1312268 matches found
curl: CVE-2025-10148: predictable WebSocket mask
No AI was involved. Summary: The curl WebSocket implementation generates a fixed masking key at the beginning of a connection an re-uses it for every frame: Generation of masking key enc.mask in Curlwsaccept: https://github.com/curl/curl/blob/455afa1de5182b95a5dcc988f18cdff584b95239/lib/ws.cL1340...
SingleStore: 2FA bypass possible on https://authsvc.singlestore.com
A vulnerability was discovered that allowed the 2FA authentication mechanism to be bypassed completely. An attacker could access the victim's account by only knowing the email address and password, without requiring the 2FA code...
Basecamp: Improper bot-authentication allows to impersonate any user when sending messages in a room
A vulnerability was discovered in the bot authentication mechanism. The issue allowed an unauthenticated user to impersonate any user and post messages in rooms the impersonated user had access to. The bot authentication function failed to properly validate the bot key, allowing a partial key to...
U.S. Dept Of Defense: Exposed wp-config.php file in ███ National Guard website
A WordPress configuration file containing sensitive information, such as the MySQL database password, was found exposed on a website of the National Guard. The file was accessible at a public endpoint...
Django: Path traversal via archive.extract - CVE 2021-3281 incomplete patch
A vulnerability was discovered in the "extract" function of the ZipArchive and TarArchive classes in the Django framework. The vulnerability was caused by the use of the "abspath" function, which removes terminating path separators. This made the guard logic protection insufficient to protect...
Bykea: Lack of minimum value bid wheel verification on customer_bid in Rental Trips
A missing validation on the customerbid field when creating rental trips allowed passengers to submit arbitrary bid amounts, including very low fares. Proper validation was added to prevent unrealistic values...
AWS VDP: Existence of completed pods allows for bypass of Kubernetes NetworkPolicy
Description The Amazon VPC CNI controller, when configured to manage NetworkPolicy rules, will incorrectly apply firewall rules for Completed pods as if the pods are still running, causing these rules to be applied to other unrelated pods that happen to receive the same IP address as a Completed...
Integer Overflow → Heap Buffer Overflow in BYTES-Tensor Parsing (DoS)
This report is not public...
Mozilla: User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon
A vulnerability was discovered in the Mozilla Pontoon application that allowed users to delete other users' personal access tokens at the /delete-token/tokenid/ endpoint without proper permission checks. The vulnerability was caused by the absence of user permission verification in the deletetoke...
curl: libcurl: Host-Only Cookies Leak to Alternate IPv4 Forms
libcurl canonicalizes numeric IPv4 hostnames during URL parsing and redirect handling example: 127.000.000.001 to 127.0.0.1. When a host-only cookie no Domain= attribute is set, it is stored in the cookie jar with the host string 127.0.0.1. On redirect, even if the Location: contains an alias hos...
U.S. Dept Of Defense: Account Takeover via Unverified Email Change and Improper Session Handling
A vulnerability was discovered in the email change functionality of the system. When the email was changed to an unregistered email address, the system accepted the change without proper verification. If the victim later registered using the same email, the attacker's existing session was not...
curl: Heap-buffer-overflow (Out-of-Bounds Read) in DoH hostname encoding
Summary: I found a heap-buffer-overflow in the dohreqencode function in lib/doh.c. The bug happens when curl processes a DNS-over-HTTPS request for a hostname that is an empty string. The code gets the string length as 0, then tries to access hostlen - 1, which becomes host-1. This is an...
Cloudflare Public Bug Bounty: [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth
A vulnerability was discovered in Cloudflare Access that could allow for unauthorized approvals within the Temporary Auth workflow. The issue was resolved after the researcher reported it to Cloudflare...
Path Traversal vulnerability in keras using tar extract
Technical Details of the Vulnerability Summary Keras's keras.utils.getfile function is vulnerable to directory traversal attacks despite implementing filtersafepaths. The vulnerability exists because extractarchive uses Python's tarfile.extractall method without the security-critical filter="data...
PlayStation: Double fdrop on a socket through sys_netcontrol
The netcontrol syscall in the kernel had a vulnerability where the socket file descriptor was not properly validated when removing a socket from a netevent structure. This allowed an attacker to cause a double fdrop on a socket, potentially leading to a use-after-free condition...
curl: Incorrect Parsing of IPv6 Zone ID in curl
I'm Zehui Miao from NISL@THU. During recent research, our team identified a parsing inconsistency in the curl. 0x01 Affected components 1.1 Affected components • C Curl • Versions: tested in 8.4.0 • CLAIMS TO FOLLOW: RFC-3986 1.2 Attack scenario The threat model illustrated in Figure 1 explains t...
U.S. Dept Of Defense: Information Disclosure via Publicly Accessible Debug Log
A publicly accessible WordPress debug log file was discovered on the target system. The log file contained PHP warnings and deprecated notices that disclosed sensitive server paths and plugin details. This exposure may have assisted an attacker in fingerprinting the environment or exploiting know...
Cloudflare Public Bug Bounty: Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATO
The vulnerability in the MCP Server Portal Apps was caused by missing sanitization of the redirecturi parameter, leading to a second-order XSS vulnerability. An attacker could craft a malicious redirecturi containing JavaScript code, obtain a clientid for this URI, and reuse it when a victim had ...
Account takeover due to missing oauth audience verification in google sign in
Description The web application integrates Google OAuth for user authentication. Upon successful Google sign-in and user consent, the application receives a token from Google. This token is used by the web application to fetch user profile information such as email and name and complete the login...