Mozilla: Information disclosure on password cancel endpoint

The password reset cancellation process disclosed the user's IP address in the email sent to the user upon cancellation. This information disclosure vulnerability was exploited to obtain the IP address of a user by tricking them into submitting the password reset cancellation request...

U.S. Dept Of Defense: CSRF to XSS

The vulnerability allowed an attacker to combine Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF attacks. The XSS vulnerability allowed the injection of malicious scripts that could be executed in the victim's browser, potentially stealing sensitive data like cookies or session token...

Mozilla: User API Key leakage in Github commit leads to unauthorized access to sql.telemetry.mozilla.org

A Mozilla employee's API token for https://sql.telemetry.mozilla.org was leaked in one of the Github repos. The token provided access to the service dashboard which contained confidential data. The API token was rotated and removed from the service...

PortSwigger Web Security: cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-party

The windmail.exe application in the CGI scripts wordlist had a vulnerability that allowed an attacker to read arbitrary files on the server and send the contents to a third-party email address...

MacTaggart Scott: Overwrite any file of the web server

The web server was vulnerable to file overwrite due to a vulnerable module used to generate files. An attacker could have overwritten any file on the web server, including critical system files, by sending a specially crafted request...

AWS VDP: External service interaction (HTTP)

The External Service Interaction vulnerability was discovered in a URL. The vulnerability allowed an attacker to induce the application to interact with arbitrary external services such as DNS and HTTP. This vulnerability was outside the scope of the program, as the related infrastructure had bee...

Internet Bug Bounty: `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods

The Rust Security Response WG disclosed a vulnerability in the std::process::Command module on Windows, where it incorrectly escaped arguments when invoking batch files. This allowed for bypassing the fix by including trailing whitespace or periods in the batch file name, which are ignored and...

Nextcloud: Open redirect when logging in with user_oidc

An open redirect vulnerability was discovered in Nextcloud's useroidc app. This vulnerability allowed an attacker to redirect users to a malicious website during the login process...

HackerOne: Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation

Vulnerability description not provided...

nullsec VDP: Test by HDR

Test by HDR...

mycompany VDP: This test report has been disclosed by 20_root.

This test report has been disclosed by 20root. ████...

Insightly: Email verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"

The vulnerability allowed bypassing email verification when creating a new Insightly account. The vulnerability existed in the "EmailAddress" parameter of the member creation endpoint. By modifying the parameter, an attacker could create a new account using any email address, including those of...

U.S. Dept Of Defense: CSRF leads to Account takeover

The target website was found vulnerable to CSRF, allowing an attacker to perform actions on the user's behalf without their knowledge or consent. The vulnerable endpoint was identified at https://██████/account/profile/edit, where the user's profile information could be modified. A POC was...

Mozilla: Bypass Email verification for monitoring at `monitor.mozilla.org`

The email verification at monitor.mozilla.org was bypassed by leveraging a leaked verification token from the /api/v1/user/breaches endpoint. The verification token was then used to bypass the email verification process and gain access to monitor the email without the owner's permission...

HackerOne: Takeover of hackerone.engineering via Medium

The report describes a broken link hijacking vulnerability on the hackerone.engineering domain, which belonged to HackerOne. The domain was found to be pointing to a non-existent page on Medium, allowing the reporter to create a page with the same URL and take over the domain...

Mozilla: [ addons-preview-cdn.mozilla.net ] A subdomain takeover is available via unregistered domain in Fastly

The domain addons-preview-cdn.mozilla.net was found to CNAME resolve to addons.allizom.org, which was hosted on Fastly's service. The domain addons-preview-cdn.mozilla.net was not registered within Fastly, resulting in a "Fastly error: unknown domain" message. The vulnerability was demonstrated b...

Internet Bug Bounty: CVE-2024-45498: Apache Airflow Command injection in read_dataset_event_from_classic DAG

CVE-2024-45498 was a command injection vulnerability in the readdataseteventfromclassic DAG in Apache Airflow version 2.10.0. The vulnerability allowed an attacker with user privileges to inject OS commands into the s3://output/1.txt dataset, which were then executed when the DAG was triggered...

Nextcloud: Share information of Tables app is not limited to affected users

The vulnerability in the Tables app in Nextcloud allowed the sharing of information with users not affected by the vulnerability...

Kubernetes: Injection in path parameter of Ingress-nginx

A vulnerability was discovered in the Ingress-nginx controller where an attacker could inject arbitrary content into the path parameter of an Ingress. This allowed the attacker to upload a malicious nginx configuration file to the ingress controller's file system and then include that file in a...

U.S. Dept Of Defense: CSRF leads to Account takeover

The CSRF vulnerability was found on the endpoint https://██████████/account/profile/edit, which allowed an attacker to modify the victim's account information, including their username, password, and email address, resulting in account takeover...