Clario: Account Takeover because of the mis-configuration on the Password Reset Page

Summary https://api.account.opendoor.ltd has no rate-limit on the password reset's verification page. By this, I can take over any account. All I need to know is victim's email address. Step to reproduce 1. There is an endpoint - POST /v1/verification-code/forgot-password which will take POST dat...

Mail.ru: Account Takeover at worki.ru

One time code reuse between registration and authentication in combination with insufficient bruterofce protection allowed account access via verification code bruteforce for worki.ru. Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

pixiv: Reset any password

Summary: When I try to reset the password, the verification code of the mailbox is 6 digits, and there is no limit on the number of submissions, so I can reset the password of any user. Steps To Reproduce: 1.input the email reset password url. F595146 click the "submit" button F595147 input the...

Code injection

An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...

CVE-2019-8909

An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...

Security Advisory - Smart SMS Verification Code Vulnerability in Some Huawei Smart Phones

There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Website or malicious App and register. Due to incorrect processing of the smart SMS verification code, successful exploitation can cause sensitive information leak...

CVE-2018-18825

Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log...

Design/Logic Flaw

Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log...

CVE-2018-18825

Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log...

CVE-2018-18825

Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log...

Hunan Jiancheng Information Technology Co., Ltd. Jiancheng.com APP has information leakage vulnerability

The Building Program App is a construction and engineering app. There is an information leakage vulnerability in the Construction Engineering APP of Hunan Construction Engineering Information Technology Co. An attacker can register any account, reset any password and perform unauthorized operatio...

Chongqing to the home network technology limited company to the home to buy treasure APP there is information leakage vulnerability

The home has been purchased treasure to provide second-hand housing, new housing, rental housing, stores, information query, transaction brokerage and other services. CAPTCHA information leakage: This vulnerability is mainly in the registration and password retrieval, the server will return the...

Beijing Huijinxing Real Estate Brokerage Co., Ltd. magic sale APP has SMS bombing vulnerability

MagicSale is a new home distribution platform for institutional cooperation, helping brokers of cooperating institutions to effectively develop "inventory customers" in their hands, corresponding their needs to the new home market, and securely realizing the income of institutions and brokers. Th...

Anhui Yuanlu Information Technology Co., Ltd. deer Zhiyou APP there is information leakage vulnerability

Fawn Smart Tour is a smartphone tour guide software that provides hand-drawn maps of attractions, automatic positioning in scenic spots, and accompanied by vivid voice explanations, just like a tour guide on the go. CAPTCHA Design Vulnerability: This vulnerability mainly occurs when logging in,...

Beijing Beifang Founder Electronics Company Limited Economic Reference News APP has information leakage vulnerability

Economic Reference News App is a news and information application. An information leakage vulnerability exists in the Economic Reference News APP of Beijing Beifang Founder Electronics Co. An attacker can register any account, reset any password and perform unauthorized operations by capturing th...

Is two-factor authentication (2FA) as secure as it seems?

Two-factor authentication 2FA was invented to add an extra layer of security to the—now considered old-fashioned and insecure—simple login procedure of entering a username and password. One of the most well-known examples of 2FA is when you try to log into a familiar website from a different...

Caixin Media Limited Caixin App has SMS Bombing Vulnerability

Caixin APP is the must-read financial information client of Caixin Media, providing users with comprehensive, in-depth, instant and accurate financial news and information information. Caixin APP of Caixin Media Co., Ltd. suffers from SMS bombing vulnerability, the vulnerability stems from the...

Information Leakage Vulnerability in Little Tail Translator APP of Language Network (Wuhan) Information Technology Co.

Little Tail Translator is an online translation mobile application of Language Network Wuhan Information Technology Co., Ltd, which realizes translation between multiple languages and can quickly translate words or whole sentences. A vulnerability exists in the Little Tail Translator app, which i...

paypal/permissions-sdk-php cross-site scripting vulnerability

paypal/permissions-sdk-php is a PHP-based Paypal payment software development kit. A cross-site scripting vulnerability exists in the 'verificationcode' parameter of the samples/GetAccessToken.php file in paypal/permissions-sdk-php. A remote attacker could exploit this vulnerability to execute co...

CVE-2018-14596

wancms 1.0 through 5.0 allows remote attackers to cause a denial of service resource consumption via a checkcode aka verification code URI in which the values of fontsize, width, and height are large numbers...