curl: GnuTLS CURLINFO_TLS_SESSION / CURLINFO_TLS_SSL_PTR type confusion

Summary: curleasygetinfo for CURLINFOTLSSESSION and CURLINFOTLSSSLPTR incorrectly return CURLSSLBACKENDOPENSSL in struct curltlssessioninfo backend field for GnuTLS. struct curltlssessioninfo curlsslbackend backend; void internals; ; The bug is at...

User Enumeration via "Account not found" Message

This report is not public...

U.S. Dept Of Defense: Unauthenticated Users Can Access Other Users’ Bug Report Attachments via Broken Access Control

A vulnerability was discovered where unauthenticated users could access other users' bug report attachments due to a lack of proper access control. The /BugReport/Admin/Attachment/id endpoint exposed attachments linked to private bug reports, and the numeric ID in the URL could be manipulated to...

curl: curl ASSERTs when accessing an LDAP URL

Summary: curl can crash when accessing an LDAP URL. curl ldap://localhost:1388 curl: result.c:930: tryread1msg: Assertion !BERBVISEMPTY &resoid ' failed. Aborted core dumped No AI was used in the production of this report. This was enabled by oss-fuzz, but initiated by me adding LDAP support to...

U.S. Dept Of Defense: SQL Injection - JSON 'name' parameter

A SQL injection vulnerability was discovered in the 'name' parameter of the website. The vulnerability allowed manipulation of SQL queries executed by the backend database. The original request containing the vulnerable parameter was provided...

XPath Injection in search_item_ctrl_f Function - Hugging Face Smolagents v1.20.0

The searchitemctrlf function in the Hugging Face Smolagents library is vulnerable to XPath injection. The function simply concatenates user input into an XPath query without sanitizing or escaping the input. Vulnerable Code Location: File: src/smolagents-1.20.0/smolagents/visionwebbrowser.py...

Tucows (VDP): Vulnerability: XML-RPC Interface Enabled and Accessible

Summary The website ███ has the XMLRPC interface enabled which exposes several methods including pingbackping and systemmulticall These methods can be abused by attackers to perform high volume denial of service DDoS attacks and brute force amplification attacks which can severely impact the...

Node.js: Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 Fix

Summary: I found that Windows device names CON, PRN, AUX, etc. can still be used for path traversal attacks when working with UNC network paths, even after the CVE-2025-27210 patch. So basically, the fix only covered regular paths but missed the UNC path scenario when using path.join Description:...

Tucows (VDP): Business Logic Error – Bypass of OTP Verification During Signup on hover.com

The Business Logic Error – Bypass of OTP Verification During Signup on hover.com was a vulnerability that allowed an attacker to register an account on www.hover.com using any email address without passing the required OTP verification. The vulnerability was caused by the ability to omit the code...

World-Writable NLTK Cache Directory Enables Local Users to Tamper with or Delete NLP Data

Description The llamaindex library sets the NLTK data directory to a subdirectory of the codebase by default e.g., static/nltkcache inside the package directory. In multi-user environments or shared hosting, this directory is world-writable or accessible by multiple users. As a result, any user c...

Brave Software: SameSite restrictions are lifted, and SameSite:Strict cookie are being sent.

A vulnerability was discovered where SameSite=Strict cookies were being sent during cross-site navigations, even though they should have been restricted under the SameSite policy. This was caused by the absence of the Sec-Fetch-Site: cross-site header, which is normally used to prevent such...

U.S. Dept Of Defense: Exposed wp-config.php file

A copy of the WordPress configuration file wp-config.php was found at an endpoint. The file contained sensitive information, such as MySQL and AWS credentials, and various keys...

Khan Academy: 337k users and 1 employee leaked credentials

The Khan Academy website experienced a data breach, resulting in the leakage of 337.7k user accounts and one employee account. The leaked credentials, including email addresses and passwords, were discovered on a website called "leakradar.io"...

curl: Disk Space Exhaustion leading to a Denial of Service (DoS)

Description The tooldebugcb function can write large amounts of debug data to a log file if the --trace or --trace-ascii options are used with a large volume of data. If an attacker can cause cURL to download or upload a very large amount of data e.g., via a very large HTTP response or an unlimit...

8x8: █.8x8.vc/index.js: Exposed Google Maps API Key Allowing Potential Abuse of Paid Services

The Google Maps API key was inadvertently exposed in client-side code, allowing potential unauthorized access to some Google Maps services. The issue was promptly addressed by implementing appropriate API key restrictions where feasible...

curl: Uncontrolled File Write/Arbitrary File Creation

Description The dumpeasysrc function in the provided code snippet allows an attacker to specify an arbitrary file path for outputting the generated libcurl source code via the global-libcurl variable. If the global-libcurl value is not properly sanitized or restricted, a malicious user could...

curl: HTTP Request Smuggling Vulnerability Analysis - cURL Security Report

HTTP Request Smuggling Vulnerability Report - cURL Summary: cURL does not explicitly reject HTTP requests that contain both Transfer-Encoding and Content-Length headers, which can lead to HTTP request smuggling vulnerabilities CWE-444 when the request passes through intermediary systems proxies,...

ExpressionEngine: SQL injection in structure plugin

An SQL injection flaw was discovered in ExpressionEngine's Structure plugin. User input from the channelids parameter was passed directly into SQL queries without proper sanitization. The vulnerability required admin panel access...

Nextcloud: Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet Library

A path traversal vulnerability was discovered in Nextcloud Tables. This vulnerability allowed the exfiltration of any files supported by the PhpSpreadsheet library...

Bykea: MongoDB Query Logs & Schema Leak via Unauthenticated Endpoint

MongoDB Query Logs & Schema Leak via Unauthenticated Endpoint An unauthenticated health check endpoint was discovered that exposed basic system and infrastructure details...