15693 matches found
VK.com: Монипулирование на страницах пользоватлей значением "Подсказывать стикеры в полях ввода"
Отсутствовал hash в запросах при изменении настроек стикеров. Ошибочка в репорте включить на конце 1 Включить https://m.vk.com/attachments?ajax=1&act=stickershintsenabled&value=1 CSRF - ОТСУСТВИЕ HASH дает возможность совершать переключение в мобильной версии ВК , подсказок в полях ввода ! Тем...
Hiro: Weak crossdomain.xml
The e-mail list management service used by Blockstack operated by MailChimp has a lenient cross-domain flash policy -- this is not a vulnerability, however, the crossdomain.xml used by the mailing service is more lenient than used by normal web services...
Rockstar Games: dom based xss in http://www.rockstargames.com/GTAOnline/ (Fix bypass)
The researcher was able to bypass a previous fix for a DOM-Based XSS vulnerability 254343 by hashing part of the payload. This showed that our previous fix was insufficient, so we updated it to a more thorough solution...
Automattic: SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processing
Summary FFmpeg is a video encoding software that appears to be used by wordpress.com for video processing for paid accounts. FFmpeg is known to process HLS playlists that may contain references to external files. I was able to fire this feature using GAB2 subtitle chunks inside an AVI file. After...
HackerOne: Insecure SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com
Hello, I just found some minor issue with RSA 2048 bits SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com thru Qualys SSL Labs and wanted to report it. Proof of Concept https://www.ssllabs.com/ssltest/analyze.html?d=b5s.hackerone-ext-content.com Result: SHA1withRSA...
Weblate: Incorrect HTTPS Certificate
Weblate appears to have a public facing git repository located at git.weblate.org that utilises HTTPS when viewed in the browser. As a side note, netcat to port 80 results in the default debian landing page. 77.78.107.252 - git.weblate.org The site has an incorrectly configured certificate, and...
HackerOne: Subdomain takeover #4 at info.hacker.one
Summary: Hi team, looking the last fix released from unbounce team at https://hackerone.com/reports/217358 i've been able to bypass it and takeover the subdomain info.hacker.one with a new vulnerable ENDPOINT + PARAM COMBINATION at UnbouncePages App Actual Dns Entry: F174718 Reproduction Steps fo...
Internet Bug Bounty: CVE-2017-5482 The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print().
Reported to the project maintainers in 2016. Regardless of CVE-2016-8575 q933print still could overread the buffer trying to parse a short packet. Fixed by https://github.com/the-tcpdump-group/tcpdump/commit/c39c1d99ac3b6d5d9519b39da6717180651650d3...
Zomato: Unauthorised Access to Anyone's User Account
When we do Login with Facebook on the Zomato app, you're doing zero authentication of the user. I'm able to hack into the targeted user's accounts by just using the Facebook ID. Affected API raw request: POST...
Uber: Reflected XSS in lert.uber.com
Due to a lack of input validation from the search field on lert.uber.com, it was possible to obtain a Reflected XSS from the URL path, e.g. https://lert.uber.com/s/search/All/Home"PAYLOAD. Thanks, @hussain0x3c!...
PortSwigger Web Security: Order-phishing via Payment ID URL
Hello. I discovered the endpoint, which allows the attacker conduct the fishing attack to other users and they can pay for attacker's order. Why this can happen? On the site, order id parameter sends to the https://portswigger.net/CCPayment.aspx as POST, but attacker can append it as GET and it...
LocalTapiola: SQL Injection /webApp/oma_conf ctx parameter (viestinta.lahitapiola.fi)
Vulnerable script: /webApp/omaconf Vulnerable parameter: ctxvarsemail Database: PostgreSQL PoC http POST /webApp/omaconf HTTP/1.1 Host: viestinta.lahitapiola.fi Content-Type: application/x-www-form-urlencoded Content-Length: 1131...
Bumble: Unvalidated redirect on team.badoo.com
Domain affected: https://team.badoo.com/ corp.badoo.com PoC Tested on Firefox: https://team.badoo.com/%0d%0adata:text/html;text,%3Csvg%2fonload%3Dprompt%281%29%3E F129735 Describe: team.badoo.com may vulnerable to CRLF injection, when we inject %0d%0a into url, the Location header, entire content...
Nextcloud: Bypass permissions
@secator reported some permission related issues in Nextcloud Server to us. On request of the reporter the issue has only been disclosed limitedly...
Nextcloud: Server side request forgery (SSRF) on nextcloud implementation.
An admin of nextcloud server can add other trusted nextcloud server in his own installation. The following request passes when a new add request is processed: http POST /nextcloud/index.php/apps/federation/trusted-servers HTTP/1.1 Host: myown.nextcloudserver.com User-Agent: Mozilla/5.0 Macintosh;...
Nextcloud: failure to invalidate session on password change
Steps to reproduce 1. Login as user1 in firefox browser 2. Go to http://localhost/nextcloud/index.php/settings/personal 3. Go to other browser chrome and login as user1 4. Change the password in chrome Observe that the session in firefox still works...
Pornhub: Weak user aunthentication on mobile application - I just broken userKey secret password
The researcher discovered a hard coded authentication bypass on the mobile app...
Internet Bug Bounty: Adobe Flash Player Race Condition Vulnerability
Adobe Flash Player is prone to a race condition vulnerability which leads to Use After Free. COM Object will be initialized twice and uninitialized when the count number decrement to zero by the main thread. As we could force the second initialization being called by a Worker thread, the...
Bime: XXE in the Connector Designer
A XML External Entity XXE vulnerability allowed an attacker to read arbitrary files on the server...
Informatica: [rev-app.informatica.com] - XXE via SAML
Request: POST /sso HTTP/1.1 Host: rev-app.informatica.com Connection: keep-alive Content-Length: 8669 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Origin: https://infapassport.okta.com Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5....
Coinbase: SPF records not found
There is no TXT record in DNS zone that defines Sender Policy Framework entry for domain api.coinbase.com. These are the best practices and need to be configure in DNS records to protect your mail servers. using SPF records will help in spam filtering as SPF records does helps in verifying the...
Shopify: [www.*.myshopify.com] CRLF Injection
CRLF Injection via Request-URI PoC: http://www.myshopify.com/xxcrlftest%0aSet-Cookie:test=test3;domain=.myshopify.com; https://www.blackfan.myshopify.com/xxx%0aSet-Cookie:test=test2;domain=.myshopify.com; HTTP Response: HTTP/1.1 302 Moved Temporarily ... Location: http://myshopify.com/xxcrlftest...
Envoy: [dashboard.signwithenvoy.com] Open Redirect
Open redirect via Request-URI PoC: https://dashboard.signwithenvoy.com//www.google.com/%2e%2e%2f HTTP Response: HTTP/1.1 303 See Other ... Location: //www.google.com/%2e%2e%2f/...
Coinbase: Two-factor authentication (via SMS)
Hello Coinbase Security Team I just found a problem in Two-factor authentication mechanism, here is the details and how to reproduce this issue: I have two accounts with two emails on coinbase.com i active 2FA on the both of two emails with this phone number +201066462288. From Chrome i will try ...
Concrete CMS: FULL PATH DISCLOSUR
Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...
Node.js: Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`
A flaw in Node.js Permission Model enforcement was discovered that allowed traceevents.createTracing.enable to write trace logs outside of the --allow-fs-write setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x...
curl: mbedTLS / wolfSSL / rustls backends silently skip hostname verification when CURLOPT_SSL_VERIFYPEER=0
Summary When an application sets CURLOPTSSLVERIFYPEER=0 while keeping CURLOPTSSLVERIFYHOST=2 the default, the mbedTLS, wolfSSL, and rustls TLS backends silently skip the hostname-vs-certificate check. The OpenSSL, GnuTLS, and Schannel backends correctly preserve hostname checking under the same...
Node.js: Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions
Summary The March 2026 security release patched CVE-2026-21637 by wrapping SNICallback, ALPNCallback, and pskCallback invocations in try/catch blocks inside lib/internal/tls/wrap.js. That fix is present in v26.3.0. However, two other TLS callback paths in the same file were left unprotected: 1...
Node.js: NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset
Summary: A 19-byte malformed SQLite changeset passed to Node.js node:sqlite DatabaseSyncapplyChangeset causes a native NULL pointer dereference and terminates the Node.js process. Description: The built-in Node.js node:sqlite API exposes DatabaseSyncapplyChangesetchangeset, options, which accepts...
curl: CVE-2026-6429: netrc credential leak with reused proxy connection
Summary: libcurl can leak .netrc-derived host Authorization credentials across redirected hosts when an HTTP proxy connection is reused. In the PoC, .netrc contains credentials only for a.test, but after a.test redirects to b.test and then c.test over the same keep-alive proxy connection, libcurl...
curl: CVE-2026-6276: stale custom cookie host causes cookie leak
Summary: libcurl keeps a stale data-state.aptr.cookiehost after a request that uses a custom Host: header. On later requests on the same easy handle, when no custom Host: is used, libcurl still reuses that stale value for outgoing cookie selection lib/http.c:2560-2563 and incoming Set-Cookie...
curl: HSTS accepted from HTTP origin behind HTTPS proxy
curl/libcurl appears to accept and persist Strict-Transport-Security from an http:// origin when the request is sent through an https:// proxy. After that, a later http:// request for the same host is automatically upgraded to https:// due to stored HSTS state. Affected versions 8.12.0 through...
LY Corporation: page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token Compromise
An open redirect vulnerability was identified in page.line.me because redirect destinations were not properly restricted to trusted domains. This vulnerability could have been abused within an OAuth 2.0 authorization flow to cause the authorization response to be sent to an attacker-controlled...
curl: SMTP Command Injection Vulnerabilities in curl
Summary Successfully reproduced SMTP command injection vulnerabilities in curl that allow attackers to inject arbitrary SMTP commands by using carriage return and line feed characters \r\n in email addresses. Vulnerabilities Confirmed 1. MAIL FROM Injection Description: Injection via --mail-from...
Rocket.Chat: NoSQL injection leaks visitor token and livechat messages
The Rocket.Chat application was affected by two NoSQL injection vulnerabilities. The first vulnerability allowed leaking visitor tokens by exploiting the livechat:loginByToken method, while the second vulnerability enabled leaking livechat messages by exploiting the livechat:loadHistory method...
HackerOne: Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program
Vulnerability description not provided...
Basecamp: Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com
The vulnerability in the Navgraph system allowed any third-party app to send and read requests from the server at app.hey.com...
Hyperledger: Docker Secret Disclosure via GitHub Actions Cache Poisoning
The vulnerability involved the disclosure of Docker secrets through GitHub Actions cache poisoning. The issue was reported and subsequently resolved...
Node.js: Proxy-Authorization header not cleared on cross-origin redirect in undici.request
The Proxy-Authorization and x-auth-token headers were not cleared on cross-origin redirects in versions of undici up to and including 6.7.0. This issue was similar to a previously fixed security vulnerability where Authorization and Cookie headers were not cleared on such redirects...
Weblate: Information Disclosure
A vulnerability allowed API keys to be exposed in a PyPI package...
curl: Buffer overflow and affected url:-https://github.com/curl/curl/blob/master/docs/examples/hsts-preload.c
Vulnerability description not provided...
Internet Bug Bounty: Integrity checks according to policies can be circumvented in Node.js 20 and Node.js 18
Integrity checks according to Node.js policies can be circumvented, allowing untrusted code to execute with elevated permissions. This affects Node.js 18.x and 20.x when using the experimental policy feature. The vulnerability was reported by Tobias Nießen, who also provided a patch that has been...
Internet Bug Bounty: [CVE-2023-22799] Possible ReDoS based DoS vulnerability in GlobalID
A ReDoS-based DoS vulnerability was discovered in the GlobalID gem, affecting versions 0.2.1 and above. Crafted input could cause the regular expression engine to consume excessive processing time, leading to a denial of service. The issue has been fixed in version 1.0.1...
GitHub: Smuggling content in PR with refs/replace in GitHub
An incorrect comparison vulnerability was found in GitHub Enterprise Server, allowing commit smuggling through the display of an incorrect diff in the GitHub pull request UI. This vulnerability required write access to the repository and affected versions 3.7.0 and above. It was fixed in versions...
Sony: SQL Injection at https://████ via ███ parameter
Vulnerability description not provided...
HackerOne: Any one can view collaborater email address via path /reports/<id>/participants
The vulnerability allowed anyone to view the email address of collaborators invited to vulnerability reports through the program's API. Access to collaborator email addresses was not properly restricted...
Internet Bug Bounty: Authenticated but unauthorized users may enumerate Application names via the API
An information disclosure vulnerability existed in all versions of Argo CD starting with v0.5.0, allowing authenticated but unauthorized users to enumerate application names via API error messages. This could be used as a starting point for further attacks, such as social engineering. The...
curl: CVE-2023-28319: UAF in SSH sha256 fingerprint check
Vulnerability description not provided...
Nextcloud: Basic auth header on WebDAV requests is not bruteforce protected
A basic authentication bypass vulnerability was discovered on WebDAV requests, due to a lack of rate limit protection. Attackers could brute force the password and gain full account takeover. The vulnerability was reported and fixed...
U.S. Dept Of Defense: xss on reset password page
target:https://█████/Default.aspx?TabId=81&ctl=SendPassword&returnurl=%252fUOTSHelpDesk When a user goes on the forget password page and enters a username it is reflected onto the page. An attacker could simply enter a username like alert1 and it would execute an alert not to mention there is no...