CVE-2022-35291

Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successfu...

CVE-2022-35291 Privilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS)

Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successfu...

Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar SIEM has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2022-23218 DESCRIPTION: GNU C Library aka glibc is vulnerable to a stack-based...

Internet Bug Bounty: Off-by-slash vulnerability in nodejs.org and iojs.org

Original Report: https://hackerone.com/reports/1631350 The reason for submitting this report is written in the comment of the original report. ---- Summary: Configuration files for Nginx in nodejs/build repository have multiple off-by-slash misconfigurations. Because nodejs.org and iojs.org are...

Node.js: Off-by-slash vulnerability in nodejs.org and iojs.org

Summary: Configuration files for Nginx in nodejs/build repository have multiple off-by-slash misconfigurations. Because nodejs.org and iojs.org are deployed using those files, it is possible for an attacker to gain access to unexpected directories. This report is not related to nodejs/node...

PT-2022-24287

Name of the Vulnerable Software and Affected Versions Systemd affected versions not specified Description An off-by-one Error issue was discovered in the format timespan function of time-util.c. An attacker could supply specific values for time and accuracy that lead to a buffer overrun in format...

CreateFor#JBProjects.sol is vulnerable to reentrancy

Lines of code Vulnerability details Impact Reentrancy attack can trick users by spamming incorrect project Id event emission Proof of Concept The function createFor which uses safeMint is lacking any form a reentrancy protection. OZ Safe Mint implementation is function safeMint address to, uint25...

HackerOne: June 2022 Incident Report

Intro Since the founding of HackerOne, we have kept a steadfast commitment to disclosing security incidents because we believe that sharing security information far and wide is essential to building a safer internet. HackerOne's culture is to disclose more often, and in more detail than the rest ...

Exploit for Off-by-one Error in F5 Nginx

CVE-2021-23017-PoC pip install -r requirements.txt pytho...

CMC Electronics EFB breakout vulnerability

We’ve been finding vulnerabilities in electronic flight bags for a few years now. Disclosure response from the vendors involved has varied from excellent to radio silence. In every case we have tried extremely hard to engage with the vendors involved, even where we were ignored. We asked friendly...

PT-2022-30879

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.4 Description The issue is related to an off by one error in the dm dmub outbox1 low irq function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versio...

PT-2022-31241

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.15 Description The issue is related to an off by one error in the dm dmub outbox1 low irq function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

[PNM-003] _totalStakedBefore_ and _totalStakedAfter_ are the always the same

Lines of code Vulnerability details Description It can be medium or high according to the off-chain logic which is not avaiable for the contest. Specifically, rebases can only be updated by function storeRebase and the only callsite of function storeRebase is in function rebase. While we have...

Exploit for Off-by-one Error in Sudo_Project Sudo

CVE-2021-3156: Heap-Based Buffer Overflow in Sudo Baron Samed...

CVE-2022-1823

Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execu...

PT-2022-14142 · Mcafee · Mcafee Consumer Product Removal Tool

Name of the Vulnerable Software and Affected Versions: McAfee Consumer Product Removal Tool versions prior to 10.4.128 Description: The issue is related to improper privilege management, which could allow a local user to modify a configuration file. This modification could lead to a LOLBin Living...

CVE-2022-30155: Off-by-one Error

Windows Kernel Denial of Service Vulnerability...

CVE-2022-32739

When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number...

CVE-2022-30309: Incorrect Authorization

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...

WordPress plugin WP Admin Style 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP Admin Style plugin version 0.1.2 and prior versions contain a cross-site scripting...