1312386 matches found
MacTaggart Scott: Overwrite any file of the web server
The web server was vulnerable to file overwrite due to a vulnerable module used to generate files. An attacker could have overwritten any file on the web server, including critical system files, by sending a specially crafted request...
AWS VDP: External service interaction (HTTP)
The External Service Interaction vulnerability was discovered in a URL. The vulnerability allowed an attacker to induce the application to interact with arbitrary external services such as DNS and HTTP. This vulnerability was outside the scope of the program, as the related infrastructure had bee...
Internet Bug Bounty: `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods
The Rust Security Response WG disclosed a vulnerability in the std::process::Command module on Windows, where it incorrectly escaped arguments when invoking batch files. This allowed for bypassing the fix by including trailing whitespace or periods in the batch file name, which are ignored and...
Nextcloud: Open redirect when logging in with user_oidc
An open redirect vulnerability was discovered in Nextcloud's useroidc app. This vulnerability allowed an attacker to redirect users to a malicious website during the login process...
HackerOne: Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation
Vulnerability description not provided...
nullsec VDP: Test by HDR
Test by HDR...
mycompany VDP: This test report has been disclosed by 20_root.
This test report has been disclosed by 20root. ████...
Insightly: Email verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"
The vulnerability allowed bypassing email verification when creating a new Insightly account. The vulnerability existed in the "EmailAddress" parameter of the member creation endpoint. By modifying the parameter, an attacker could create a new account using any email address, including those of...
U.S. Dept Of Defense: CSRF leads to Account takeover
The target website was found vulnerable to CSRF, allowing an attacker to perform actions on the user's behalf without their knowledge or consent. The vulnerable endpoint was identified at https://██████/account/profile/edit, where the user's profile information could be modified. A POC was...
Mozilla: Bypass Email verification for monitoring at `monitor.mozilla.org`
The email verification at monitor.mozilla.org was bypassed by leveraging a leaked verification token from the /api/v1/user/breaches endpoint. The verification token was then used to bypass the email verification process and gain access to monitor the email without the owner's permission...
HackerOne: Takeover of hackerone.engineering via Medium
The report describes a broken link hijacking vulnerability on the hackerone.engineering domain, which belonged to HackerOne. The domain was found to be pointing to a non-existent page on Medium, allowing the reporter to create a page with the same URL and take over the domain...
Mozilla: [ addons-preview-cdn.mozilla.net ] A subdomain takeover is available via unregistered domain in Fastly
The domain addons-preview-cdn.mozilla.net was found to CNAME resolve to addons.allizom.org, which was hosted on Fastly's service. The domain addons-preview-cdn.mozilla.net was not registered within Fastly, resulting in a "Fastly error: unknown domain" message. The vulnerability was demonstrated b...
Internet Bug Bounty: CVE-2024-45498: Apache Airflow Command injection in read_dataset_event_from_classic DAG
CVE-2024-45498 was a command injection vulnerability in the readdataseteventfromclassic DAG in Apache Airflow version 2.10.0. The vulnerability allowed an attacker with user privileges to inject OS commands into the s3://output/1.txt dataset, which were then executed when the DAG was triggered...
Nextcloud: Share information of Tables app is not limited to affected users
The vulnerability in the Tables app in Nextcloud allowed the sharing of information with users not affected by the vulnerability...
Kubernetes: Injection in path parameter of Ingress-nginx
A vulnerability was discovered in the Ingress-nginx controller where an attacker could inject arbitrary content into the path parameter of an Ingress. This allowed the attacker to upload a malicious nginx configuration file to the ingress controller's file system and then include that file in a...
U.S. Dept Of Defense: CSRF leads to Account takeover
The CSRF vulnerability was found on the endpoint https://██████████/account/profile/edit, which allowed an attacker to modify the victim's account information, including their username, password, and email address, resulting in account takeover...
IBM: SSRF and secret key disclosure found on Turbonomic endpoint
The vulnerability of SSRF and secret key disclosure was found on a Turbonomic endpoint and reported to IBM. The issue was analyzed and remediated...
IBM: SSRF and secret key disclosure found on Turbonomic endpoint
The SSRF and secret key disclosure vulnerabilities found on the Turbonomic endpoint were reported to IBM, analyzed, and remediated...
U.S. Dept Of Defense: CSRF Attack leads to delete album at ████████
The report describes a CSRF vulnerability in the DoD asset ███████, specifically in the feature to create albums for a media collection. The vulnerability allows an attacker to delete a victim's album without the victim's consent, as the delete request is based on GET and lacks CSRF verification...