Staging.every.org: Improper email address verifiation while saving Account Details

Summary: Attacker could be able change its email to any email address even already created another user's email address.Even though UI doesnot allow it Steps To Reproduce: 0. Set up proxy. 1. Singup with any email address 2. Go to profile section 3. Click on update button 4. Monitor call in rever...

Stripo Inc: my.stripo.emai email verification bypassed and also create email templates

Summary: According to the Stripo.emai When the new user sign up Stripo.email allow to create email templates after the verification of the email of Your stripo account. Until your email get verified You are not able to create a email templates in your acc. User need to verified their email...

Stripo Inc: Email verification bypasa

Email verification bypass: after finishing the registration user need to verify the email address, this can be bypased while loggin in to the account...

Automattic: Follow by email allows for following by unverified emails

The initial report outlined being able to add any email to a Tumblr account without verifying it first which is expected behavior that does not pose a security risk. However, the reporter also reported that these unverified emails were able to be used in our “follow by email” feature which we did...

CVE-2019-5486

A authentication bypass vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements...

CVE-2019-5486

A authentication bypass vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements...

Authentication flaw

A authentication bypass vulnerability exists in GitLab CE/EE v12.3.2, v12.2.6, and v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements...

CVE-2019-5486

Removed by vendor...

CVE-2019-5486

CVE-2019-5486 - GitLab Salesforce login integration authentication bypass : The vulnerability affects GitLab CE/EE versions prior to 12.3.2, prior to 12.2.6, and prior to 12.1.10 when using the Salesforce login integration. An attacker can create an account that bypasses domain restrictions and e...

Stripo Inc: Bypass email verification and create email template with the editor

Description : The main goal to use the Stripo is to create an email templates with the editor that is available in the account. And you're not allowed to open it until you validate your email address. But by modifying the response , i was able to bypass the email verification. Steps To Reproduce:...

Trint Ltd: SSO bypass in zendesk using trint organization able to leak internal ticket information

Summary hello there because in app.trint.com there's no email verification i able to login in your zendesk SSO using your organization your organization using domain @trint.com because there's no email verification i able to read and takeover + claim this email [email protected] and i able to...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b17c86b9-e52e-11e9-86e9-001b217b3468)

SO-AND-SO reports : XSS in Markdown Preview Using Mermaid Bypass Email Verification using Salesforce Authentication Account Takeover using SAML Uncontrolled Resource Consumption in Markdown using Mermaid Disclosure of Private Project Path and Labels Disclosure of Assignees via Milestones Disclosu...

Gitlab -- Multiple Vulnerabilities

The GitLab Team reports: XSS in Markdown Preview Using Mermaid Bypass Email Verification using Salesforce Authentication Account Takeover using SAML Uncontrolled Resource Consumption in Markdown using Mermaid Disclosure of Private Project Path and Labels Disclosure of Assignees via Milestones...

Akaunting 1.3.17 Cross Site Scripting

Title: Stored XSS In akaunting compnay name alt Affected Version: 1.0.0 - 1.3.17 Tested on: Chrome, Firefox, Opera Latest version Author: Rudra Sarkar @rudr4sarkar 1. Affected "alt" attribute 2. Create account, Confirm Email Verification 3. Create Company name with "alertdocument.domain; 4. It wi...

Omise: Signup with any email and enable 2FA without verifying email

Description : When i signup, i can enable 2FA without verification my email. Attack Scenario : 1. The Attacker signup with the victim email. 2. Go to Two factor authetication and enable 2FA Impact when the victim want to register in this site, they can't, because they email claims by attacker. an...

DRUPAL-CONTRIB-2019-066

This module enables you to have a separate permission only for creating users. The module doesn't respect Drupal's setting for "Who can register accounts?" when set to "Visitors, but administrator approval is required". When this option is chosen, the module overrides the setting, and makes it...

CVE-2019-5473

An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4...

CVE-2019-5473

An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4...

CVE-2019-5473

An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4...

CVE-2019-5473

GitLab CVE-2019-5473: an authentication issue allows bypassing email verification. Affected deployments prior to GitLab 12.0.4/12.1.2; remediation is to upgrade to GitLab 12.0.4 or 12.1.2 (or later). Multiple advisories and reports (Red Hat, Ubuntu, Debian, OSV, CVE lists, and a HackerOne writeup...