1272 matches found
Denial of service due to unlimited number of parts
Impact The multipart body parser accepts an unlimited number of file parts. The multipart body parser accepts an unlimited number of field parts. The multipart body parser accepts an unlimited number of empty parts as field parts. Patches This is fixed in v7.4.1 for Fastify v4.x and v6.0.1 for...
HackerOne: HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension
An HTML injection vulnerability was discovered on HackerOne.com through the H1 Triage Wizard Chrome Extension. An attacker could inject malicious code into the triage questionnaire modal, potentially leading to the compromise of confidential information or impacting its integrity...
SSRF via filter bypass due to lax checking on IPs
None...
Missing rate limiting on password reset functionality allows sending lots of emails
None...
IDOR Vulnerability in Nextcloud Mail
None...
HackerOne: Attachment in published HackerOne report exposure private program
Vulnerability description not provided...
HackerOne: [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick
A Local File Inclusion vulnerability was discovered in an outdated version of ImageMagick used for image resizing on a website. An attacker could exploit this vulnerability by uploading a malicious PNG image, which would include the local file as content of the resized image in a hexadecimal...
U.S. Department of State: IDOR in TalentMAP API can be abused to enumerate personal information of all the users
An IDOR vulnerability was discovered in the Talentmap API that allowed guest users to enumerate personal information of all users. The vulnerability was due to the lack of access control mechanisms in the API endpoint. A malicious actor could exploit this vulnerability to fetch information of all...
FreeBSD : security/tor -- SOCKS4(a) inversion bug (847f16e5-9406-11ed-a925-3065ec8fd3ec)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 847f16e5-9406-11ed-a925-3065ec8fd3ec advisory. - The Tor Project reports: TROVE-2022-002: The SafeSocks option for SOCKS4a is inverted leading to SOCK...
Open redirect on government website sends users to adult content
Fake websites and open redirects have conspired to make things awkward for a UKGOV website. The site in question, riverconditionsdotenvironment-agencydotgovdotuk, was being abused in search engine results to redirect to various sites which arent associated with UKGOV--most of which were adult...
Passcode bypass on Talk Android app
None...
CSRF vulnerability in Nextcloud Desktop Client on Windows when clicking malicious link
None...
HackerOne: HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity
Sensitive report data, including report title, severity, program, and report ID, was leaked due to a mistake by a researcher and HackerOne. The leak occurred when HackerOne disclosed a report but did not redact the video proof of concept, which contained undisclosed reports reported by the...
HackerOne: Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query
The Analytics API query builder was vulnerable to a confusion attack that allowed users to query data from the dimreports table using a WHERE or HAVING clause with a FILTER in the HackerOne Analytics Query Language HAQL. This was possible because the dimreports and dimhackerreports tables both...
Gener8: Twitter Broken Link in https://gener8ads.com (Hackerone Profile)
A broken Twitter link was found on a company's Hackerone profile, which could be claimed by any malicious user. This could lead to the hijacking of the link and the potential deception of new researchers who click on it...
Internet Bug Bounty: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)
I reported at https://hackerone.com/reports/1684163 https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w Certain configurations of rails-html-sanitizer 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to...
GHSA-5X79-W82F-GW8W Inefficient Regular Expression Complexity in rails-html-sanitizer
Summary Certain configurations of rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as High Severity 7.5 CVSS3.1. References - CWE - CWE-1333: Inefficient Regular Expression Complexity 4.9 - https://hackerone.com/reports/1684163 Credit This vulnerability was responsibly...
Mattermost: Uninstalling Mattermost Launcher for Windows (64-bit), then reinstalling keeps you logged in without authentication
The Mattermost Desktop App for Windows 64-bit had a vulnerability where uninstalling and then reinstalling the app would automatically log the user back in without requiring authentication, allowing unauthorized access to the user's account and data. The uninstall process did not remove session...
Brave Software: S3 Bucket Takeover : brave-apt
An unclaimed S3 bucket was found on the domain brave.com, which was being used in the installation of brave-browser in Linux distros. An attacker could have taken over the S3 bucket and used it to spread malware or create a fake login page to spoof users. The vulnerability was reported to the...