973095 matches found
CVE-2024-2748
A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execute unauthorized actions on behalf of an unsuspecting user. A mitigating factor is that user interaction is required. This vulnerability affected GitHub Enterprise Server 3.12.0 a...
CVE-2025-13744
CVE-2025-13744 affects GitHub Enterprise Server. The issue is an Improper Neutralization of Input During Web Page Generation in the Filter (search) component, allowing attacker-controlled HTML to be rendered across GitHub and potentially exfiltrate sensitive information. An attacker must have per...
payload-labkit
payload-labkit Salam, praktisi keamanan! Berikut tiga daftar...
Nextcloud: SVG filter primitives bypass remote image blocking, enabling email tracking without consent.
A vulnerability was discovered in the HTML sanitizer of the Roundcube webmail application. The sanitizer did not properly handle the SVG filter primitive, allowing external resources to be loaded even when the "Block remote images" setting was enabled. This vulnerability could be used to track...
Exposure of Storage Secret in Pyroscope
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...
Bug-Bounty-and-Learning-Space
Bug Bounty & Learning Space A markdown backup of my personal...
Nextcloud: Valid share tokens allow to access tempory upload files of share owner
A vulnerability was discovered that allowed access to temporary upload files of a share owner using valid share tokens...
Command Injection through bash -c
This report is not public...
Content-Type Spoofing in LollMS Image Upload
Executive Summary A security vulnerability has been identified in LollMS that allows authenticated users to bypass file type validation by spoofing the Content-Type header. The /api/upload/chatimage endpoint only validates the HTTP header, not the actual file content, allowing malicious files to ...
curl: CVE-2025-15224: libssh key passphrase bypass without agent set
A vulnerability was discovered in the libcurl libssh backend where the CURLOPTSSHAUTHTYPES option did not properly implement the CURLSSHAUTHAGENT flag. As a result, if the CURLSSHAUTHPUBLICKEY option was set, the implementation would act as if CURLSSHAUTHAGENT was always defined, allowing...
Job API exposed without authorization
This report is not public...
Tracing + Assessments Access
This report is not public...
XSSREFLECTOR
XSS Reflector XSS Reflector adalah tools otomatis untuk...
Revive Adserver: Reflected XSS in afr.php
Vulnerability description not provided...
curl: testing hackerone functions
hi team i am testing hackerone functions i need some help of you this is my test account can you blacklist me from your program not ban just blacklist Impact thanks...
IBM: Remote Code Execution identified on IBM endpoint.
A remote code execution vulnerability was identified on an IBM endpoint. The issue was reported to IBM, analyzed, and remediated...
PT-2025-51038
Name of the Vulnerable Software and Affected Versions Apple products affected versions not specified Description A permissions issue was identified and addressed through the implementation of additional restrictions. Recommendations At the moment, there is no information about a newer version tha...
Arbitrary file write via tar traversal
Summary A crafted tar.gz passed to MLflow pyfunc extraction is unpacked with tarfile.extractall without path validation. Archive entries containing .. or absolute paths can escape the destination directory and write arbitrary files on the host. This is reachable when users supply prebuiltenvuri o...
Stripo Inc: [Critical] Unauthorized Cross-Tenant Data Access in Stripo AI Hub Campaign via Deleted Project.
An unauthorized cross-tenant data access vulnerability was discovered in the Stripo AI Hub Campaign. The vulnerability allowed access to data from a deleted project. The issue was resolved...