Email Validation Bypass And Preventing Sign Up From Email's Owner

Summary Email validation can easily be bypassed because verifyemailenabled option enable email validation at sign up only. A user changing it's email after signing up and verifying it can change it without verification in /profile. This can be used to prevent legitimate owner of the email address...

Default configuration

A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verifyemailenabled" will only validate email only on sign up...

Improper Authentication

Overview omniauth-microsoftgraph is an omniauth provider for new Microsoft Graph API. Affected versions of this package are vulnerable to Improper Authentication due to missing validation of the email attribute. An attacker can take over accounts by exploiting the trust placed in the email as a...

CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

PT-2024-18984 · Rubygems · Omniauth-Microsoft Graph

Name of the Vulnerable Software and Affected Versions: omniauth-microsoft graph versions prior to 2.0.0 Description: The implementation did not validate the legitimacy of the email attribute of the user nor did it give or document an option to do so, making it susceptible to nOAuth misconfigurati...

SUSE CVE-2020-7754

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters...

Design/Logic Flaw

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...

CVE-2023-45150 Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...

CVE-2023-45150

CVE-2023-45150 concerns Nextcloud Calendar. The Red Hat/Reddit/GHSA and CVE records describe a flaw in the Nextcloud Calendar app where missing precondition checks allow handling of arbitrarily long strings (e.g., overly long email addresses), leading to a busy, unresponsive server and potential ...

Zod denial of service vulnerability during email validation

Impact API servers running express-zod-api having: - version of express-zod-api below 10.0.0-beta1, - and using the following or similar validation schema in its implementation: z.string.email, are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in zod versions up t...

GHSA-MVRP-3CVX-C325 Zod denial of service vulnerability during email validation

Impact API servers running express-zod-api having: - version of express-zod-api below 10.0.0-beta1, - and using the following or similar validation schema in its implementation: z.string.email, are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in zod versions up t...

Design/Logic Flaw

The 'Email' parameter of the processlogin.php resource does not validate the characters received and they are sent unfiltered to the database...

GHSA-M95Q-7QP3-XV42 Zod denial of service vulnerability

Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails...

CVE-2023-4316

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails...

Denial of service

Zod in version 3.22.2 allows an attacker to perform a denial of service while validating emails...

CVE-2023-4316 Zod 3.22.2 - Regular expression Denial of Service

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails...

CVE-2023-4316

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails...

CVE-2023-4316

CVE-2023-4316 affects Zod versions 3.21.0 through 3.22.3, enabling denial-of-service when validating emails due to inefficient regex handling. Affected software: Zod (JavaScript/TypeScript). Root cause: regex-based email validation can be exploited to exhaust resources. Impact: DoS during email v...

CVE-2023-4316: Inefficient Regular Expression Complexity

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails...

npm zod security vulnerability

npm zod is a TypeScript-first schema declaration and validation library from npm USA. A security vulnerability exists in Zod version 3.22.2, which stems from a vulnerability that allows an attacker to perform a denial-of-service attack while validating an email...