CRLF Injection in Nodejs ‘undici’ via host

Impact undici library does not protect host HTTP header from CRLF injection vulnerabilities. Patches This issue was patched in Undici v5.19.1. Workarounds Sanitize the headers.host string before passing to undici. References Reported at https://hackerone.com/reports/1820955. Credits Thank you to...

GHSA-5R9G-QH6M-JXFF CRLF Injection in Nodejs ‘undici’ via host

Impact undici library does not protect host HTTP header from CRLF injection vulnerabilities. Patches This issue was patched in Undici v5.19.1. Workarounds Sanitize the headers.host string before passing to undici. References Reported at https://hackerone.com/reports/1820955. Credits Thank you to...

GHSA-R6CH-MQF9-QC9W Regular Expression Denial of Service in Headers

Impact The Headers.set and Headers.append methods are vulnerable to Regular Expression Denial of Service ReDoS attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize utility function...

Regular Expression Denial of Service in Headers

Impact The Headers.set and Headers.append methods are vulnerable to Regular Expression Denial of Service ReDoS attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize utility function...

Denial of service due to unlimited number of parts

Impact The multipart body parser accepts an unlimited number of file parts. The multipart body parser accepts an unlimited number of field parts. The multipart body parser accepts an unlimited number of empty parts as field parts. Patches This is fixed in v7.4.1 for Fastify v4.x and v6.0.1 for...

HackerOne: HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension

An HTML injection vulnerability was discovered on HackerOne.com through the H1 Triage Wizard Chrome Extension. An attacker could inject malicious code into the triage questionnaire modal, potentially leading to the compromise of confidential information or impacting its integrity...

SSRF via filter bypass due to lax checking on IPs

None...

Missing rate limiting on password reset functionality allows sending lots of emails

None...

IDOR Vulnerability in Nextcloud Mail

None...

HackerOne: Attachment in published HackerOne report exposure private program

Vulnerability description not provided...

HackerOne: [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick

A Local File Inclusion vulnerability was discovered in an outdated version of ImageMagick used for image resizing on a website. An attacker could exploit this vulnerability by uploading a malicious PNG image, which would include the local file as content of the resized image in a hexadecimal...

U.S. Department of State: IDOR in TalentMAP API can be abused to enumerate personal information of all the users

An IDOR vulnerability was discovered in the Talentmap API that allowed guest users to enumerate personal information of all users. The vulnerability was due to the lack of access control mechanisms in the API endpoint. A malicious actor could exploit this vulnerability to fetch information of all...

FreeBSD : security/tor -- SOCKS4(a) inversion bug (847f16e5-9406-11ed-a925-3065ec8fd3ec)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 847f16e5-9406-11ed-a925-3065ec8fd3ec advisory. - The Tor Project reports: TROVE-2022-002: The SafeSocks option for SOCKS4a is inverted leading to SOCK...

Open redirect on government website sends users to adult content

Fake websites and open redirects have conspired to make things awkward for a UKGOV website. The site in question, riverconditionsdotenvironment-agencydotgovdotuk, was being abused in search engine results to redirect to various sites which arent associated with UKGOV--most of which were adult...

Passcode bypass on Talk Android app

None...

CSRF vulnerability in Nextcloud Desktop Client on Windows when clicking malicious link

None...

HackerOne: HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity

Sensitive report data, including report title, severity, program, and report ID, was leaked due to a mistake by a researcher and HackerOne. The leak occurred when HackerOne disclosed a report but did not redact the video proof of concept, which contained undisclosed reports reported by the...

HackerOne: Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query

The Analytics API query builder was vulnerable to a confusion attack that allowed users to query data from the dimreports table using a WHERE or HAVING clause with a FILTER in the HackerOne Analytics Query Language HAQL. This was possible because the dimreports and dimhackerreports tables both...

Gener8: Twitter Broken Link in https://gener8ads.com (Hackerone Profile)

A broken Twitter link was found on a company's Hackerone profile, which could be claimed by any malicious user. This could lead to the hijacking of the link and the potential deception of new researchers who click on it...

Internet Bug Bounty: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)

I reported at https://hackerone.com/reports/1684163 https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w Certain configurations of rails-html-sanitizer 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to...