115 matches found
Glovo: Exposed valid AWS, Mysql, Sendgrid and other secrets
Summary: Hi team, I just discovered some hardcoded credentials allowing access to AWS, Mysql database, ... To make this report short, here is the POC: see ███ & █████ Steps To Reproduce: where there are the info : APPNAME=Glovo APPENV=local APPKEY=█████ APPDEBUG=false APPURL=http://localhost...
CVE-2022-24864
Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...
Design/Logic Flaw
Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...
CVE-2022-24864 Malicious Javascript injection in OriginProtocol/origin-website
Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...
CVE-2022-24864 Malicious Javascript injection in OriginProtocol/origin-website
Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...
Wholeaked - A File-Sharing Tool That Allows You To Find The Responsible Person In Case Of A Leakage
wholeaked is a file-sharing tool that allows you to find the responsible person in case of a leakage. It's written in Go. How? wholeaked gets the file that will be shared and a list of recipients. It creates a unique signature for each recipient and adds it to the file secretly. After then, it ca...
Uber Bug, Ignored for Years, Casts Doubt on Official Uber Emails
A security vulnerability that would allow malicious attackers to send email from Uber’s network appears to be closed – but users could have been swindled already. The easy-to-find bug has been hanging around for years, ready to take Uber’s customers for a ride of a very different sort. According ...
c7n-mailer (>=0.6.4 <=0.6.12), jesse (>=2.2.0 <=2.2.1) +7 more potentially affected by CVE-2021-43572 via starkbank-ecdsa (>=1.0.0 <=1.1.1)
starkbank-ecdsa PYPI version =1.0.0, =0.6.4, =2.2.0, =1.0.1, =1.0.1, =1.3.0, =6.8.3, =6.9.0 - starkbank =0.1.0 Source cves: CVE-2021-43572 Source advisory: OSV:GHSA-92VM-MXJF-JQF3...
c7n-mailer (>=0.6.4 <=0.6.12), jesse (>=2.2.0 <=2.2.1) +7 more potentially affected by CVE-2021-43572 via starkbank-ecdsa (>=1.0.0 <=1.1.1)
starkbank-ecdsa PYPI version =1.0.0, =0.6.4, =2.2.0, =1.0.1, =1.0.1, =1.3.0, =6.8.3, =6.9.0 - starkbank =0.1.0 Source cves: CVE-2021-43572 Source advisory: OSV:PYSEC-2021-426...
c7n-mailer (>=0.6.4 <=0.6.12), jesse (>=2.2.0 <=2.2.1) +7 more potentially affected by unknown CVE via starkbank-ecdsa (>=1.0.0 <=1.1.1)
starkbank-ecdsa PYPI version =1.0.0, =0.6.4, =2.2.0, =1.0.1, =1.0.1, =1.3.0, =6.8.3, =6.9.0 - starkbank =0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-9WX7-JRVC-28MM...
WordPress SendGrid plugin access control error vulnerability
WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress SendGrid plugin version 1.11.8 and earlier is vulnerable to an access control error, which stems fro...
CVE-2021-34629
The SendGrid WordPress plugin is vulnerable to authorization bypass via the getajaxstatistics function found in the /lib/class-sendgrid-statistics.php file which allows authenticated users to export statistic for a WordPress multi-site main site, in versions up to and including 1.11.8...
CVE-2021-34629
The SendGrid WordPress plugin is vulnerable to authorization bypass via the getajaxstatistics function found in the /lib/class-sendgrid-statistics.php file which allows authenticated users to export statistic for a WordPress multi-site main site, in versions up to and including 1.11.8...
Authorization
The SendGrid WordPress plugin is vulnerable to authorization bypass via the getajaxstatistics function found in the /lib/class-sendgrid-statistics.php file which allows authenticated users to export statistic for a WordPress multi-site main site, in versions up to and including 1.11.8...
CVE-2021-34629 SendGrid <= 1.11.8 – Authorization Bypass
The SendGrid WordPress plugin is vulnerable to authorization bypass via the getajaxstatistics function found in the /lib/class-sendgrid-statistics.php file which allows authenticated users to export statistic for a WordPress multi-site main site, in versions up to and including 1.11.8...
CVE-2021-34629
CVE-2021-34629 affects the WordPress SendGrid plugin (versions up to and including 1.11.8). The vulnerability is an authorization bypass in the function get_ajax_statistics (located at ~/lib/class-sendgrid-statistics.php) that can be exploited by an authenticated user to export statistics for the...
WordPress 访问控制错误漏洞
WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on PHP and MySQL servers. WordPress SendGrid plugin version 1.11.8 and earlier is vulnerable to an access control error, which stems fro...
PT-2021-20596 · Sendgrid · Wordpress Sender Plugin
Name of the Vulnerable Software and Affected Versions: SendGrid WordPress plugin versions up to and including 1.11.8 Description: The issue allows authenticated users to bypass authorization and export statistics for a WordPress multi-site main site. This is possible due to a vulnerability in the...
SendGrid <= 1.11.8 - Authenticated Authorization Bypass
The plugin is vulnerable to authorization bypass via the getajaxstatistics function found in the /lib/class-sendgrid-statistics.php file which allows authenticated users to export statistics for a WordPress multi-site main site in versions up to 1.11.8. This vulnerability only affects the main si...
SendGrid <= 1.11.8 - Authenticated Authorization Bypass
The plugin is vulnerable to authorization bypass via the getajaxstatistics function found in the /lib/class-sendgrid-statistics.php file which allows authenticated users to export statistics for a WordPress multi-site main site in versions up to 1.11.8. This vulnerability only affects the main si...