20626 matches found
GitHub Security Lab: Java: QL Query Detector for JHipster Generated CVE-2019-16303
This bug was reported directly to GitHub Security Lab...
U.S. Dept Of Defense: Reflected XSS on https://█████████/
Vulnerable Website URL or Application: javascript https://███████/███████=%22%3E%3Csvg/onload=alert%22nagli%22%3E Description of Security Issue: please limit to one site/app per submission Reflected XSS due to no input validation ██████████ Steps needed to reproduce bug: Navigate to javascript...
Shopify: Informations disclosure - Access to some checkout informations
It came to my attention that using the CheckoutStatus query on https://arrive-server.shopifycloud.com/graphql it is possible to access some checkout details, specifically the query can be called with an ID value ranging from 1 up to 48908. Unfortunately, as I could not figure out how to create a...
Mail.ru: XSS on ub.icq.net
Not blind SSRF on ub.icq.net via url parameter value makes internal port scanning possible...
Code Injection in svaarala/duktape
Description Arbitrary Code Excecution in svaarala/duktape/tools/genconfig.py. Duktape - embeddable Javascript engine with a focus on portability and compact footprint. Genconfig is a Process Duktape option metadata and produce various useful outputs. Technical Description This package was...
Code Injection in apolloauto/apollo
Description Arbitrary Code Excecution in genprotofile.py in ApolloAuto/Apollo. An open autonomous driving platform. Technical Description This package was vulnerable to Arbitrary code execution due to a use of a known vulnerable function load in yaml. fix is to be done genprotofile.py Exploit cod...
Code Injection in ultralytics/yolov3
Description Arbitrary Code Excecution in ultralytics/yolov3. Yolov3 is a model from Ultralytics. Ultralytics is a U.S.-based particle physics and AI startup with over 6 years of expertise supporting government, academic and business clients. Ultralytics offer a wide range of vision AI services,...
Prototype Pollution in rodrigocmoreira/sgt-fields
Description sgt-fields is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var sgtFields = require"sgt-fields" var obj = console.log"Before : " + .polluted; sgtFields.setobj,"proto.polluted","Yes! Its Polluted"; console.log"After : " + .polluted; 2...
Code Injection in mozilla/deepspeech
Description Arbitrary Code Excecution in mozilla/DeepSpeech.DeepSpeech is an open source embedded offline, on-device speech-to-text engine which can run in real time on devices ranging from a Raspberry Pi 4 to high power GPU servers. Technical Description This package was vulnerable to Arbitrary...
Uber: Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees
A Business employee with the user role was able to escalate their privilege to admin using a crafted request to the https://business.uber.com/rpc?rpc=updateEmployees endpoint, as long as the employeeUuid is known...
Mail.ru: Partner's manager can aсccess statistics of all drivers [city-mobil.ru/taxiserv]
User with partner's manager role was able to obtain statistics for drivers of different partner company...
Mail.ru: XSS при Изменения машины на странице "Контроль" [city-mobil.ru/taxiserv]
Stored XSS on city-mobil.ru/taxiserv car page via firstname and lastname of driver...
U.S. Dept Of Defense: CVE 2020 14179 on jira instance
Summary: An remote attacker can view the custom sla fields used in the jira instance and also can use the sla fields to make a jql query. Impact Information disclosure of the custom sla fields, senstive information leakage throught he jql query parameter Read more about the impact here:...
GitHub Security Lab: Java: Add SSRF query for Java
This bug was reported directly to GitHub Security Lab...
Cross-site Scripting (XSS) - Generic in igniterealtime/openfire-bookmarks-plugin
Description openfire-bookmarks-plugin is vulnerable to Cross-Site Scripting XSS. Steps To Reproduce 1. Download openfire and install https://www.igniterealtime.org/downloads/ 2. Run the server http://localhost:9090/index.jsp 3. Click on "Plugins" http://localhost:9090/plugin-admin.jsp and install...
U.S. Dept Of Defense: Reflected XSS on █████████
Summary Reflected XSS on █████. Description The page █████ has a reflected parameter ██████████. The parameter is used in a javascript function. For example for requesting http://█████████/?█████████=chron0x the javascript is as follows: javascript ... //alert'boo'; function clickit var █████████...
Prototype Pollution in steveukx/properties
Description properties-reader is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC and INI files: // poc.js var propertiesReader = require'properties-reader'; console.log"Before : " + .polluted console.log"Before : " + .polluted1 var properties =...
VK.com: XSS в названии звонка
XSS в сниппете звонка. Уязвимость позволяла выполнить скрипт на стороне пользователя, позвонив ему...