CSRF vulnerability in Nextcloud Desktop Client on Windows when clicking malicious link

None...

HackerOne: HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity

Sensitive report data, including report title, severity, program, and report ID, was leaked due to a mistake by a researcher and HackerOne. The leak occurred when HackerOne disclosed a report but did not redact the video proof of concept, which contained undisclosed reports reported by the...

HackerOne: Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query

The Analytics API query builder was vulnerable to a confusion attack that allowed users to query data from the dimreports table using a WHERE or HAVING clause with a FILTER in the HackerOne Analytics Query Language HAQL. This was possible because the dimreports and dimhackerreports tables both...

Gener8: Twitter Broken Link in https://gener8ads.com (Hackerone Profile)

A broken Twitter link was found on a company's Hackerone profile, which could be claimed by any malicious user. This could lead to the hijacking of the link and the potential deception of new researchers who click on it...

Internet Bug Bounty: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)

I reported at https://hackerone.com/reports/1684163 https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w Certain configurations of rails-html-sanitizer 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to...

GHSA-5X79-W82F-GW8W Inefficient Regular Expression Complexity in rails-html-sanitizer

Summary Certain configurations of rails-html-sanitizer = 1.4.4. Severity The maintainers have evaluated this as High Severity 7.5 CVSS3.1. References - CWE - CWE-1333: Inefficient Regular Expression Complexity 4.9 - https://hackerone.com/reports/1684163 Credit This vulnerability was responsibly...

Mattermost: Uninstalling Mattermost Launcher for Windows (64-bit), then reinstalling keeps you logged in without authentication

The Mattermost Desktop App for Windows 64-bit had a vulnerability where uninstalling and then reinstalling the app would automatically log the user back in without requiring authentication, allowing unauthorized access to the user's account and data. The uninstall process did not remove session...

Brave Software: S3 Bucket Takeover : brave-apt

An unclaimed S3 bucket was found on the domain brave.com, which was being used in the installation of brave-browser in Linux distros. An attacker could have taken over the S3 bucket and used it to spread malware or create a fake login page to spoof users. The vulnerability was reported to the...

Calendar name length not validated before writing to database

None...

HackerOne: Any organization's assets pending review can be downloaded

Steps to reproduce - sign in as any user - visit https://hackerone.com/organizations/:handle/assets/downloadpendingreviews.csv, where :handle is the organization you want to download the assets for Impact This may leak sensitive data about an organization's attack surface...

MTN Group: Wordpress users Disclosure [ /wp-json/wp/v2/users/ ] Not Resolved ()

On this report's 735586 You closed the report and changed the status to Resolved. But it's Not Resolved The Bug It's Still there url: https://www.mtn.com/wp-json/wp/v2/users/ Sorry to say this still i can reproduce this issue please remove /wp-json/wp/v2/users/ file if your domain dont use that...

nextcloudcmd incorrectly trusts bad TLS certificates

None...

XSS in Desktop Client in call notification popup

None...

GHSA-3FJJ-P79J-C9HH Fastify: Incorrect Content-Type parsing can lead to CSRF attack

Impact The attacker can use the incorrect Content-Type to bypass the Pre-Flight checking of fetch. fetch requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts application/js...

HackerOne: adding h1_analyst_* to username for normal users

Vulnerability description not provided...

Exception logging in Sharepoint app reveals clear-text connection details

None...

Profile of disabled user stays accessible

None...

Adobe: DOM XSS at `https://adobedocs.github.io/OAE_PartnerAPI/?configUrl={site}` due to outdated Swagger UI

Vulnerability description not provided...

fastify vulnerable to denial of service via malicious Content-Type

Impact An attacker can send an invalid Content-Type header that can cause the application to crash, leading to a possible Denial of Service attack. Only the v4.x line is affected. This was updated: upon a close inspection, v3.x is not affected after all. Patches Yes, update to v4.8.0. Workarounds...

Uber hacked

Uber informed the public on Thursday it was responding to a cybersecurity incident after somebody breached its network. From what we have been able to find out so far, the attacker managed to compromise an employees access to the chat app Slack. The intruder may also have gained access to the...