curl: curl doesn't hide credentials in /proc/XXX/cmdline provided via CLI arguments

Summary: cleanarg helper func doesn't work, when credentials are provided without a whitespace to a short options flag, e.g. -uUSER:PASS vs -u USER:PASS or -UUSER:PASS vs -U UUSER:PASS Affected version curl -V curl 8.12.1 x8664-pc-linux-musl libcurl/8.12.1 OpenSSL/3.3.3 zlib/1.3.1 brotli/1.1.0...

HackerOne: The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present

The /reports/:id.json endpoint disclosed potentially sensitive user attributes, including the reporter's email, OTP backup codes, phone number, graphqlsecrettoken, and t-shirt size when a reporter summary was present...

WordPress: Pivilege escalation of any new user to Keymaster caused by CSRF

A vulnerability in the bbPress plugin allowed an attacker to escalate a newly registered user's forum role to bbpkeymaster without proper authentication. This occurred because bbPress failed to implement adequate CSRF protections when assigning forum roles, allowing an attacker to craft a malicio...

AWS VDP: Non-Production API Endpoints for the Device Farm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The Device Farm service was found to have two non-production API endpoints that could be accessed using standard IAM credentials without generating CloudTrail logs. This allowed silent permission enumeration, where an adversary could test the permissions of compromised credentials without...

Hemi VDP: VSCode launch.json file exposed on hemi.xyz

A .vscode/launch.json file was published publicly on https://hemi.xyz/...

Autodesk: CVE-2023-5561 on Payapps.com

A vulnerability was identified at the WordPress site on payapps.com. This vulnerability allowed unauthenticated attackers to discern the email addresses of users who have published public posts. The vulnerability has been fixed...

Mozilla: Mozilla VPN Clients: RCE via file write and path traversal

The report describes a path traversal vulnerability in the Mozilla VPN client software that allowed for remote code execution. The vulnerability was found in the "livereload" command of the client's inspector feature, which could be accessed when the client was in developer mode with "Use Staging...

A malicious manifests can lead to DoS due to unchecked array bound access via network in ollama/ollama

This report is not public...

Hemi VDP: Broken X (Twitter) link on hemi.xyz/about

Vulnerability description not provided...

control-messe.de Cross Site Scripting vulnerability OBB-4024543

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

shop.stephenvilleofficepro.com Cross Site Scripting vulnerability OBB-4024515

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

shop.temiskamingofficepro.ca Cross Site Scripting vulnerability OBB-4024516

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

shop.myavr.com Cross Site Scripting vulnerability OBB-4024506

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

mesfm.umc.com Cross Site Scripting vulnerability OBB-4024480

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

courtsmammouth.mu Improper Access Control vulnerability OBB-4024457

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Hemi VDP: Cloudflare WAF Bypass - Origin IP Exposure

The Cloudflare WAF was bypassed, exposing an IP address belonging to a server operated by Hemi...

Hemi VDP: Linkedin Broken Link Hijacking on https://hemi.xyz/about

The LinkedIn account link for a team member on the https://hemi.xyz/about page pointed to a non-existent LinkedIn account...

curl: Format string vulnerability, curl_msnprintf() function

Summary: A vulnerability has been identified in the curl library’s formatted output functions specifically in curlmsnprintf and its related functions. When a malicious attacker-controlled format string containing the %hn conversion specifier is passed, the function incorrectly attempts to write t...

Regular expression Denial of Service - ReDoS

Description The preprocessstring function in the transformers.testingutils module uses a regular expression to process code blocks in docstrings. This regular expression has the following structure: codeblockpattern = r"?:python|py\s\n\s ?:.?\n?.?" The segment ?:.?\n?.? contains nested quantifier...

Internet Bug Bounty: Possible DoS by memory exhaustion in net/imap

The net-imap gem implemented an IMAP client in Ruby. Versions prior to 0.3.8, 0.4.19, and 0.5.6 contained a vulnerability that could lead to denial of service by memory exhaustion. The vulnerability was caused by the response parser using Rangetoa to convert uid-set data without limiting the...