1312386 matches found
curl: Git repository found
Summary: Hello team , When i research I found domain vuln to downliad git repository and i will explain that. Steps To Reproduce: 1. Add DotGit extention on your browser 2. Now try to access to that domain https://curl.dev/ 3. You will show that extention is alert and can download that bucket...
Cosmos: Making transfer v2 channel unupgradable through the forwarding
The transfer v2 channel can become unupgradable through the forwarding functionality. The forwarding process can create packet commitments on a legitimate channel, which cannot be deleted due to the lack of acknowledgments from a malicious channel. This results in the legitimate channel being...
U.S. Dept Of Defense: Secret Access Key of AWS Firehose Disclosure
The domain had an endpoint that contained the secret access key of an AWS Firehose delivery stream encoded in base64. The secret access key was disclosed, allowing the record to be put into the Firehose delivery stream...
Node.js: Usage of unsafe random function in undici for choosing boundary
The vulnerability in the Undici library involves the use of an unsafe random function to choose the boundary for a multipart/form-data request. The use of Math.random to generate this boundary can be predicted if several of its generated values are known. This could potentially allow an attacker ...
curl: Hackers Attack Curl Vulnerability Accessing Sensitive Information
Summary: A critical security flaw in Curl. This is a data transfer tool and may potentially allow attackers to access sensitive information. Affected version 6.5 through 8.11.0 Steps To Reproduce: Security vulnerability when curl is used with a .netrc file for the credentials and also uses a HTTP...
Monero: Remote memory exhaustion in Epee RPC stack under zero Receive Window
The Epee RPC stack in Monero was vulnerable to memory exhaustion attacks. Delayed ACK or zero Receive Window advertisements could cause the server to keep responses in the send queue until memory was exhausted. This could lead to remote crashes of Monero nodes that exposed their RPC interfaces...
curl: bypass of this Fixed #2437131 [ Inadequate Protocol Restriction Enforcement in curl ]
Summary: A flaw has been identified in the curl command-line tool related to its protocol selection mechanism. Specifically, the protocol restrictions set by the --proto option can be bypassed, allowing unintended protocols to be used despite explicit restrictions. This flaw can result in plainte...
Internet Bug Bounty: [CVE-2024-54133] Possible Content Security Policy bypass in Action Dispatch
A vulnerability was discovered in the contentsecuritypolicy helper in Action Pack of Ruby on Rails. Carefully crafted inputs were able to inject new directives into the Content-Security-Policy CSP header, potentially leading to a bypass of the CSP and its protection against cross-site scripting X...
Internet Bug Bounty: [SECURITY] CVE-2024-50379 Apache Tomcat - RCE via write-enabled default servlet
A vulnerability was discovered in Apache Tomcat where a race condition could be triggered on a Windows machine with a write-enabled default servlet, leading to remote code execution. The issue was caused by the case-insensitive nature of the file system, which allowed an uploaded file to be treat...
curl: OS Command Injection (subprocess Module Usage)
Summary The Bandit tool flagged the usage of the subprocessmodule in the file curl.pyunder the B404:blacklist rule. This rule highlights potential security risks associated with using the subprocess module without proper sanitization of inputs, which can lead to command injection vulnerabilities...
Nextcloud: [nextcloud/mail] Blind SSRF to Internal Network via "List-Unsubscribe" SMTP Header when allow_local_remote_servers is allowed
Vulnerability description not provided...
PlayStation: sys_fsc2h_ctrl kernel stack free
The sysfsc2hctrl kernel function can lead to a kernel stack free vulnerability. The vulnerability is caused by a race condition involving multiple threads accessing a local stack buffer. This could potentially result in a privilege escalation...
Mozilla: Subdomain takeover on a subdomain under firefox.com
The subdomain ████ was vulnerable to a subdomain takeover due to its CNAME record pointing to a Fastly-hosted service that was not registered with Fastly. This allowed the researcher to claim and take control of the subdomain...
Denial of Service(DOS) in LangChainLLM due to missing exception handler.
Summary The streamcomplete method of the LangChainLLM class executes the llm using a thread and retrieves the result of the llm via the getresponsegen method of the StreamingGeneratorCallbackHandler class. During this process, getresponsegen recursively detects the onllmerror and onllmend events...
IBM: POST based Cross-Site Scripting on IBM research endpoint
The POST-based Cross-Site Scripting vulnerability on the IBM research endpoint was reported, analyzed, and remediated. The vulnerability was discovered by an external researcher...
Internet Bug Bounty: netrc and redirect credential leak
The netrc file in curl could lead to the unintentional leakage of a password to a different host when following HTTP redirects, if the netrc file had an entry matching the redirect target hostname but omitting either just the password or both login and password...
AWS VDP: A potential risk in the aws-lambda-ecs-run-task which can be used to privilege escalation.
The aws-lambda-ecs-run-task application created a function with a role that had excessive permissions, including the AdministratorAccess policy. This allowed for potential privilege escalation by an attacker...
Bykea: Lack of Feedback Validation Permits Arbitrary Driver Ratings
The vulnerability discovered by @bugbountywithmarco in Bykea's feedback system allowed authenticated passengers to submit feedback for drivers they had not actually ridden with. The exploit was limited to trips the attacker legitimately owned, and each trip could only affect one driver rating at ...
Yelp: Object Level access control leads to reading user's full requests, sessions, and error messages
The summary is as follows: A vulnerability was discovered in the Yelp internal administration tool called "Tailored Mail" hosted on the subdomain https://proze.yelp.com/. The vulnerability allowed unauthenticated attackers to read the internal admin's full HTTP requests, sessions, and other...