15512 matches found
VK.com: Missing Server Side Rate Limiting can Lead to VK Account Take over
Insufficient flood control...
Internet Bug Bounty: libtiff 4.0.6 segfault / read outside of buffer (CVE-2016-9297)
segfault and read outside of buffer in libtiff 4.0.6 and possibly earlier. This library is baked into web browsers used by millions and also devices like the PlayStation Portable and the iPhone. http://bugzilla.maptools.org/showbug.cgi?id=2590 Reported to the vendor on 7 November 2016: ASAN:SIGSE...
Udemy: Completed Compromise & Source Code Disclosure via Exposed Jenkins Dashboard at https://jenkins101.udemy.com
Howdy, @udemy! Summary: ======= I am writing to inform you of a critical information disclosure bug via an exposed Jenkins dashboard located at https://jenkins101.udemy.com. Upon navigating to this address, I was asked to authenticate with my Github account. After authenticating, I was surprised ...
LocalTapiola: SQL Injection /webApp/oma_conf ctx parameter (viestinta.lahitapiola.fi)
Vulnerable script: /webApp/omaconf Vulnerable parameter: ctxvarsemail Database: PostgreSQL PoC http POST /webApp/omaconf HTTP/1.1 Host: viestinta.lahitapiola.fi Content-Type: application/x-www-form-urlencoded Content-Length: 1131...
Reverb.com: IDOR - Ability to view unlisted products
Hi All, I believe I've found a vulnerability on your sandbox site which allows attackers to view the details of listings that are unpublished. Description While creating a product, I noticed there is a call to https://sandbox.reverb.com/api/listings/65905/productbundle which returns json details...
Nextcloud: Bypass permissions
@secator reported some permission related issues in Nextcloud Server to us. On request of the reporter the issue has only been disclosed limitedly...
Internet Bug Bounty: urllib HTTP header injection CVE-2016-5699
https://bugs.python.org/issue22928 https://access.redhat.com/security/cve/cve-2016-5699...
Instacart: WordPress Authentication Denial of Service
Hi, I found out that you are using WordPress version 4.5.3. Researchers found out 5 days ago, that this version has a vulnerability, a Path traversal in WordPress Core Ajax handlers. Intro WordPress is web software that can be used to create a website, blog, or app. A path traversal vulnerability...
Uber: User Enumeration and Information Disclosure
Vulnerability Name: User Enumeration and Information Disclosure Description: It was possible to enumerate users for SquareSpace admin console in uber-movement. Please find below details of users enumerated: 1. [email protected] 2. [email protected] Information Disclosure in...
Internet Bug Bounty: CVE-2016-2177 Undefined pointer arithmetic in SSL code
1.0.2 version here: https://github.com/openssl/openssl/commit/a004e72b95835136d3f1ea90517f706c24c03da7 1.0.1 version here: https://github.com/openssl/openssl/commit/6f35f6deb5ca7daebe289f86477e061ce3ee5f46 These will get listed in the next security advisory and rolled up in the next release...
Uber: Self-XSS on partners.uber.com
Hi, I found a reflected XSS vulnerability in password reset page https://partners.uber.com/reset-password. I have tested this vulnerability in the latest Chrome and Firefox browsers. Reproduction Steps: 1- Go to https://login.uber.com/forgot-password and reset password. Then, Click password reset...
Uber: User credentials are not strong on vault.uber.com
I was just trying to login vault.uber.com I entered email xx and password xx, I got loggedin to someones account. I entered email zz and password zz, I got loggedin to someones account. It means passowrd complexity and length of username/email is not enforced. This allowed my to access the someon...
Uber: Dom Based Xss
Hi. found dom xss on this subdomain eng.uber.com. you are using a vulnerable plugin prettyPhoto.. This XSS will work in Firefox,Chrome - Google and IE last version ! And this is very dangerous! POC Firefox vector http://eng.uber.com/prettyPhotoi/x,/x POC Google and IE...
GlassWire: DLL Hijacking Vulnerability in GlassWireSetup.exe
GlasswireSetup.exe is subject to the attack described here: http://textslashplain.com/2015/12/18/dll-hijacking-just-wont-die/ You can get a simple demo with this harmless DLL: https://bayden.com/dl/shfolder.dll See attached image for proof of execution...
Coinbase: HTML injection in apps user review
just watch this video https://www.dropbox.com/s/360cytluyiw2ym9/HTMLI.mp4?dl=0 this about full fake login exploit https://www.youtube.com/watch?v=5iRylyJTzWc...
Radancy: RC4 cipher suites detected
A group of researchers Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering and Jacob Schuldt have found new attacks against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used. The attacks arise from statistical fla...
Radancy: Version Disclosure (NginX)
Hi, I found a version disclosure Nginx in the your web server's HTTP response. Extracted Version: 1.8.0 This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Nginx. Impact An attacker...
Mail.ru: XSS at af.attachmail.ru
XSS via attached SVG on sandbox domain af.attachmail.ru. xss via .svg file, working into UC BROWSER MINI only. Video poc: https://www.youtube.com/watch?v=E5akSwOXaKs&feature=youtu.be...
Gratipay: DKIM records not present, Email Hijacking is possible
Your SPF record is v=spf1 include:email.freshdesk.com include:spf.mandrillapp.com include:spf.google.com -all Which very well shows that you don't want spoofed email to be sent from your domains, but you just forget one thing: DKIM DomainKeys Identified Mail is an important authentication mechani...
Ruby on Rails: Potential XSS on sanitize/Rails::Html::WhiteListSanitizer
Possible XSS vulnerability in rails-html-sanitizer There is a possible XSS vulnerability in the white list sanitizer in the rails-html-sanitizer gem. This vulnerability has been assigned the CVE identifier CVE-2015-7580. Versions Affected: All. Not affected: None. Fixed Versions: v1.0.3 Impact...
Mail.ru: XSS in ad.mail.ru
The XSS vulnerability is located here: https://ad.mail.ru/adi/3030 and is triggered by setting referer to: "alert0 The problem is that the referer is being loaded like so: html alert0 " I am aware that this is out of scope, but I am still reporting it since I just happened to spot it while lookin...
Adobe: Reflected Cross Site Scripting - 'puser' Parameter in login page
PoC URL:...
HackerOne: Improper way of validating a program
Hello HackerOne, I found out that it's easy to publish a program that isn't yours. January 20, 2015 I created a program named Puffer Bird and I leave the sandbox to prepare to launch the program. Then, I requested for a program review. January 21, 2014 at 1:08 AM I received an email from...
Vimeo: XSS on any site that includes the moogaloop flash player | deprecated embed code
The moogaloop flash player includes in most cases http://f.vimeocdn.com/p/flash/moogaloop/6.0.30/controllers/videoControllerProgressive.swf. In that flash file we can find functionality that looks into the SharedObject "com.conviva.livePass" for recently loaded swf-URLs under the key "lastSwfUrls...
X (Formerly Twitter): XSS platform.twitter.com
Since you have fixed a few problems with the FlashTransport on platform.twitter.com already, I though I would also take a look at the JavaScript around it. Problem URL: https://platform.twitter.com/widgets/hub.html Description: The mentioned page opens URLs send to it via postMessage or...
Internet Bug Bounty: Multiple issues in looking-glass software (aka from web to BGP injections)
During the month of May 2014 we performed an offensive security analysis, trying to find how hard would it be for a low-to-medium skilled attacker to disrupt the core of the Internet ie. achieve the largest possible impact at the lowest common layer, with minimal resource. This is a confidential...
OkCupid: XSS Vulnerability Found!
Good Day okcupid Security Team! i just want to report that i found a bug on your website. what i've found out is a xss vulnerability with the use of third party app facebook. at first i upload an image in facebook and name it as " then go to okcupid.com then i click upload image and i click the...
Yahoo!: XSS Vulnerability (my.yahoo.com)
Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...
curl: curl cross-origin HTTPS redirect reuses TLS client certificate for unintended second-origin mTLS authentication
Summary: When curl follows an HTTPS redirect to a different origin under normal -L / CURLOPTFOLLOWLOCATION behavior, it still presents the configured TLS client certificate to the redirected-to HTTPS server. This happens without --location-trusted / CURLOPTUNRESTRICTEDAUTH, even though curl alrea...
Monero: `check_reserve_proof` counts duplicate entries: one output can inflate `total`
A vulnerability was discovered in the checkreserveproof function in the Monero wallet software. The vulnerability allowed duplicate entries in the reserve proof, which could artificially inflate the reported total reserve amount without affecting the verification of individual entries. The issue...
GitHub: OAuth redirect uri validation bypass for :proxima_first_party_sync apps
A vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. The vulnerability was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. The vulnerability was reported through the GitHub Bug Bounty program...
curl: MQTT Protocol Packet Injection via Unchecked CONNACK Remaining Length
I'm not sure if this is a vulnerability or intended behavior, but I noticed that curl MQTT implementation accepts CONNACK packets with Remaining Length values greater than 2, which appears to violate the MQTT v3.1.1 specification. According to the MQTT spec, CONNACK packets should have a Remainin...
curl: libcurl: Improper Authentication State Management on Cross-Protocol Redirects
Following the recent advisory for CVE-2025-14524, I conducted an investigation into how libcurl manages OAuth2 credentials during complex redirect chains. I have confirmed that while the library successfully protects traditional user credentials, it fails to clear OAuth2 Bearer tokens in the same...
curl: Denial of Service (DoS) vulnerability in dedotdotify() URL path normalization
Summary A Denial of Service DoS vulnerability exists in the dedotdotify function in lib/urlapi.c that can cause excessive CPU consumption due to On² time complexity when processing URLs with malicious path patterns containing many ../ sequences. Affected Component - Component: libcurl URL API -...
curl: SMTP CRLF Injection in curl/libcurl via MAIL FROM/RCPT TO parameters
SMTP CRLF Injection Vulnerability in curl/libcurl Vulnerability ID: CURL-SMTP-CRLF-2024 CWE-93: Improper Neutralization of CRLF Sequences Executive Summary curl/libcurl contains a CRLF injection vulnerability in its SMTP implementation that allows attackers to inject arbitrary SMTP commands by...
curl: Disclosure of email addresses
https://github.com/curl/curl/blob/master/.mailmap Impact Summary: Disclosure of email addresses...
curl: Exploitable Format String Vulnerability in curl_mfprintf Function
Vulnerability description not provided...
Internet Bug Bounty: libcurl: freeing stack buffer during x509 certificate parsing
The libcurl's ASN1 parser had a vulnerability in the utf8asn1str function used for parsing an ASN.1 UTF-8 string. The function could detect an invalid field and return an error, which would trigger a free of a 4-byte local stack buffer. This could lead to a crash or potential memory corruption,...
Reddit: IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit user
Vulnerability description not provided...
curl: CVE-2024-6197: freeing stack buffer in utf8asn1str
The libcurl library at commit 04739054cdac5a0614fb94e3655e313c03399f35 contained an invalid invocation of the free function in the utf8asn1str function. The buffer being freed was located on the stack, which posed a security risk as the freed address could have been later returned by malloc calls...
Internet Bug Bounty: [CVE-2024-32464] ActionText ContentAttachment’s can Contain Unsanitized HTML
CVE-2024-32464 ActionText ContentAttachment's can Contain Unsanitized HTML Instances of ActionText::Attachable::ContentAttachment included within a richtextarea tag were discovered to potentially contain unsanitized HTML. This vulnerability was assigned the CVE identifier CVE-2024-32464. Versions...
Node.js: Proxy-Authorization header not cleared on cross-origin redirect in undici.request
The Proxy-Authorization and x-auth-token headers were not cleared on cross-origin redirects in versions of undici up to and including 6.7.0. This issue was similar to a previously fixed security vulnerability where Authorization and Cookie headers were not cleared on such redirects...
Node.js: Path traversal by monkey-patching Buffer internals
A path traversal vulnerability was introduced in the experimental permission model in Node.js 20 and 21 by monkey-patching Buffer internals. This allowed modification of the result of path.resolve, leading to traversal beyond the expected path...
U.S. Dept Of Defense: authentication bypass
An authentication bypass vulnerability was discovered in the login page of a web portal, allowing unauthorized access without providing valid credentials...
Mozilla: Stored Xss on bugzilla.mozilla.org via comment edit feature from non-admin to admin.
A stored XSS vulnerability was discovered on the comment edit feature of bugzilla.mozilla.org. This allowed an attacker to execute malicious JavaScript code when an admin attempted to edit a comment. The vulnerability was reported and a bug report was filed...
GitHub Security Lab: cpp: if (a+b>c) a=c-b is incorrect if a+b overflows
Vulnerability description not provided...
HackerOne: Asset Inventory Internal Descriptions are leaked in CSV export
An internal asset description in the Asset Inventory feature of HackerOne was leaked in the CSV export, potentially exposing sensitive information stored in the description...
Cloudflare Public Bug Bounty: Privilege escalation to root in Pages build image v2
Vulnerability description not provided...
Internet Bug Bounty: Privilege Esacalation at Apache Airflow 2.5.1
A vulnerability was found in Apache Airflow before version 2.6.0 that allowed local Linux users to access sensitive files, such as SSH private keys, owned by the account that operates Airflow. The issue was caused by Airflow setting log files to vulnerable privileges, allowing any Linux user on t...