1312268 matches found
curl: Memory leak in Curl_auth_create_ntlm_type3_message
Summary: When handling NTLMv2, if the decoded type-2 “TargetInfo” is large enough that ntresplen+headersize exceeds NTLMBUFSIZE 1024, the code returns early without freeing ntlmv2resp, causing a memory leak...
curl: Buffer Overflow in WebSocket Handshake (lib/ws.c:1287)
Summary: Buffer overflow vulnerability in curl's WebSocket implementation due to unsafe use of strcpy in the handshake process. The vulnerability is located at lib/ws.c:1287 where strcpykeyval, randstr is called without proper bounds checking, despite having a bounds check earlier in the code. AI...
Node.js: fs.futimes() Bypasses Read-Only Permission Model
A flaw in Node.js's permission model was discovered that allowed a file's access and modification timestamps to be changed via futimes even when the process had only read permissions. Unlike utimes, futimes did not apply the expected write-permission checks, which meant file metadata could be...
Path traversal vulnerability via `FileSystemPathPointer.join()` method allows unauthorized file access
Description A critical path traversal vulnerability exists in the FileSystemPathPointer.join method within the nltk library. The vulnerability allows attackers to bypass directory restrictions and access files outside the intended directory structure by using path traversal sequences such as ../ ...
curl: SMTP Command Injection Vulnerability in libcurl 8.16.0 via RFC 3461 Suffix
Executive Summary libcurl version 8.16.0 contains a critical SMTP command injection vulnerability CVE-quality in the implementation of RFC 3461 Delivery Status Notification DSN parameter support. The vulnerability allows an attacker to inject arbitrary SMTP commands by including CRLF \r\n...
Nextcloud: Predictable proposal participant tokens enable unauthorized access and vote submission
A vulnerability was discovered in predictable proposal participant tokens, which enabled unauthorized access and vote submission...
SingleStore: Insufficient checks in the file path parameter allow writing to unauthorized directories
A directory traversal vulnerability was identified in the file upload functionality. Authenticated users could write files to parent directories outside the intended upload location by manipulating the path parameter. The issue was classified as Low severity due to limited impact. The vulnerabili...
arkadiyt-projects: Arbitrary File Write
A path traversal vulnerability was discovered in the protodump tool. The vulnerability allowed for arbitrary file writes outside the intended output directory due to insufficient validation of the gopackage option extracted from embedded protobuf descriptors. The Filename function extracted the...
arkadiyt-projects: DNS Rebinding Attack
Hi, there is a DNS rebinding vulnerability in your SSRF filter. F4891755 You validate the hostname's IP address, but then pass the hostname to Net::HTTP.start, which does its own DNS lookup. An attacker can control a DNS server that returns a safe public IP during validation, then returns 127.0.0...
Rocket.Chat: SSRF via Improper Redirect Validation in Rocket.Chat oEmbed Function
A vulnerability was discovered in Rocket.Chat version 7.10.1 where the oEmbed feature did not properly validate redirected URLs. This allowed an attacker to bypass SSRF protections and access internal network resources that would otherwise be unreachable...
AWS VDP: Responsible disclosure - public S3 bucket exposing JSON/config files
A publicly listable S3 bucket was discovered, exposing various JSON and configuration files. The bucket listing and file metadata were retrievable without authentication...
Nextcloud: BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data
Summary The Out-of-Office OOO API endpoints at /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId and /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId/now suffer from a Broken Object Level Authorization BOLA vulnerability. Any authenticated user can retrieve the out-of-office data of any other user by...
curl: Missing enforcement of SFTP quote syntax can lead to operation on wrong object
Summary: curl supports -Q or --quote and libcurl CURLOPTQUOTE to specify "commands" to execute for ftp and SFTP connections. The SFTP supports commands that perform operations on filesystem objects. When the object path has a filename, the caller is supposed to quote the parameter example: -Q...
lemlist: Unauthorized Password Reset Allows Account Takeover Across Tenant Boundaries
An authorization issue was discovered in the application that allowed a tenant admin to change the password of another user within the same tenant, including invited agency accounts. The victim had to first accept the invitation before the attacker could proceed. The issue could allow unintended...
HackerOne: Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse
A vulnerability was discovered in the reward redemption process of a points and rewards system. The vulnerability allowed an attacker to obtain multiple valid Burp Suite Pro licenses by using different email addresses, without any validation or verification tied to the user's account. The email...
Mars: Sensitive information exposed at [███] via /export_panelists_to_xlsx endpoint
A vulnerability was identified that allowed unauthorized access to personally identifiable information through an unprotected API endpoint. The vulnerability exposed user email addresses and telephone numbers. The issue was classified under CWE-312 with a CVSS score of 6.1. The vulnerability was...
curl: Apple SecTrust legacy path accepts untrusted certificates on pre-10.14 macOS/iOS when built with USE_APPLE_SECTRUST
Summary: When libcurl is built with USEAPPLESECTRUST and runs on Apple OS versions that lack SecTrustEvaluateWithError macOS 10.14 / iOS 12, the legacy verification path miscompares OSStatus to SecTrustResultType and never checks the SecTrust result. This can cause untrusted certificates to be...
MLFlow server is exposed to data exfiltration and destruction due to lack of Origin validation
The MLFlow REST server is vulnerable to DNS rebinding attacks, allowing malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. Once rebinding is successful, the attacker can: Query for experiments via the 2.0/mlflow/experiments/search...
curl: OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients)
Summary: In curl’s OpenSSL backend, osslgetchannelbinding retains a new reference to the server’s X509 certificate via SSLget1peercertificate and never releases it. When Negotiate SPNEGO over TLS is in use, this path is invoked and leaks one X509 object per trigger. Over many requests in a...