CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

PT-2024-18984 · Rubygems · Omniauth-Microsoft Graph

Name of the Vulnerable Software and Affected Versions: omniauth-microsoft graph versions prior to 2.0.0 Description: The implementation did not validate the legitimacy of the email attribute of the user nor did it give or document an option to do so, making it susceptible to nOAuth misconfigurati...

SUSE CVE-2020-7754

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters...

Design/Logic Flaw

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...

CVE-2023-45150 Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...

CVE-2023-45150

CVE-2023-45150 concerns Nextcloud Calendar. The Red Hat/Reddit/GHSA and CVE records describe a flaw in the Nextcloud Calendar app where missing precondition checks allow handling of arbitrarily long strings (e.g., overly long email addresses), leading to a busy, unresponsive server and potential ...

GHSA-MVRP-3CVX-C325 Zod denial of service vulnerability during email validation

Impact API servers running express-zod-api having: - version of express-zod-api below 10.0.0-beta1, - and using the following or similar validation schema in its implementation: z.string.email, are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in zod versions up t...

Zod denial of service vulnerability during email validation

Impact API servers running express-zod-api having: - version of express-zod-api below 10.0.0-beta1, - and using the following or similar validation schema in its implementation: z.string.email, are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in zod versions up t...

Design/Logic Flaw

The 'Email' parameter of the processlogin.php resource does not validate the characters received and they are sent unfiltered to the database...

GHSA-M95Q-7QP3-XV42 Zod denial of service vulnerability

Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails...

CVE-2023-4316

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails...

Denial of service

Zod in version 3.22.2 allows an attacker to perform a denial of service while validating emails...

CVE-2023-4316 Zod 3.22.2 - Regular expression Denial of Service

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails...

CVE-2023-4316

CVE-2023-4316 affects Zod versions 3.21.0 through 3.22.3, enabling denial-of-service when validating emails due to inefficient regex handling. Affected software: Zod (JavaScript/TypeScript). Root cause: regex-based email validation can be exploited to exhaust resources. Impact: DoS during email v...

PT-2023-28722 · Zod · Zod

Name of the Vulnerable Software and Affected Versions: Zod versions 3.21.0 through 3.22.3 Description: The issue allows an attacker to perform a denial of service while validating emails. This is related to a ReDoS vulnerability. Recommendations: For versions 3.21.0 through 3.22.3, update to a...

npm zod security vulnerability

npm zod is a TypeScript-first schema declaration and validation library from npm USA. A security vulnerability exists in Zod version 3.22.2, which stems from a vulnerability that allows an attacker to perform a denial-of-service attack while validating an email...

CVE-2023-41316

Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitati...

CVE-2023-40179

Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the specified email was not found in our database. It would only display the "Enter the code" form if the email is associated with a member o...

Code injection

Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the specified email was not found in our database. It would only display the "Enter the code" form if the email is associated with a member o...

CVE-2023-40179

The CVE-2023-40179 entry describes an account enumeration vulnerability in Silverware Games. Prior to version 1.3.6, the Password Recovery flow returned an error when the email was not in the database, which could reveal whether an email is registered. Since version 1.3.6, the password reset flow...