Verification Process Spoofing

django-rest-registration is vulnerable to verification process spoofing. The misuse of django signing API and just relying on static string for signatures leads to easily guessable signatures used for email verification...

Design/Logic Flaw

verification.py in django-rest-registration aka Django REST Registration library before 0.5.0 relies on a static string for signatures i.e., the Django Signing API is misused, which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to...

CVE-2019-13177

verification.py in django-rest-registration aka Django REST Registration library before 0.5.0 relies on a static string for signatures i.e., the Django Signing API is misused, which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to...

Facebook Collected Contacts from 1.5 Million Email Accounts Without Users' Permission

Not a week goes without a new Facebook blunder. Remember the most recent revelation of Facebook being caught asking users new to the social network platform for their email account passwords to verify their identity? At the time, it was suspected that Facebook might be using access to users' emai...

chilijelly.net Open Redirect vulnerability

Vulnerable URL: http://www.chilijelly.net/flashdetection.swf?flashContentURL=https://openbugbounty.org Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 07.01.2018 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank...

U.S. Dept Of Defense: Attackers can control which security questions they are presented (████████)

Summary: When clicking on the forgot password link on ██████, the questions used to verify identify can be arbitrarily selected by an attacker. Description: When clicking on the forgot password link on ██████████, the questions used to verify identify can be arbitrarily selected by an attacker...

Coinbase: Information disclosure of user by email using buy widget

In the Coinbase Buy Widget flow, we were displaying the last 4 digits of a user's phone number for verification purposes e.g. "we've send a code to xxx-1234". Industry standard seems to be 2 digits instead of 4, so we now mask all but the last 2 digits...

Updated perl-Module-Signature packages fix security vulnerabilities

Updated perl-Module-Signature package fixes the following security vulnerabilities reported by John Lightsey: Module::Signature could be tricked into interpreting the unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries. When verifying t...

Threat Outbreak Alert: Fake Account Lockout Notice Email Messages on May 14, 2014

Medium Alert ID: 34222 First Published: 2014 May 14 14:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an account lockout notice for the recipient. The text in the email message attempts to convince the recipient to...

xheditor editor upload. php malformed file upload vulnerability-vulnerability warning-the black bar safety net

The code uses a whitelist mechanism to verify, press the truth to say that the white list are generally relatively safe. But the problem arises in the verification process where verification extension use The is a regular pregmatch method As long as we construct the suffix name contains a white...

OpenOffice: Duplicated, Unprotected Certificate Information shown in Signed ODF Documents

Affects: OpenOffice 2.3.0 and 2.2.0 and possibly older versions I. Background OpenOffice is a opensource suite containing several programs to handle Office documents like text documents or spreadsheets. The latest version uses an XML based document format ODF. OpenOffice allows documents to be...

MDKSA-2001:019 - xemacs update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Linux-Mandrake Security Update Advisory Package name: xemacs Date: January 31st, 2001 Advisory ID: MDKSA-2001:019 Affected versions: 6.0, 6.1, 7.0, 7.1, 7.2, Corporate Server 1.0.1 Problem Description: Previous versions of XEmacs had a problem with th...

Security Hole of MRJ 2.2.3 (Mac OS Runtime for Java) - Inconsistent Use of CODEBASE and ARCHIVE Attributes

------------------------------------------------------------------ Security Hole of MRJ 2.2.3 Mac OS Runtime for Java - Inconsistent Use of CODEBASE and ARCHIVE Attributes - http://java-house.etl.go.jp/ml/archive/j-h-b/039457.html ------------------------------------------------------------------...