curl: libcurl: Host-Only Cookies Leak to Alternate IPv4 Forms

libcurl canonicalizes numeric IPv4 hostnames during URL parsing and redirect handling example: 127.000.000.001 to 127.0.0.1. When a host-only cookie no Domain= attribute is set, it is stored in the cookie jar with the host string 127.0.0.1. On redirect, even if the Location: contains an alias hos...

U.S. Dept Of Defense: Account Takeover via Unverified Email Change and Improper Session Handling

A vulnerability was discovered in the email change functionality of the system. When the email was changed to an unregistered email address, the system accepted the change without proper verification. If the victim later registered using the same email, the attacker's existing session was not...

curl: Heap-buffer-overflow (Out-of-Bounds Read) in DoH hostname encoding

Summary: I found a heap-buffer-overflow in the dohreqencode function in lib/doh.c. The bug happens when curl processes a DNS-over-HTTPS request for a hostname that is an empty string. The code gets the string length as 0, then tries to access hostlen - 1, which becomes host-1. This is an...

Cloudflare Public Bug Bounty: [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth

A vulnerability was discovered in Cloudflare Access that could allow for unauthorized approvals within the Temporary Auth workflow. The issue was resolved after the researcher reported it to Cloudflare...

Path Traversal vulnerability in keras using tar extract

Technical Details of the Vulnerability Summary Keras's keras.utils.getfile function is vulnerable to directory traversal attacks despite implementing filtersafepaths. The vulnerability exists because extractarchive uses Python's tarfile.extractall method without the security-critical filter="data...

PlayStation: Double fdrop on a socket through sys_netcontrol

The netcontrol syscall in the kernel had a vulnerability where the socket file descriptor was not properly validated when removing a socket from a netevent structure. This allowed an attacker to cause a double fdrop on a socket, potentially leading to a use-after-free condition...

curl: Incorrect Parsing of IPv6 Zone ID in curl

I'm Zehui Miao from NISL@THU. During recent research, our team identified a parsing inconsistency in the curl. 0x01 Affected components 1.1 Affected components • C Curl • Versions: tested in 8.4.0 • CLAIMS TO FOLLOW: RFC-3986 1.2 Attack scenario The threat model illustrated in Figure 1 explains t...

U.S. Dept Of Defense: Information Disclosure via Publicly Accessible Debug Log

A publicly accessible WordPress debug log file was discovered on the target system. The log file contained PHP warnings and deprecated notices that disclosed sensitive server paths and plugin details. This exposure may have assisted an attacker in fingerprinting the environment or exploiting know...

Cloudflare Public Bug Bounty: Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATO

The vulnerability in the MCP Server Portal Apps was caused by missing sanitization of the redirecturi parameter, leading to a second-order XSS vulnerability. An attacker could craft a malicious redirecturi containing JavaScript code, obtain a clientid for this URI, and reuse it when a victim had ...

Account takeover due to missing oauth audience verification in google sign in

Description The web application integrates Google OAuth for user authentication. Upon successful Google sign-in and user consent, the application receives a token from Google. This token is used by the web application to fetch user profile information such as email and name and complete the login...

Dynatrace: OneAgent Unprivileged NTLM User Coercion

Vulnerability description not provided...

curl: Missing Security Headers

Missing Security Headers Low Target: https://curl.se/ OWASP Mapping: A05 Misconfiguration / A02 Crypto Vulnerability ID: sec-headers-0f70ef5bcb Description A Missing Security Headers issue was discovered. This may allow an attacker to exploit the application. Proof of Concept Using cURL bash curl...

Authorization Bypass in MLflow Basic Auth (unprotected Flask/GraphQL routes)

This report is not public...

Monero: Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node Paralysis

A deadlock vulnerability was discovered in the Monero JSON-RPC interface that allowed a remote, unauthenticated attacker to completely paralyze any Monero node with a single HTTP request containing specific batch methods, leading to permanent denial of service. The vulnerability affected all...

curl: curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/Tor

Summary: When using curl with a SOCKS5 proxy e.g. Tor on 127.0.0.1:9050, glibc getaddrinfo performs direct UDP connect probes to the target’s IP:443. These syscalls bypass the proxy and expose the user’s route to the destination, breaking anonymity expectations. The IPs I got in my case:...

curl: Curl parse_connect_to_string Heap-Overread Leading to Denial of Service via CURLOPT_CONNECT_TO

Summary: A heap-buffer-overread occurs in Curl's parseconnecttostring function when using the CURLOPTCONNECTTO option with crafted input. This can lead to a segmentation fault and crash of the application, resulting in a denial-of-service. The issue is triggered by malformed host strings containi...

Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner

Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner...

WakaTime: Invalid

Summary: While testing the OAuth implementation on your platform, I discovered a critical vulnerability that allows a malicious attacker to take over any victim’s account and maintain persistent access even if the victim later verifies their email or changes their password. This issue arises...

curl: WebSocket Fragmentation DoS on Curl Client

Summary A malicious WebSocket server can send a fragmented message FIN=0 followed by a flood of continuation frames, causing the client curl to continuously allocate memory while waiting for message completion. This can result in high memory usage and potential crash OOM, representing a...

Omise: Pending invites remain valid even after the inviter is removed.

The pending invites created by a removed admin remained valid, and members already added by the removed admin remained in the team with admin privileges, even after the inviter was removed...