1312437 matches found
U.S. Dept Of Defense: SQL Injection - entryid parameter in 'formbuilderv2-confirmation.php'
A SQL injection vulnerability was discovered in the 'entryid' parameter of the 'formbuilderv2-confirmation.php' script on the website. The vulnerability allowed for the manipulation of SQL queries executed by the backend database...
U.S. Dept Of Defense: POST XSS - fields[account][lastname] parameter
A cross-site scripting XSS vulnerability was discovered in the fieldsaccountlastname parameter of the POST request. The vulnerability allowed an attacker to inject malicious scripts that could be executed. This could potentially lead to consequences such as cookie theft and session hijacking...
U.S. Dept Of Defense: POST XSS - fields[account][firstname] parameter
A cross-site scripting XSS vulnerability was discovered in a parameter named "fieldsaccountfirstname" that was processed via the POST method. The vulnerability allowed the injection of malicious scripts that could be executed when the affected page was loaded. The impact of the vulnerability was...
U.S. Dept Of Defense: POST XSS - data[type] parameter
A Cross-Site Scripting XSS vulnerability was discovered on a certain system. The vulnerable parameter was datatype, which allowed an attacker to inject malicious scripts that could be executed. The vulnerability was reported and referenced...
U.S. Dept Of Defense: SQL Injection - data[account][id] parameter
A SQL injection vulnerability was discovered in the "dataaccountid" parameter on the website. The vulnerability allowed for the manipulation of SQL queries executed by the backend database. The impact of this vulnerability was not specified...
U.S. Dept Of Defense: POST XSS - data[account][id] parameter
A Cross-Site Scripting XSS vulnerability was discovered in the POST method through the "dataaccountid" parameter. The vulnerability allowed the injection of malicious scripts that could be executed. The affected system was located on a system host. The vulnerability was not assigned a CVE number...
Mars: RXSS on ββββββ via customerId parameter
A Reflected Cross-Site Scripting XSS vulnerability was identified on the Mars website at ββββββ. The vulnerability was located in the customerId parameter, which was inadequately sanitized before being reflected back to users in the HTTP response. When the parameter was manipulated with malicious...
curl: HTTP/3 Stream Dependency Cycle Exploit
Penetration Testing Report: HTTP/3 Stream Dependency Cycle Exploit --- 0x00 Overview A novel exploit leveraging stream dependency cycles in the HTTP/3 protocol stack was discovered, resulting in memory corruption and potential denial-of-service or remote code execution scenarios when used against...
curl: HTTP/2 CONTINUATION Flood Vulnerability
0x00 Vulnerability Overview: Fatal Flaw in HTTP/2 Protocol Stack 1. HTTP/2 Header Block Fragmentation Mechanism RFC 7540 Specification: Header blocks are transmitted using a HEADERS frame followed by one or more CONTINUATION frames. All frames must belong to the same stream and be sent...
GitHub: Arbitrary Read of Another Users private repository without Authorization
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. This vulnerability affected all versions of GitHub Enterprise...
curl: Speculative Execution Side-Channel in `curl`
π‘οΈ Penetration Testing Report ========== Speculative Execution Side-Channel in curl Date: May 2025 --- π§ Executive Summary This report outlines a speculative execution side-channel vulnerability found in curl versions 7.12.0 to 8.9.0, specifically within builds supporting experimental QUIC...
U.S. Dept Of Defense: Swagger UI Injection via Config URL - `βββ`
A Swagger UI injection vulnerability was identified on a specific endpoint. The issue allowed an attacker to inject custom JSON configuration into the Swagger UI, potentially leading to unspecified consequences...
Fastify: Remote Code Execution via unsafe usage of `reply.view({ raw })` in @fastify/view (EJS template engine)
The @fastify/view plugin, when used with the EJS engine and the reply.view raw: pattern, allowed arbitrary EJS execution. This vulnerability arose from the fact that Fastify trusted the raw template string without sanitization or restrictions when passed directly to EJS's compile method, leading ...
Regular expression Denial of Service - ReDoS
Description A regular expression denial of service ReDoS vulnerability has been identified in the Hugging Face Transformers library's weight conversion utility. The vulnerability exists in the converttfweightnametoptweightname function, which converts TensorFlow weight names to PyTorch format. Th...
curl: [High] Arbitrary File Write via Path Traversal in cURL CLI (`-o`, `--output`) (CWE-22: Improper Limitation of a Pathname to a Restricted Directory)
Summary: The -o / --output parameter in cURL does not restrict or sanitize file paths. When passed relative traversal sequences e.g., ../../, cURL writes files outside the current working directory, allowing arbitrary file overwrite. In automated or privileged environments CI/CD, root containers,...
curl: [High] MITM via Insecure CA Path Handling in cURL (--capath, CURLOPT_CAPATH) (CWE-494: Download of Code Without Integrity Check)
Summary: The --capath option in cURL and CURLOPTCAPATH in libcurl accept any directory path without validation. If an attacker provides a custom CA path containing a fake root certificate, cURL will trust malicious HTTPS endpoints signed with that fake root. This allows for full Man-in-the-Middle...
WakaTime: Session Replay Attack Allows Authentication Bypass via Captured Login Responses Allowing Bypass of 429 Too many attempts for Multiple Failed Logins
Summary An attacker can bypass authentication by capturing a valid login response including session cookies/tokens and replaying it during a failed login attempt with incorrect credentials. The server fails to invalidate or validate session tokens properly, allowing unauthorized access even after...
Omise: Facebook Username Takeover via Broken Link in Footer
The Facebook username associated with the broken link in the footer was available for takeover. This could have allowed an attacker to create a fake Facebook page and mislead users into trusting it...
curl: Potential XSS vector in curl via unsanitized URL parameter handling
Description Summary: During the analysis of the curl source code, a possible vector for Cross-Site Scripting XSS was identified through the globurl function and how URL input is handled via urlnode-url. Improper input validation or escaping could result in untrusted data being processed insecurel...
curl: Double Free Vulnerability in `libcurl` Cookie Management (`cookie.c`)
Description: Two Double Free vulnerabilities have been identified in the cookie.c file of the libcurl library. These issues occur due to improper memory management, where the same memory area is freed multiple times under certain conditions. Below are clear steps to reproduce each vulnerability...