Open-Xchange: IDOR - setAttribute action of user object in API

Note. I selected sandbox.open-xchange.com as the asset in Hackerone but this was tested on a local installation . Hello, There appears to be a possible IDOR vulnerability in the following API endpoint for setting custom attributes:...

PT-2017-14035 · E Sic · E-Sic

Name of the Vulnerable Software and Affected Versions: E-Sic version 1.0 Description: An authentication bypass issue exists due to the acceptance of '=' or ' values for the username and password variables in the "/index" also known as "login" API endpoint. Recommendations: For E-Sic version 1.0, ...

Authorization

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...

RubyGems: Request Hijacking Vulnerability in RubyGems 2.6.13 and earlier

We received this report via security@ from [email protected], I'm filing here for tracking and visibility purposes... "I was looking at commit 8d91516fb7037ecfb27622f605dc40245e0f8d32, which was the fix for the DNS hijacking issue CVE-2017-0902. The function still handles the DNS response in ...

opendata.gov.je XSS vulnerability

Vulnerable URL: https://opendata.gov.je/api/1/util/snippet/apiinfo.html?resourceid=a15ed8ba-93a8-4596-b6bb-945717c257bbrooturl=javascript:alert/OPENBUGBOUNTY/// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 13.12.2017 Vulnerability type:| XSS Vulnerability status:|...

CVE-2017-11629

dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...

WakaTime: Email Spoofing Via /api/v1/users/reset_password

Thanks @leet-boy! Thanks @alanhamlett and all the team of @WakaTime for fixing this and handling the report quickly and fairly!...

CVE-2017-7283

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php...

ok.ru: Blind SQL Injection

@linkks reported a blind sql injection: POST /api/updateShareCount HTTP/1.1 Host: insideok.ru Cache-Control: no-cache Accept: application/json, text/javascript, /; q=0.01 Origin: http://insideok.ru Referer: http://insideok.ru/lica User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64; rv:50.0...

Cross-site scripting vulnerability in KingCMS 'conn.php' page

KingCMS is a content management system based on WEB technology. A cross-site scripting vulnerability exists in KingCMS. The /api/conn.php page fails to properly filter user input, allowing an attacker to exploit the vulnerability to build a malicious web page and trick users into parsing it to...

Slack: Rate-limit bypass

Hello Slack, This vulnerability is about a 2FA Bypass, On Slack Web Application there is rate limit implemented. After performing 4-6 failed 2FA Attempt, Rate limit logic will ge Triaged and ask user to wait for next attemptpreventing automated 2FA Attempts I tested the same using iOS AppiOS 9.3....

api.anqu.com XSS vulnerability

Vulnerable URL: http://api.anqu.com/search/index/?keyword=%22%3E%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unkno...

Imgur: Local file read in image editor

Filepaths were able to traverse up outside of their intended directory when using the /edit/process API endpoint. Insufficient imageid filtration in image editor allowed an attacker to read arbitrary files. An attacker could read files by setting file path in imageid GET param in /edit/process AP...

United Airlines Slow to Patch Mobile App Vulnerability

A vulnerability reported to United Airlines that could have been exploited to manipulate flight reservations and customer data sat unpatched for almost six months before it was fixed 10 days ago. Researcher Randy Westergren found and reported an issue in United’s mobile app in May, shortly after...

rubygems: DNS hijacking vulnerability in api_endpoint()

A flaw was found in a way rubygems verified the API endpoint hostname retrieved through a DNS SRV record. A man-in-the-middle attacker could use this flaw to force a client to download content from an untrusted domain...

CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." A flaw was found in a...

CVE-2014-9355

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint...

CVE-2014-9355

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint...

Cross site request forgery (csrf)

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint...

CVE-2014-9355

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint...