263 matches found
Information disclosure
V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page information without entering a verification code...
Clario: Account Takeover because of the mis-configuration on the Password Reset Page
Summary https://api.account.opendoor.ltd has no rate-limit on the password reset's verification page. By this, I can take over any account. All I need to know is victim's email address. Step to reproduce 1. There is an endpoint - POST /v1/verification-code/forgot-password which will take POST dat...
Mail.ru: Account Takeover at worki.ru
One time code reuse between registration and authentication in combination with insufficient bruterofce protection allowed account access via verification code bruteforce for worki.ru. Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...
pixiv: Reset any password
Summary: When I try to reset the password, the verification code of the mailbox is 6 digits, and there is no limit on the number of submissions, so I can reset the password of any user. Steps To Reproduce: 1.input the email reset password url. F595146 click the "submit" button F595147 input the...
CVE-2019-8909
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...
Code injection
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...
CVE-2019-8909: Uncontrolled Resource Consumption
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...
CVE-2018-7961: Exposure of Sensitive Information to an Unauthorized Actor
There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Website or malicious App and register. Due to incorrect processing of the smart SMS verification code, successful exploitation can cause sensitive information leak...
Security Advisory - Smart SMS Verification Code Vulnerability in Some Huawei Smart Phones
There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Website or malicious App and register. Due to incorrect processing of the smart SMS verification code, successful exploitation can cause sensitive information leak...
Design/Logic Flaw
Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log...
CVE-2018-18825
Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log...
CVE-2018-18825
Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log...
CVE-2018-18825
Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log...
CVE-2018-18825: Improper Neutralization of Input During Web Page Generation
Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log...
Chongqing to the home network technology limited company to the home to buy treasure APP there is information leakage vulnerability
The home has been purchased treasure to provide second-hand housing, new housing, rental housing, stores, information query, transaction brokerage and other services. CAPTCHA information leakage: This vulnerability is mainly in the registration and password retrieval, the server will return the...
Hunan Jiancheng Information Technology Co., Ltd. Jiancheng.com APP has information leakage vulnerability
The Building Program App is a construction and engineering app. There is an information leakage vulnerability in the Construction Engineering APP of Hunan Construction Engineering Information Technology Co. An attacker can register any account, reset any password and perform unauthorized operatio...
Beijing Huijinxing Real Estate Brokerage Co., Ltd. magic sale APP has SMS bombing vulnerability
MagicSale is a new home distribution platform for institutional cooperation, helping brokers of cooperating institutions to effectively develop "inventory customers" in their hands, corresponding their needs to the new home market, and securely realizing the income of institutions and brokers. Th...
Anhui Yuanlu Information Technology Co., Ltd. deer Zhiyou APP there is information leakage vulnerability
Fawn Smart Tour is a smartphone tour guide software that provides hand-drawn maps of attractions, automatic positioning in scenic spots, and accompanied by vivid voice explanations, just like a tour guide on the go. CAPTCHA Design Vulnerability: This vulnerability mainly occurs when logging in,...
Beijing Beifang Founder Electronics Company Limited Economic Reference News APP has information leakage vulnerability
Economic Reference News App is a news and information application. An information leakage vulnerability exists in the Economic Reference News APP of Beijing Beifang Founder Electronics Co. An attacker can register any account, reset any password and perform unauthorized operations by capturing th...
Is two-factor authentication (2FA) as secure as it seems?
Two-factor authentication 2FA was invented to add an extra layer of security to the—now considered old-fashioned and insecure—simple login procedure of entering a username and password. One of the most well-known examples of 2FA is when you try to log into a familiar website from a different...