FormAssembly: scripts loader DOS vulnerability

1 vulnerability description WordPress allows users to load multiple JS files and CSS files through load-scripts.php files at once. For example, https://wpwebsite.com/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-ui-core,editor&ver=4.9.1, file load-scripts.php will load jquery-ui-core and editor...

MariaDB: scripts loader (denial of service) vulnerability

1 vulnerability description WordPress allows users to load multiple JS files and CSS files through load-scripts.php files at once. For example, https://wpwebsite.com/wp-admin/load-scripts.php?c=1&load=jquery-ui-core,editor&ver=4.9.1, file load-scripts.php will load jquery-ui-core and editor files...

Mail.ru: XSS via Cookie in Mail.ru

Unfiltered cookie content was used in DOM manipulation, leading to XSS possibility...

vpn.maartenschool.nl Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-956407 Security Researcher Spam404 Helped patch 16365 vulnerabilities Received 9 Coordinated Disclosure badges Received 69 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting vpn.maartenschool.nl websi...

curl: Incorrect IPv6 literal parsing leads to validated connection to unexpected https server.

Summary: The IPv6 ip address can be specified with square brackets like fe80::3. There can also be a zone id specified like fe80::3%15. A URL can specify its hostname with IPv6 literal, It seems that the parsing in curl library is not complete. For instance, it is possible for particular IPv6...

curl: Double-free of `trailers_buf' on `Curl_http_compile_trailers()` failure

Summary: When Curlhttpcompiletrailers fails, trailersbuf is freed twice, because we don't pass to this function the pointer value by reference. Steps To Reproduce: Did not actually reproduce, please double check patch attached and analysis. Impact Some memory corruption due to the double-free...

curl: krb5: double-free in read_data() after realloc() fail

Summary: In 'lib/security.c', there is a double-free of the reference 'buf-data' on the teardown path if 'Curlsaferealloc' fails. Also, since we read 'len' from the 'fd', the sender might be able to remotely trigger a realloc failure, and then the double-free, by sending the value 0x7fffffff...

Mail.ru: Blind SSRF on sentry.dev-my.com due to Sentry misconfiguration

Insufficient isolation of Sentry installation could potentially lead to blind SSRF...

Nextcloud: Clear text storage of proxy parameters and passwords

Proxy settings of the Nextcloud desktop client were not stored in a save way, instead they where just base64 encoded stored in the nextcloud.cfg file...

Mail.ru: Race condition при покупке подарков на games.mail.ru

TOCTOU conditions in games.mail.ru gift purchase functionality allowed to spend bonus points above balance...

Mail.ru: Account takeover via CORS misconfigutation on https://beta.delivery-club.ru

Insufficient check for request origin allowed crossite access to beta.delivery-club.ru...

Imgur: Password Reset Link not expiring after changing the email Leads To Account Takeover

Vulnerability: Password Reset Link not expiring after changing the email Proof Of Concept: 1.Send the password reset link to your email. 2.Dont open the password link just copy it and paste into any editor. 3.Open your account. 4.Go to your account settings. 5.Under account, you will see Account...

Mail.ru: [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious File

Combination of improper access control and unrestricted files upload in non-production service led to RCE possibility...

New Relic: Stored XSS at Synthetics private locations (planted through location label or description)

Hey team, I've discovered stored XSS at Synthetics private locations list. The Private locations page contains a script with private locations metadata inside and the user-input of location label and description aren't properly escaped as you can see below: html window.nr =...

Nextcloud: potential RCE and XSS via file upload requiring user account and default settings

potential RCE and XSS via file upload requiring user account and default settings Requirements 1. User account that can upload files NO admin 2. User account name on creation usually the same as on creation/displayed name 3. data directory inside of nextcloud server folder suggested by...

Mail.ru: Delete images of users with clickjacking in https://pw.mail.ru

Researcher found site-wide Clickjacking on https://pw.mail.ru which potentially could be used to trick user to delete avatar or change his/her profile data...

HackerOne: Total Paid Bounty Paid can be disclose

Summary: Hello HackerOne Bug Bounty Team, I noticed that HackerOne recently updated their interface. Indeed, when a hacker hover his mouse over a program, it now disclose some new information : F556858 The one that interested us is "Bounties sent in the last 90 days" value Description: This new...

U.S. Dept Of Defense: Examples directory is PUBLIC on https://████████mil, leading to multiple vulns

Description: Hello, In an effort to consolidate reporting. I have located 4 issues with having the Examples Directory openmy require just 1 solution to mitigate The following URLs that show concern are the following: 1. https://█████mil/examples/servlets/servlet/SessionExample --Will lead to...

GSA Bounty: xmlrpc.php file enabled - data.gov

Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DDOS. this website www.data.gov has the xmlrpc.php file enabled. Impact This can be automated from multiple hosts and be used to cause a mass DDOS attack on the victim...

U.S. Dept Of Defense: Online training material disclosing username and password

Summary: A training document is revealing username and password details for what appears to be a DoD training system Description: Using the google dork site:.mil ext:ppt intext:password, I was able to find a number of powerpoint documents on .mil websites that include username and passwords. This...