1312336 matches found
curl: curl --continue-at confusion
Summary: When curl command is used with --continue-at, the --no-clobber is unexpectedly ignored and curl will append the output to the target file, even if it already exists. If --continue-at is used with--remove-on-error it can lead to unexpected removal of the file on early errors. Note that th...
U.S. Dept Of Defense: Unauthorized Access Exposing Sensitive Data
The identified page allowed unauthorized access to a user's profile management functionality without requiring authentication. Sensitive user details, such as name, email address, and EDIPI, were exposed upon accessing the page...
Monero: low-level p2p ping + tcp flooding leads to a remote crash in monerod
The vulnerability allowed remote crashes of the P2P daemon through low-level ping and TCP flooding...
U.S. Dept Of Defense: Exposed Extremely Sensitive Information in Public ZIP File
A publicly accessible ZIP file containing sensitive information, including SMTP credentials, database connection details, and AWS secret keys, was discovered. The sensitive data was exposed due to the lack of proper access controls and encryption. The exposed credentials could have been misused f...
Shopify: Staff with Restricted Permissions Could Access Customer Data After Company Removal
The report describes a vulnerability in Shopify's admin interface where staff members with restricted company permissions could access and update customer information even after the customer had been removed from a specific company. The issue arose when a customer, initially associated with a...
U.S. Dept Of Defense: XSS found in https://www.████████.mil
The security researcher found a reflected cross-site scripting XSS vulnerability on the www.████████.mil website. The vulnerability was demonstrated using a proof-of-concept link that triggered a JavaScript alert. The affected product was identified as the web server, and the vulnerable code was...
curl: Information Disclosure at : https://curl.se/.mailmap
Summary: ================= During a security assessment, it was discovered that email addresses were exposed in a publicly accessible location. The data was retrieved using standard tools, such as curl, without requiring authentication or special permissions. This raises a concern regarding the...
Admin Able to Create User Without Setting a Password
Description The application allows an admin to create a new user account without assigning a password. This could lead to security vulnerabilities, or the system might inadvertently create an account with a default or blank password, making it susceptible to unauthorized access. Proof of Concept ...
TikTok: IDOR on ads.tiktok.com Allows Unauthorized Product Addition
An Insecure Direct Object Reference IDOR vulnerability was discovered on the TikTok Ads API that allowed the addition of arbitrary products to a user's catalog without proper authorization...
Khan Academy: XSS on using the legacy "Graphie To Png" API
The legacy "Graphie To Png" API was vulnerable to exploitation. An attacker could upload malicious graphies that included harmful SVG and JSON data. The SVG contained an onload attribute that executed arbitrary JavaScript. The JSON data modified the content of labels, causing the graphie renderer...
Stored Cross-Site Scripting (XSS) via SAML IdP XML Injection
An attacker can achieve stored cross-site scripting XSS by injecting malicious JavaScript into the SAML IdP XML metadata. This metadata is used to generate the SAML login redirect URL, which is ultimately set as the value of window.location.href. This vulnerability allows the attacker to execute...
Arbitrary File Overwrite & RCE via Tarfile Path Traversal
Description The DJL package utilizes an untar function, for example, when downloading and saving models. Additionally, the untar function overwrites existing files. Therefore, the untar method includes the following two security measures to prevent misuse of its functionality. 1. Security measure...
Improper access of prompt data by another user.
Description Another user can able to see the prompts data of a particular users. Proof of Concept let promptid be the prompt id of user 1 visit http://127.0.0.1:8080/prompts/promptid from another users user 2 session user 2 can see the user 1 promptid's data. Previously it was reported by some on...
IBM: Exposed Logs and Bearer Tokens on Test Endpoint
Exposed Logs and Bearer Tokens on Test Endpoint were reported to IBM, analyzed, and have been remediated...
Lack of unique constraint validation allows overwriting evaluators
Description The application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator. Since the backend lacks databa...
Node.js: GOAWAY HTTP/2 frames cause memory leak outside heap
A memory leak could occur when a remote peer abruptly closed the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could have led to increased memory...
Logging into webui as view only internal user provides overly privileged bearer key
Description When an user with the role "internaluserviewer" logs into the application they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application. The following steps are taken: An admin creates an Internal User with the role...
curl: information disclosure
Summary: web.archive.org -website web. Archive is a website like google search, but he saves all links. Wayback disclosing URL's without users' permission, Anyone can access them maybe emails and passwords they are notes they should be private and see everything just by searching about random not...