CVE-2020-5239

In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All...

Improper authentication in Symfony

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/securit...

GHSA-CCHX-MFRC-FWQR Improper authentication in Symfony

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/securit...

The vulnerability of Huawei USG9500’s microprogramming software allows a intruder to compromise the confidentiality and integrity of the protected information.

The vulnerability of Huawei USG9500’s microprogramming network interface card is related to insufficient protection for registration data. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

DVD Photo Slideshow Professional 8.07 Buffer Overflow

Exploit Title: DVD Photo Slideshow Professional 8.07 - 'Key' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-10 Vendor Homepage : http://www.picture-on-tv.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the python exploit script, it will create ...

February 11, 2020-KB4534129 Cumulative Update for .NET Framework 4.8 for Windows 10 Version 1709

None None...

February 11, 2020-KB4534130 Cumulative Update for .NET Framework 4.8 for Windows 10 Version 1803

None None...

Wedding Slideshow Studio 1.36 Buffer Overflow

Exploit Title: Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-09 Vendor Homepage : http://www.wedding-slideshow-studio.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the python exploit script, it will crea...

Profile Builder and Profile Builder Pro < 3.1.1 - User Registration With Administrator Role

The plugin is affected by a broken authentication vulnerability, allowing unauthenticated users to register or edit their account and gain the Administrator role using the plugin's forms. The vulnerability only exists in the Plugin's own generated Registration Form or Profile Edit Form. This mean...

WordPress Profile Builder Pro plugin <= 3.1.0 - User Registration With Administrator Role vulnerability

User Registration With Administrator Role vulnerability found by Noman Riffat in WordPress Profile Builder Pro plugin versions = 3.1.0. Solution Update the WordPress Profile Builder Pro plugin to the latest available version at least 3.1.1...

WordPress Profile Builder plugin <= 3.1.0 - User Registration With Administrator Role vulnerability

User Registration With Administrator Role vulnerability found by Noman Riffat in WordPress Profile Builder plugin versions = 3.1.0. Solution Update the WordPress Profile Builder plugin to the latest available version at least 3.1.1...

Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow

Exploit Title: Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow Exploit Author : ZwX Exploit Date: 2020-02-09 Vendor Homepage : http://www.wedding-slideshow-studio.com/ Tested on OS: Windows 10 v1803 Social: twitter.com/ZwX2a Steps to Reproduce: 1. Run the python exploit script, it will crea...

Registration Magic < 4.6.0.3 - Multiple Cross-Site Scripting (XSS)

The plugin is affected by an unauthenticated Stored XSS on the Contact Form which could allow attacks against administrators viewing the submissions. As well as multiple reflected XSS...

Registration Magic < 4.6.0.3 - Authenticated SQL Injection via Form_id

The RegistrationMagic – Custom Registration Forms and User Login WordPress plugin was affected by an Authenticated SQL Injection via Formid security vulnerability. https://example.com/wp-admin/admin.php?page=rmanalyticsshowform&rmformid=selectfromselectsleep20a&rmtr=30...

Reddit: registering with the same email address multiple times leads to account takeover

i'm not sure if this issue is in scope or not or if it's intended , kindly if you don't accept this issue please close it as informative , thanks in advance Summary: the ability of the user to register many times using the same mail address can lead to account take over Steps To Reproduce: 1...

The vulnerability of Cisco IOS XE SD-WAN software, related to errors in managing registration data, allows a hacker to gain full control over the device.

The vulnerability of Cisco IOS XE SD-WAN software is related to errors in managing registration data. Exploiting this vulnerability can allow a attacker to gain full control over the device...

The vulnerability in the web interface of the Cisco Data Center Network Manager (DCNM) system allows a perpetrator to perform arbitrary actions on the vulnerable device.

The vulnerability of the Web interface for controlling the Cisco Data Center Network Manager DCNM system is related to the use of pre-installed registration data. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device remotely...

The vulnerability of the REST API interface of the Cisco Data Center Network Manager system allows a attacker to perform arbitrary actions on the vulnerable device.

The vulnerability of the REST API interface of the Cisco Data Center Network Manager DCNM system is related to the use of pre-installed registration data. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device remotely...

The vulnerability of the SOAP API interface of the Cisco Data Center Network Manager system allows a attacker to perform arbitrary actions on the vulnerable device.

The vulnerability of the SOAP API interface of the Cisco Data Center Network Manager DCNM system is related to the use of pre-installed registration data. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device remotely...

WordPress CarSpot premium theme <= 2.2.2 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (registration form & user profile)

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress CarSpot premium theme versions = 2.2.2. Solution Update the WordPress CarSpot premium theme to the latest available version at least 2.2.3...