/lunary (≤ v1.2.11). Root cause (as described): em...

CVE-2024-5755 Email Validation Bypass in lunary-ai/lunary

In lunary-ai/lunary versions =v1.2.11, an attacker can bypass email validation by using a dot character '.' in the email address. This allows the creation of multiple accounts with essentially the same email address e.g., '[email protected]' and '[email protected]', leading to incorrect...

PT-2024-37122 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions =v1.2.11 Description: The issue allows an attacker to bypass email validation by using a dot character '.' in the email address, enabling the creation of multiple accounts with essentially the same email address. Thi...

Regular Expression Denial Of Service

kubeflow/kubeflow is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to the usage of a regular expression to validate email addresses which has inefficient complexity, allowing an attacker to submit a crafted email which results in excessive CPU consumption,...

WordPress Plugin WooCommerce-Social Login Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress Plugin...