ZEIT: Open Redirect on Gitllab Oauth leading to Acount Takeover

Summary: When an Open Redirect is used in a phishing attack, the victim receives an email that looks legitimate with a link that points to a correct and expected domain. What the victim may not notice, is that in the middle of a long URL there are parameters that manipulate and change where the...

ZEIT: Open redirection in https://zeit.co/login?next=

you have a open redirection bug in https://zeit.co/login?next= now i want to redirect the victem to https://www.google.com https://zeit.co/login?next=\www.google.com done !! it will redirected F511594 Impact redirect the victems to any page and it can be xss bug...

ZEIT: Open redirect vuln on login

Summary: An attacker can redirect vicitm on an external website using https://zeit.co/login endpoint because next parameter Steps To Reproduce: add details for how we can reproduce the issue 1 .Go To https://zeit.co and login there 2 .after login go to...

ZEIT: Stored Cross-site scripting

Stored Cross-site Scripting in https://zeit.co the steps in the video Impact steal an accounts cookies and more...

ZEIT: Gitlab Oauth Misconfiguration Lead To Account Takeover

Summary: Hello I found that you did not specify which link to redirect with Token Gitlab Allowing the attacker to exploit this vulnerability to force the user to redirect his Gitlab Token To the attacker's site , And Take Over The Account of user Steps To Reproduce: 1. Access To...

CVE-2018-6184

ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /next request namespace...

CVE-2018-6184

ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /next request namespace...

Directory traversal

ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /next request namespace...

CVE-2018-6184

ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /next request namespace...

CVE-2018-6184

Zeit Next.js 4.x before 4.2.3 is vulnerable to a directory traversal via the /_next request namespace. The connected templates describe Local File Inclusion/LFI exposure, allowing an attacker to read sensitive files and potentially modify data or perform administrative actions within the affected...

zeit-raum.de XSS vulnerability

Open Bug Bounty ID: OBB-531154 Description| Value ---|--- Affected Website:| zeit-raum.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ZEIT Next.js Directory Traversal Vulnerability

Next.js is a minimalist server-side rendering framework for React applications. A directory traversal vulnerability exists in ZEIT Next.js versions prior to 2.4.1 under the /next and /static request namespaces. An attacker can exploit this vulnerability to obtain sensitive information...

Directory traversal

ZEIT Next.js before 2.4.1 has directory traversal under the /next and /static request namespace, allowing attackers to obtain sensitive information...

CVE-2017-16877

ZEIT Next.js before 2.4.1 has directory traversal under the /next and /static request namespace, allowing attackers to obtain sensitive information...

CVE-2017-16877

ZEIT Next.js before 2.4.1 has directory traversal under the /next and /static request namespace, allowing attackers to obtain sensitive information...

CVE-2017-16877

CVE-2017-16877 affects ZEIT/Next.js versions prior to 2.4.1. Multiple connected sources describe a directory traversal flaw in the "/_next" and "/static" namespaces that can allow an attacker to obtain sensitive information from the server. The issue is categorized with high severity in several f...

apollo.zeit.de Open Redirect vulnerability

Open Bug Bounty ID: OBB-326096 Description| Value ---|--- Affected Website:| apollo.zeit.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

ranking.zeit.de XSS vulnerability

Vulnerable URL: http://ranking.zeit.de/che2016/en/irgendwasmit/ergebnis?begriff=1=%3Csvg/onload=alert'OPENBUGBOUNTY'%3E// Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 12:29 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclos...

ZEIT AUDIO - Customized SSL, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application ZEIT AUDIO published at the 'play' market has multiple vulnerabilities...

DIE ZEIT E-Paper App - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application DIE ZEIT E-Paper App published at the 'play' market has multiple vulnerabilities...