15413 matches found
VLC (European Commission - DIGIT): Buffer overflow in libavi_plugin memmove() call
Summary: When parsing an invalid AVI file, a buffer overflow might occur. Description: The ReadFrame function in the avi.c file uses a variable iwidthbytes, which is obtained directly from the file. It is a signed integer. It does not do a strict check before the memory operationmemmove, memcpy,...
Internet Bug Bounty: heap buffer overflow in phar_detect_phar_fname_ext
The original report is here https://bugs.php.net/bug.php?id=77247 txt USEZENDALLOC=0 ./php-src-PHP-7.2.13/sapi/cli/php -r "vardumpnew Pharfilegetcontents'poc.phar',0,'test.phar';" txt ================================================================= ==44888==ERROR: AddressSanitizer:...
Zomato: [auth2.zomato.com] Reflected XSS at `oauth2/fallbacks/error` | ORY Hydra an OAuth 2.0 and OpenID Connect Provider
Heyy there, I have found a xss in auth2.zomato.com Full url:https://auth2.zomato.com/oauth2/fallbacks/error?error=xss&errordescription=xss&errorhint=xss Vulnerable Parameters: All available parameters are vulnerable XSS Payload: XSS Steps To Reproduce the xss Just copy paste and load this url in...
Internet Bug Bounty: Integer overflow leading to buffer overflow
There exists an integer overflow in Perlmysetenv @ util.c : 2070 2070: void PerlmysetenvpTHX const char nam, const char val ... 2166: const int nlen = strlennam; ... 2171: vlen = strlenval; 2172: newenv = charsafesysmallocnlen + vlen + 2 sizeofchar; Here in a 64 bit version of Perl, since the...
Vanilla: Vanilla Forums domGetImages getimagesize Unserialize Remote Code Execution Vulnerability (critical)
Summary: An unauthenticated attacker can inject an serialized payload into a phar archive and trigger read access to it via an unprotected getimagesize. The attacker can leverage this to deserialize untrusted data and gain remote code execution. Notes: - THIS BUG IS UNAUTHENTICATED, however you...
Node.js third-party modules: Prototype pollution attack (mixin-deep)
As discussed in 309391, here's the separate report for each of the library. This one is the information for the mixin-deep library. Module: mixin-deep Summary: Utilities function in all the listed modules can be tricked into modify the prototype of "Object" when the attacker control part of the...
Semrush: CORS (Cross-Origin Resource Sharing)
Affected URL: https://ta.semrush.com/version/ Description: The application implements an HTML5 cross-origin resource sharing CORS policy for this request which allows access from any domain. Allowing access from all domains means that any domain can perform two-way interaction with the applicatio...
LocalTapiola: Secure Client-Initiated Renegotiation
Renegotiation can open the door to attacks. There are two primary worries: CVE-2009-3555: This vulnerability allows a “man-in-the-middle” attacker to inject data into an HTTPS session and execute requests on behalf of the victim. Refer to CVE-2009-3555 for more details. Denial of Service DoS:...
Node.js third-party modules: [augustine] Static Web Server Directory Traversal via Crafted GET Request
Hi, A crafted GET request can be leveraged to traverse the directory structure of a host using the augustine web server package, and request arbitrary files outside of the specified web root. Module specification Name: augustine Version: 0.2.3 latest release build Verified conditions Test server:...
Bitwarden: Vulnerable exported broadcast receiver
Good evening, This is actually in your code base this time. : Since the following broadcast receiver has export=true it can be exploited by 3rd parties. Vulnerability com.x8bit.bitwarden.PackageReplacedReceiver has exported set to true making the receiver vulnerable to tampering. F238236 POC I wa...
Legal Robot: Update any profile
A security researcher discovered that profile fields first name, last name, title, company, bio could be modified by another authenticated user, if the other user had access to the victim's randomly generated user id. Thanks to @samczsun for an excellent and detailed report!...
Internet Bug Bounty: PHP WDDX Deserialization Heap OOB Read in timelib_meridian()
Description: While deserializing an invalid dateTime value, wddxdeserialize would result in a heap out-of-bounds read in timelibmeridian. As wddxdeserialize is exposed to network data, and sometimes echo the results back to client, this issue could potentially allow remote peeking of the process...
WakaTime: Running 2 accounts with a single email
Hi, While testing, I found a logic flaw which made me to make two accounts with a single email Reproduction Steps 1-Create one account with [email protected] 2-another with [email protected] or [email protected] etc 3-Emails of both accounts will come at [email protected] fix: Dont allow "+" in emails. Thank...
Shopify: Stored XSS in *.myshopify.com
Hello, First of all in noticed that this is out of scope "Any issue related to the storefront area being displayed in a element in the admin area, for example in the Theme Editor." This is not in the store front and this will be set in an XSS payload. 1. Go to https://YOUR...
Yelp: Verification of email addresses possible through https://www.yelp.com/signup/facebook
Hi, There is an issue with the https://www.yelp.com/signup/facebook endpoint which allows an attacker to validate whether a specific email address is registered on Yelp. There seems to be no rate limit nor a validation for already used CSRF tokens. Steps to reproduce: 1. Go to...
Nextcloud: Bypassing quota limit
Hi an user can upload files despite having a limited quota by changing value of "OC-Total-Length" in header to "A" or adding "X-Expected-Entity-Length" in header with "A" value in normal insuffisant storage we have: PUT /remote.php/webdav/a.jpg HTTP/1.1 Content-Type: application/octet-stream...
OLX: Reflected XSS in www.olx.ph
Summary === The www.olx.ph domain is vulnerable to reflected XSS through the search function. Proof of concept === The following URL contains a harmless XSS vector, which causes an alert box to appear...
Internet Bug Bounty: Padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
Advisory: https://www.openssl.org/news/secadv/20160503.txt Writeup Referencing a proof of concept: http://web-in-security.blogspot.de/2016/05/curious-padding-oracle-in-openssl-cve.html...
Gratipay: X-Content-Type Header Missing For aspen.io
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared...
Zendesk: [CRITICAL] HTML injection issue leading to account take over
Hi , I have found an HTML injection issue in https://.zendesk.com/people/tags that could lead to account take over. I can't get malicious scripts executed , but an attacker can take over the admin's account by injecting the following HTML code. html CLICK HERE the data-method attribute is not...
AWS VDP: Non-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
The vulnerability allows adversaries to silently enumerate permissions of compromised AWS credentials for the CloudWatch service without generating logs in CloudTrail. Two non-production API endpoints were identified that can be accessed with standard IAM credentials but do not log the activity...
Internet Bug Bounty: important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)
important: Apache HTTP Server: SSRF with modrewrite in server/vhost context on Windows CVE-2024-40898 A vulnerability was reported in the Apache HTTP Server that allowed Server-Side Request Forgery SSRF in the server/vhost context on Windows systems with modrewrite enabled. This vulnerability was...
Basecamp: Account takeover via insecure intent handling
The Basecamp app was vulnerable to account takeover due to insecure intent handling. A malicious app installed on the same device could obtain the user's Oauth2 token and take over their account...
curl: CVE-2024-0853: OCSP verification bypass with TLS session reuse
A vulnerability was identified in cURL version 8.5.0 that allowed revoked certificates to be accepted when reusing a TLS session. The issue was caused by a correction that inadvertently skipped OCSP stapling verification during TLS session reuse. This allowed revoked certificates to be accepted i...
U.S. Dept Of Defense: Docker Registry without authentication leads to docker images download
An exposed Docker Registry HTTP API allowed attackers to download Docker images and potentially access confidential source code without authentication. The vulnerability was caused by a lack of access control on the registry and could have been mitigated by implementing proper access controls or...
Node.js: fs.openAsBlob() bypasses permission system
The fs.openAsBlob method in Node.js, when used with the --experimental-permission flag, allowed bypassing the permission system and reading files without the required permissions...
Internet Bug Bounty: CVE-2022-35260: .netrc parser out-of-bounds access
Original Report:https://hackerone.com/reports/1721098 Impact If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service...
curl: CVE-2022-42915: HTTP proxy double-free
This is a finding that Trail of Bits found in their ongoing curl security audit. Reported at a status meeting today. Summary: curl frees memory twice in some cleanup function related to HTTP proxies. It as simple as curl -x http://localhost:80 dict://127.0.0.1 Using valgrind on the current git...
GitLab: Remote Command Execution via Github import
Summary This is very similar to https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/Remote%20Command%20Execution%20via%20Github%20import and allows arbitrary redis commands to be injected when imported a GitHub repository. When importing a GitHub repo the...
Ruby: lib/net/ftp.rb: trusting PASV responses allow client abuse
When net/ftp performs a passive FTP transfer, it tries to using PASV. Passive mode is what net/ftp uses by default. A server response to a PASV command includes the IPv4 address and port number for the client to connect back to in order to perform the actual data transfer. This is how the FTP...
GitHub Security Lab: Java: CWE-346 Queries to detect remote source flow to CORS Headers
This bug was reported directly to GitHub Security Lab...
DuckDuckGo: Reflected/Stored XSS on duckduckgo.com
Hi DuckDuckGo, While browsing normally since I use DuckDuckGo on a daily basis, I discovered an interesting stored XSS on the duckduckgo main search engine. A payload that somebody had left on urbandictionary.com had triggered a HTML injection, and a stored XSS as a result. Steps to Reproduce 1...
HackerOne: "Bounty splitting enabled" can discloses if public VDPs are running private VRP
Hello Everyone, I hope all is safe and you're safe in this pandemic, and I hope this won't bother you like my previous submitions lol , Description : The "allowsprivatedisclosure" resource in team for private team that have a public profile is shown there which discloses that this program have a...
Concrete CMS: Authenticated path traversal to RCE
crayons Description The bFilename parameter in the scenario index.php/ccm/system/dialogs/block/design/submit is vulnerable to remote code execution via path traversal vulnerability. Authenticated attacker with rights to edit web application pages can upload malicious PNG file containing PHP code...
CS Money: Improper authentication in the load sell inventory page
Summary: Hello team, I found an endpoint response all data relate to sell mode inventory that doesn't have improper authentication in the link: https://cs.money/loadsellmodeinventory Steps To Reproduce: add details for how we can reproduce the issue 1. Open directly the link:...
Dropcontact: Idor for firstpromoter service
An IDOR has been detected on firstpromoter service...
Mail.ru: Public access to Sidekiq dashboard at shopper.sbermarket.ru
Anonymous access to Sidekiq process dashboard was available on shopper.sbermarket.ru...
Kubernetes: Node disk DOS by writing to container /etc/hosts
Report Submission Form Summary: Pod files /etc/hosts, /etc/hostname, /etc/resolve.conf are not readonly. A normal pod running in kubernetes cluster can kil a host through write data to /etc/hosts. Not only /etc/hosts, but also /etc/resolve.conf and /etc/hostname can do this. Kubernetes Version:...
Topcoder: Reflected XSS on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action
Summary: Hi : A reflected XSS occurs when creating bookmarks. Steps To Reproduce: A user can create bookmarks on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action. In this url redirect and url parameters are vulnerable to XSS. PoC:...
U.S. Dept Of Defense: Previously Compromised PulseSSL VPN Hosts
Hi again!! Back in 2019, I had reported that a pulseSSL VPN server owned by US DoD can be compromised by a publicly available exploit. The report is 681249. As a result, the userid and passwd db was also compromised. I found that at least 1 userid and password combination from that compromised db...
Internet Bug Bounty: Squid leaks previous content from reusable buffer
Summary: A malicious response to a FTP request can cause Squid to miscalculate the length of a string copying data past the terminating NULL. Due to Squid's memory pool the contents that is exposed could range from internal data, to other user's private Request/Response to Squid. This exist in...
Stripo Inc: XSRF Token is Not being validated when sending emails test request which lead to CSRF attack using the flash file + 307 redirect technique
XSRF Token is Not being validated when sending emails test request which lead to CSRF attack using the flash file + 307 redirect technique...
Vend VDP: Open Redirect in the Path of vendhq.com
Summary: There is an open redirection vulnerability in the path of https://www.vendhq.com/ Description: An attacker can redirect anyone to malicious sites. Steps To Reproduce: Type in this URL: https://www.vendhq.com//evil.com/ As, you can see it redirects to that website when you inject this...
ecobee: Open API - AWS S3 GET Bucket (List Objects) Version 1
Summary: AWS S3 GET Bucket List Objects Version 1 API accesible Steps To Reproduce: navigate to: https://www.ecobee.com/wp-content/uploads/ Observe that you get a listbucketresponse https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketGET.htmlRESTBucketGET-requests The truncated param is set...
ok.ru: Plain text password for 'unknown' user exist in URL when opening jira.apiok.ru
Documentation at https://api.mail.ru/docs/guides/billing/ has a link to http://apiok.ru/jira/documents/ which redirects to https://jira.apiok.ru/secure/CreateIssue.jspa?pid=-2&osusername=unknown&ospassword=X7:1OEh3 This pair of username & password - is effective login & password to JIRA system an...
ownCloud: Remote Code Execution through Deserialization Attack in OwnBackup app.
I found a deserialization vulnerability in the OwnBackup app, this vulnerability allows to execute remote code in the server. An administrator user could install the vulnerable app, or take advantage of this vulnerability if the OwnBackup application is installed. Below are the steps to properly...
Valve: Vulnerability in GoldSource Engine allows to upload and run an arbitrary DLL on client
Introduction Greetings. In GoldSource Engine there is a vulnerability that allows to run an arbitrary DLL on the client, using the flaws in the file downloading system. Description Part of the problem is hidden in the CLBatchResourceRequest function. This is a client function that is responsible...
Mail.ru: Cross site scripting vulnerability in JW Player SWF
Flash-based XSS in aw-xbox.my.com...
Internet Bug Bounty: Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c
This bug was reported to PHP last month and a fix was public last week:https://bugs.php.net/bug.php?id=76423 Heap OverFlow in exifthumbnailextract of exif.c This vulnerability can be triggered by exifreaddata in any 32-bit system. exif.c:2947: if ImageInfo-Thumbnail.offset +...