HackerOne: Program admins could add verified domains to an organization

Program admins could add verified domains to an organization in HackerOne despite lacking organization admin permissions. This allowed program admins to access restricted features and escalate privileges...

GitHub Rotates Keys After High-Severity Vulnerability Exposes Credentials

GitHub has revealed that it has rotated some keys in response to a security vulnerability that could be potentially exploited to gain access to credentials within a production container. The Microsoft-owned subsidiary said it was made aware of the problem on December 26, 2023, and that it address...

CVE-2024-0200

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

CVE-2024-0200

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

CVE-2024-0200 Unsafe Reflection in Github Enterprise Server leading to Command Injection

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

CVE-2024-21680

A RCE vulnerability (CVSS 3.0: AV=L/AC=L/PR=N/UI=R/S=U/C/H/I/H/A:H) was introduced in Sourcetree for Mac and Sourcetree for Windows version 3.4.14. The issue allows an unauthenticated attacker to execute arbitrary code with high impact to confidentiality, integrity, and availability, requiring us...

CVE-2023-34063

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows...

CVE-2022-45592

CVE-2022-45592 is discussed in connected documents as affecting Linux distributions (notably Debian/Ubuntu) with a set of issues: Server-Side Request Forgery (SSRF), persistent Cross-Site Scripting (XSS), and a File Upload vulnerability. The Nessus NASL notes unpatched status for Debian/Ubuntu pa...

CVE-2023-34854

CVE-2023-34854 corresponds to an authenticated remote code execution vulnerability in HotelDruid via its backup/restore functionality. Multiple connected sources (Ubuntu/Debian trackers, Veracode, PT-Security, and Nessus) confirm RCE through backup/restore, with no explicit patch/version details ...

CVE-2023-48783

An Authorization Bypass Through User-Controlled Key vulnerability CWE-639 affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other...

Fortinet PortiPortal Security Vulnerability

Fortinet PortiPortal is a cloud-based multi-tenant portal from Fortinet, Inc. for security policy management and analysis. A security vulnerability exists in Fortinet PortiPortal version 7.2.1 and earlier, version 7.0.6 and earlier, version 6.0.14 and earlier, and version 5.3.8. An attacker could...

PT-2024-13651 · Unknown · Portiportal

Name of the Vulnerable Software and Affected Versions: PortiPortal versions 7.2.1 and below PortiPortal versions 7.0.6 and below PortiPortal versions 6.0.14 and below PortiPortal versions 5.3.8 and below Description: The issue allows a remote authenticated user with at least read-only permissions...

Black Basta-Affiliated Water Curupira’s Pikabot Spam Campaign

...

webmail.kapsam.org Cross Site Scripting vulnerability OBB-3829519

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-43876

CVE-2022-43876 affects IBM Security Verify Access OpenID Connect Provider container. The IBM bulletin states an information-disclosure flaw where web pages can be stored locally by the OIDC Provider and read by another user on the same system. Affected IBM Security Verify Access OIDC Provider ver...

pmq.org.hk Cross Site Scripting vulnerability OBB-3828398

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Choosing an AI-SPM tool: The four questions every security organization needs to ask

Ensure you are staying secure as your organization adopts AI by following these four guiding questions...

Authentication Bypass

hail is is vulnerable to Authentication Bypass. The vulnerability is due to improper validation while handling OpenID Connect OIDC email addresses. This lack of verification of the user's email domain allows an attacker to manipulate their email address to match an organization's domain with...

cleancooking.org Cross Site Scripting vulnerability OBB-3823633

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-8397 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.8.13 GitHub Enterprise Server versions prior to 3.9.8 GitHub Enterprise Server versions prior to 3.10.5 GitHub Enterprise Server versions prior to 3.11.3 GitHub Enterprise Server versions prior to...