The vulnerability of the EmailValidator and URLValidator components of the Django web application software platform allows a hacker to trigger a service failure.

The vulnerability of the EmailValidator and URLValidator components of the Django web application framework is related to the use of a regular expression with high computational complexity when processing email subject lines and URL addresses. Exploiting this vulnerability could allow an attacker...

PT-2023-6404 · Nextcloud +1 · Nextcloud Calendar +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Calendar app versions prior to 4.4.4 Description: The issue is related to missing precondition checks in the Nextcloud calendar app, which causes the server to attempt validation of strings of any length as email addresses. This can...

DEBIAN-CVE-2023-36053

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS regular expression denial of service attack via a very large number of domain name labels of emails and URLs...

CVE-2023-34099

Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7....

Shopware 代码问题漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware. A code issue vulnerability exists in Shopware versions prior to 5.7.18 that stems from some flaws in the email validation during the registration process, so that different email addresses may be constructed,...

CVE-2023-3128

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app...

CVE-2023-3128

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app...

CVE-2023-3128

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app...

WordPress Plugin WooCommerce 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Improper Access Control

thorsten/phpmyfaq is vulnerable to Improper Access Control. The vulnerability exists due to the lack of validation of email addresses in ajaxservice.php which allows an attacker to take over another account...

Incorrect Authorization

kiwitcms is vulnerable to Incorrect Authorization. The vulnerability exists in email parameter of admin.py because it does not properly validate email addresses in the admin page, which allows an attacker to change an email address without verifying ownership during account registration...

CVE-2023-1204

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically...

Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically...

phpMyFAQ Improper Access Control vulnerability

phpMyFAQ prior to version 3.1.13 does not properly validate email addresses when updating user profiles. This vulnerability allows an attacker to manipulate their email address and change it to another email address that is already registered in the system, including email addresses belonging to...

SUSE CVE-2010-3710

Stack consumption vulnerability in the filtervar function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTERVALIDATEEMAIL mode is used, allows remote attackers to cause a denial of service memory consumption and application crash via a long e-mail address string...

Privilege Escalation

github.com/grafana/grafana is vulnerable to privilege escalation due to improper email validation in the response parameter of orginvite.go. Admins can create new users with a registration link sent via email, allowing an attacker to register a user on the site with a different email address used...

CVE-2022-39355 Discourse Patreon vulnerable to improper validation of email during Patreon authentication

Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number...

rdiffweb's unlimited length Fullname field can lead to DoS

rdiffweb prior to 2.5.0a3 does not validate email length, allowing users to insert an email longer than 255 characters. If a user signs up with an email with a length of 1 million or more characters and logs in, withdraws, or changes their email, the server may cause denial of service due to...

GHSA-FQFG-C577-2VC3 rdiffweb's unlimited length Fullname field can lead to DoS

rdiffweb prior to 2.5.0a3 does not validate email length, allowing users to insert an email longer than 255 characters. If a user signs up with an email with a length of 1 million or more characters and logs in, withdraws, or changes their email, the server may cause denial of service due to...

rdiffweb's unlimited length email field can lead to DoS

rdiffweb prior to 2.4.8 does not validate email length, allowing users to insert an email longer than 255 characters. If a user signs up with an email with a length of 1 million or more characters and logs in, withdraws, or changes their email, the server may cause denial of service due to...