X (Formerly Twitter): Private list members disclosure via GraphQL

Summary: Due to improper queries of GraphQL, the attacker can steal members of the private list. Description: Twitter implements a unique GraphQL endpoint, which can use only the queries that Twitter specified. However, there is a flaw in the backend...

Information Disclosure

mailman is vulnerable to information disclosure. A flaw in the truepath function of Mailman was discovered. A remote attacker who is a member of a private mailman list could use a carefully crafted URL and gain access to arbitrary files on the server...

Instacart: Access private list metadata

Overview When user creates a list, they can choose to not make it public. However the attacker can still access the information that user chose to hide. Steps to Reproduce 1. Log in to Instacart. 2. Choose a private list that you want to see, for example the one with id = 10. 3. Go to...