15508 matches found
IRCCloud: Host Header is not validated resulting in Open Redirect
Please see the attached screenshot where I am sending a request to irccloud.com with an invalid HOST header and I am getting redirected to that domain. This is because the HOST header is not validated to ensure that the request is originating from that target host or not...
Yahoo!: From Unrestricted File Upload to Remote Command Execution
Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...
Concrete CMS: XSS in Theme Preview Tools File
https://github.com/concrete5/concrete5/blob/master/web/concrete/tools/themes/preview.phpL7 Note that one of those values near the end is not escaped...
8x8: @jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)
An unsafe nginx regex pattern was discovered in the /colibri-relay-ws/ location of the @jitsi/docker-jitsi-meet project. The regex a-zA-Z0-9-\.+ accepted arbitrary domain names and IP addresses for proxypass directives, allowing unauthenticated requests to be proxied to attacker-specified...
curl: Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN match
Hi all, Sorry to ruin anybody's day, but we've discovered another issue when it comes to dots. We've found a TLS certificate verification bypass that lets a trailing-dot IPv4 URL -- https://127.0.0.1./ -- pass peer authentication against a wildcard DNS SAN certificate such as DNS:.0.0.1. The IP...
curl: CVE-2026-6276: stale custom cookie host causes cookie leak
Summary: libcurl keeps a stale data-state.aptr.cookiehost after a request that uses a custom Host: header. On later requests on the same easy handle, when no custom Host: is used, libcurl still reuses that stale value for outgoing cookie selection lib/http.c:2560-2563 and incoming Set-Cookie...
curl: Cookie attribute TAB injection regression in Set-Cookie parsing
Overview | | | |---|---| | Component | lib/cookie.c — parsecookieheader | | Type | Security regression incomplete input validation | | CWE | CWE-20 Improper Input Validation | | Severity | LOW CVSS 3.1 estimated 3.7, comparable to CVE-2022-35252 | | Affected | curl 8.18.0 through current HEAD | |...
Monero: ZMQ RPC Log Injection and Untrusted Payload Persistence
A vulnerability was reported in the Monero CLI daemon where the ZMQ RPC request path logs untrusted request content before semantic validation. This allowed a remote party with access to the ZMQ endpoint to inject newline and control-character content into daemon logs, enabling log forging. The...
LY Corporation: page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token Compromise
An open redirect vulnerability was identified in page.line.me because redirect destinations were not properly restricted to trusted domains. This vulnerability could have been abused within an OAuth 2.0 authorization flow to cause the authorization response to be sent to an attacker-controlled...
AWS VDP: Amazon Kendra Intelligent Ranking Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints
The AWS Kendra Intelligent Ranking service was found to incorrectly report the user-agent and network information as "AWS Internal" for four API endpoints that are FIPS endpoints. This issue can lead to the obscuring of request information that may be used to track down an adversary...
curl: NULL dereference when encoding DN of x509 certificate
Vulnerability description not provided...
inDrive: Reflected XSS of media.indrive.com
Vulnerability description not provided...
HackerOne: Confirmed #2118458: Intentional redirect from www.hackerone.com to domain which is up for sale
The report describes an intentional redirect from www.hackerone.com to a domain that is currently for sale. The report states that the endpoint https://www.hackerone.com/node/9386 automatically redirects to https://www.iotna.com/, and that the domain iotna.com is currently up for sale...
Liberapay: Unsafe yaml load can lead to remote code execution
The YAML load function can lead to remote code execution vulnerability. The vulnerability allows the construction of arbitrary Python objects from untrusted YAML data, which can be exploited by an attacker...
HackerOne: Attachment disclosure via summary report
A critical vulnerability was discovered in the HackerOne platform that allowed an attacker to gain unauthorized access to attachments belonging to other users through the report summary editing functionality. By manipulating attachment IDs in the request, an attacker could view sensitive files th...
GoCD: XSS in GOCD Analytics Plugin
The vulnerability was discovered in the GOCD Analytics Plugin, specifically in the info-message.js file. The vulnerability allowed for Cross-Site Scripting XSS attacks by injecting malicious code through the ?msg= parameter. The vulnerable code failed to properly sanitize the user-supplied input,...
Internet Bug Bounty: Proxy-Authorization header is not cleared in cross-domain redirect in undici
Proxy-Authorization header not cleared on cross-origin redirect in Undici. Impacted versions = v6.0.0 = v6.6.0. Patched in v5.28.3 and v6.6.1. No known workarounds...
MTN Group: CVE-2010-1429 JBoss Insecure Storage of Sensitive Information on ips.mtn.co.ug
The JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allowed remote attackers to obtain sensitive information about deployed web contexts via a request to the status servlet, as demonstrated by a full=true query string. This issue was caused by a regression fr...
Nextcloud: Open redirect in user_saml via RelayState parameter
An open redirect vulnerability was reported in the usersaml authentication module of Nextcloud. The vulnerability allowed redirecting users to arbitrary URLs via the RelayState parameter...
Node.js: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
A vulnerability in Node.js HTTP servers was discovered that allowed denial of service DoS attacks. By sending specially crafted HTTP requests with chunked encoding, an attacker could cause resource exhaustion on the server. The lack of limitations on chunk extension bytes enabled the server to re...
Mozilla: Subdomain takeover on one of the subdomain under mozaws.net
Vulnerability description not provided...
Mozilla: Subdomain takeover on one of the subdomain under mozgcp.net
A subdomain takeover was reported on a subdomain under mozgcp.net due to a dangling DNS record that had been registered by researchers, allowing them to host content under the subdomain...
HackerOne: Able to see Bonus amount given to a report even if the bounty and Bonus is not visible to public or mentioned in {Report-Id}.json
A vulnerability allowed users to see the bonus amount given to a report, even if the bounty and bonus were not visible to the public or mentioned in the report's JSON file. This resulted in the exposure of confidential information...
Internet Bug Bounty: unsanitized input goes to regex function leads to ReDos that make request hangs
An authenticated user could exploit a vulnerability in Apache Airflow versions prior to 2.6.3 by providing crafted input, causing the current request to hang...
Nextcloud: Issuer not verified from obtained token in user_oidc
The issuer verification in the useroidc app of Nextcloud did not properly validate the issuer of the obtained token, potentially allowing for a Man-in-the-Middle attack...
Yelp: yelp.com XSS ATO (via login keylogger, link Google account)
The summary is as follows: The yelp.com website was found to be vulnerable to a cross-site scripting XSS attack. The vulnerability was caused by the website's improper handling of the "guvo" cookie, which was reflected in the HTML response without proper sanitization. Additionally, a feature on t...
Node.js: node.js process aborts when processing x509 certs with invalid public key information
A vulnerability existed in Node.js versions 18.14.2 and 19.7.0 that allowed malicious actors to cause a denial-of-service DoS by providing x509 certificates with invalid public key information. This vulnerability could lead to the termination of the Node.js process, resulting in interruptions to...
AMBER AI: Open redirect that can lead to malicious websites
go to a picture in website inspect that picture and you can see a tag change the tag with the command it will redirect !! kindly watch the POC attaching to it Impact redirect to any malicious web sites may have a chance for account takeover...
Yelp: Public Github Repo Leaking Internal Credentials
Summary: In Github I found some credentials to use in a mesos.apache.org Github: https://github.com/Yelp/Tron/blob/master/yelppackage/itestdockerfiles/mesos/mesos-secrets https://github.com/Yelp/Tron/blob/master/yelppackage/itestdockerfiles/mesos/mesos-slave-secret POC ss F2021070 F2021071 Login...
TikTok: Business Suite "Get Leads" Resulting in Revealing User Email & Phone
A vulnerability within the Business Suite settings on an Android device could have resulted in a user's email and/or phone number being revealed via the "secuserid" parameter if their information is sent via "Get Leads". We thank @datph4m for reporting this to our team...
GitHub Security Lab: Golang : Hardcoded secret used for signing JWT
This bug was reported directly to GitHub Security Lab...
Reddit: Misconfigurated login page able to lock login action for any account without user interaction
Summary While observing a few things about the login feature, I found that the account was locked after a certain number of requests. Although this feature is actually added to prevent problems such as rate limit, it is open to account lock attacks by attackers. PoC 1. Save this code as exploit.p...
GitHub Security Lab: [Java]: Flow sources and steps for JMS and RabbitMQ
This bug was reported directly to GitHub Security Lab...
Acronis: Session Fixation on Acronis
Hi there, The application does not set a new Session ID in the cookie after what appears to be an authentication attempt by the user. If this was a successful login and the Session IDs are stored in cookies then this application is affected by Session Fixation vulnerability. Steps To Reproduce...
Recorded Future: Dom Xss vulnerability
Summary: Dom Xss vulnerability Steps To Reproduce: add details for how we can reproduce the issue 1. Go to this link: https://api.recordedfuture.com/index.html 2. Open chrome devtool and go to console tab 3. Type: document.write'...alert1...'; 4. And boom! Alert 1! Impact XSS can have huge...
Evernote: [34.96.80.155] Server Logs Disclosure lead to Information Leakage
Summary: In this case server log is available for any in /server-status Steps To Reproduce: 1. Go to https://34.96.80.155/server-status/ and follow attack scenario's Attack Scenario's: Serg.io 1. User go to server and enter sensitive info that can be logged example : http://host/login?privatekey=...
GitHub Security Lab: [Java] CWE-552: Unsafe url forward
This bug was reported directly to GitHub Security Lab...
Concrete CMS: SSRF mitigation bypass using DNS Rebind attack
We noticed that the upload functionality contains the ability to upload files from remote server, however there are some mitigations against accessing the AWS Instance Metadata service. We've managed to bypass these mitigations using DNS rebinding and we've managed to fetch the AWS IAM keys when...
Mail.ru: Subdomain Takeover
Hi team, Actually team this bug is similar to my previous bug which I submitted-██████ Issue details:- Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker...
Nextcloud: objectId in share location can be set to open arbitrary URL or Deeplinks
Summary: The NextCloud Talk app allows a user to share their location in the Mobile App. The objectId= in /ocs/v2.php/apps/spreed/api/v1/chat/$token/share Can be set to a URL or Deeplink, While the metaData= will render the map, Once a user clicked the map it will open the defined URL or Deeplink...
U.S. Dept Of Defense: RCE on ███████ [CVE-2021-26084]
A remote code execution vulnerability was present in affected versions of Confluence Server and Data Center due to an OGNL injection issue. This allowed an authenticated user, and in some cases an unauthenticated user, to execute arbitrary code. The vulnerability affected versions before 6.13.23,...
GitLab: Stored XSS in markdown via the DesignReferenceFilter
Summary When rendering markdown, links to designs are parsed using the following linkreferencepattern: https://gitlab.com/gitlab-org/gitlab/-/blob/v13.12.1-ee/app/models/designmanagement/design.rbL168 ruby def self.linkreferencepattern @linkreferencepattern ||= begin pathsegment =...
Reddit: Vulnerability Name: URL Redirection / Unvalidate Open Redirect
Summary: visit this URL it will redirect you to http://bing.com. https://reviewnic.com/redirect.php?url=http://bing.com. Note: Attacker could change http://bing.com to http://evilsite-of-attacker.com and hence can steal user credentials. Impact: URL Redirection or Invalidate Open Redirect are...
Nextcloud: Leak arbitrary file under nextcloud android client privacy directory
Steps to reproduce: 1.install and login nextcloud android client 2.create a directory and set it 'shareable' 3.install the poc app "setresultcontactphotocrop" key code: EvilActivity public class EvilActivity extends AppCompatActivity final static String PRIVATEURI =...
HackerOne: Hackers can find out the ID of private programs
Summary: Hi team, Our team noticed that it is possible to find out the IDs of sandbox programs. This allows us to create a list, thereby determining that the rest of the list of IDs will belong to private programs or public or external programdirectory listing. But by removing ID all public and...
Mail.ru: Stored xss in calendar via call link
Call link URI schema in calendar.mail.ru web application was filtered improperly, allowing malicious javascript: links...
U.S. Dept Of Defense: Reflected XSS on https://█████
Summary: Reflected xss can use to steal user information because it is coming from trusted website. an user can easily trust it and attacker can easily steal user information Steps To Reproduce: 1. go to https://████?profileid=%22%3E%3C/script%3E%3Cscript%3Ealert%27xss%27%3C/script%3E 2. you will...
Concrete CMS: Stored unauth XSS in calendar event via CSRF
crayons Description The description parameter in the scenario /index.php/ccm/calendar/dialogs/event/add/save is affected by Stored XSS due to lack of user supplied data filtration. Also in should be mentioned that this endpoint does not verify CSRF token ccmtoken, which leads to an ability to...