15580 matches found
Internet Bug Bounty: Race condition in workers may cause an exploitable double free by abusing bytearray.compress()
The issue occurs while sharing a bytearray between two workers. If one worker calls bytearray.compress while the other uses that bytearray, Flash does not correctly handle the race and may double free the array. Identified as CVE-2015-0312, and reported to Adobe via Chrome VRP:...
OkCupid: XSS Vulnerability Found!
Good Day okcupid Security Team! i just want to report that i found a bug on your website. what i've found out is a xss vulnerability with the use of third party app facebook. at first i upload an image in facebook and name it as " then go to okcupid.com then i click upload image and i click the...
HackerOne: Anti-MIME-Sniffing header X-Content-Type-Options header has not been set.
Hi, The following host "profile-photos-user-content.hackerone.com" does not set the x-content-type-options header to nosniff. If a malicious user is able to upload an image with script content Possible within the comments metadata Internet Explorer up till IE8 might render the content as Javascri...
Concrete CMS: FULL PATH DISCLOSUR
Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...
curl: CURLSHOPT_UNSHARE race can cause UAF in shared SSL session cache during HTTPS transfer
Summary CURLSHOPTUNSHARE can free a shared SSL session cache while another thread is starting a normal HTTPS transfer with the same share handle. The failing transfer reaches the cache through curleasyperform, during the OpenSSL handshake. libcurl appears to try to reject this kind of lifetime...
curl: Heap-OOB read in urlapi `redirect_url()` via `CURLU_GUESS_SCHEME` + `CURLU_NO_GUESS_SCHEME` flow
Hi all, We've found an issue in lib/urlapi.c where redirecturl reads past the end of a heap buffer when the source URL it operates on lacks a "scheme://" prefix. This is reachable through documented public APIs curlurlset when the caller mixes CURLUGUESSSCHEME with a subsequent CURLUNOGUESSSCHEME...
curl: rustls backend silently ignores CURLOPT_CRLFILE when native CA store is active
Hi all, When the rustls backend is configured to use the OS native CA store --ca-native / CURLSSLOPTNATIVECA, any CRL file supplied via --crlfile / CURLOPTCRLFILE is silently ignored. The option is accepted — CURLEOK from curleasysetopt, exit 0 from the command line — and revoked certificates pas...
curl: CVE-2026-7009: OCSP stapling bypass with Apple SecTrust
Summary When curl is built with --with-apple-sectrust or -DUSEAPPLESECTRUST=ON and OpenSSL, the --cert-status / CURLOPTSSLVERIFYSTATUS option is silently bypassed when Apple SecTrust handles certificate chain verification instead of OpenSSL. The user explicitly requests OCSP stapling enforcement,...
GitHub: OAuth redirect uri validation bypass for :proxima_first_party_sync apps
A vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. The vulnerability was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. The vulnerability was reported through the GitHub Bug Bounty program...
Basecamp: Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass
A vulnerability was discovered in Trix Editor version 2.1.16 that allowed for a Stored Cross-Site Scripting XSS attack. The vulnerability arose from an unsafe interaction between Trix's custom DOMPurify configuration and its document serialization logic. The issue was caused by Trix's use of the...
LY Corporation: page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token Compromise
An open redirect vulnerability was identified in page.line.me because redirect destinations were not properly restricted to trusted domains. This vulnerability could have been abused within an OAuth 2.0 authorization flow to cause the authorization response to be sent to an attacker-controlled...
curl: Exploitable Format String Vulnerability in curl_mfprintf Function
Vulnerability description not provided...
Internet Bug Bounty: [CVE-2024-47888] Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text
There is a possible ReDoS vulnerability in the plaintextforblockquotenode helper in Action Text. This vulnerability has been assigned the CVE identifier CVE-2024-47888. Carefully crafted text was found to cause the plaintextforblockquotenode helper to take an unexpected amount of time, possibly...
Internet Bug Bounty: libcurl: freeing stack buffer during x509 certificate parsing
The libcurl's ASN1 parser had a vulnerability in the utf8asn1str function used for parsing an ASN.1 UTF-8 string. The function could detect an invalid field and return an error, which would trigger a free of a 4-byte local stack buffer. This could lead to a crash or potential memory corruption,...
curl: CVE-2024-6197: freeing stack buffer in utf8asn1str
The libcurl library at commit 04739054cdac5a0614fb94e3655e313c03399f35 contained an invalid invocation of the free function in the utf8asn1str function. The buffer being freed was located on the stack, which posed a security risk as the freed address could have been later returned by malloc calls...
Basecamp: Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com
The vulnerability in the Navgraph system allowed any third-party app to send and read requests from the server at app.hey.com...
HackerOne: [ Spot Check ] Team members can edit a user's write-up
Team members could edit a user's spot check write-up. The write-up could be modified through a GraphQL request, even though there was no option to edit the write-up in the user interface. This was considered unintended functionality, as HackerOne had previously fixed vulnerabilities where team...
Node.js: Proxy-Authorization header not cleared on cross-origin redirect in undici.request
The Proxy-Authorization and x-auth-token headers were not cleared on cross-origin redirects in versions of undici up to and including 6.7.0. This issue was similar to a previously fixed security vulnerability where Authorization and Cookie headers were not cleared on such redirects...
HackerOne: Creation of bounties through Customer API leads to private email disclosure
The creation of bounties through the Customer API led to the disclosure of private email addresses. The vulnerability was demonstrated by using both the API and GraphQL requests to award a program bounty to a user, which then exposed the email address of that user in the response...
MTN Group: CVE-2010-1429 JBoss Insecure Storage of Sensitive Information on ips.mtn.co.ug
The JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allowed remote attackers to obtain sensitive information about deployed web contexts via a request to the status servlet, as demonstrated by a full=true query string. This issue was caused by a regression fr...
curl: Buffer overflow and affected url:-https://github.com/curl/curl/blob/master/docs/examples/hsts-preload.c
Vulnerability description not provided...
U.S. Dept Of Defense: User automatically logged in as Sys Admin user on https://███/Administration/Administration.aspx
A vulnerability was discovered where any user could be automatically logged in as a system administrator on a web application. This allowed unrestricted access and privileges could be abused to modify user privileges, add or delete users, and upload files, jeopardizing the integrity of the...
U.S. Dept Of Defense: authentication bypass
An authentication bypass vulnerability was discovered in the login page of a web portal, allowing unauthorized access without providing valid credentials...
Nextcloud: user_ldap app logs user passwords in the log file on level debug
User passwords were logged in Nextcloud application logs when using LDAP authentication and debug log level settings...
HackerOne: Register & create a ticket as somebody else on HackerOne Support
A vulnerability was discovered on HackerOne Support that allowed an attacker to register and create tickets as different individuals. The issue was resolved by adjusting a setting in the Freshdesk Software...
Reddit: Huge amount of Subdomains Takeovers at Reddit.com
Vulnerability description not provided...
Cloudflare Public Bug Bounty: Cloudflare CASB Confused Deputy Problem
A vulnerability was found in Cloudflare CASB on Microsoft and GitHub integrations, allowing an attacker to create a new integration and access sensitive information if they were able to enumerate a valid tenant UUID or domain. The issue was resolved by disallowing the creation of multiple...
Sony: SQL Injection at https://████ via ███ parameter
Vulnerability description not provided...
Internet Bug Bounty: Inadequate Encryption Strength in nodejs-current reads openssl.cnf from /home/iojs/build/... upon startup on MacOS
A cryptographic vulnerability was found in nodejs-current that allowed openssl.cnf to be read from an insecure location upon startup on MacOS, potentially exposing encryption keys or certificates...
Uber: Complete Admin account takeover due to PhpDebugBar turned on in Uber's production server
A security vulnerability was discovered in Uber's production server on February 22, 2023. The vulnerability allowed an attacker to gain complete admin account takeover due to PhpDebugBar being turned on...
U.S. Dept Of Defense: AWS Credentials Disclosure at ███
Sensitive AWS credentials were disclosed through a config.json file found on a server. An attacker could have used these credentials to gain access to sensitive information on the AWS account or perform arbitrary modifications on AWS resources. The affected system host was not disclosed. No CVE...
Rocket.Chat: Regex account takeover
Summary: get admin reset token with authenticated user Description: normal user login can access to admin reset token and set a new password for admin user Releases Affected: 3.18.5 3.0.5 Steps To Reproduce from initial installation to vulnerability: Add details for how we can reproduce the issue...
Kubernetes: SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30X
Report Submission Form Summary: This report uses metrics-server as example, but it should be applicable to any aggregated api server. When metrics-server is hijacked, either by modifying the container image directly or by running another pods using the same label selector in kube-system namespace...
Stripe: CSRF token validation system is disabled on Stripe Dashboard
@dsharad discovered that due to a code change deployed on 2/14/2022, Cross Site Request Forgery CSRF protection was disabled in the Stripe Dashboard. This could have allowed an attacker to trick a victim user to visit a malicious website and cause limited changes to the victim’s Stripe account su...
Shopify: Sidekiq dashboard exposed at notary.shopifycloud.com
Summary: Hi, I found that the host https://notary.shopifycloud.com/ is exposing a sidekiq dashboard to the internet, for any unauthenticated user to use. I am not very familliar with Sidekiq, but from what I can tell its used for ruby background proccessing. I am fairly certain this dashboard is...
Nextcloud: Control character filtering misses leading and trailing whitespace in file and folder names
Summary: It is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. In lib/private/Files/Storage/Common.php, t...
GitHub Security Lab: C# : Add query to detect Server Side Request Forgery
This bug was reported directly to GitHub Security Lab...
Lark Technologies: Able to steal private files by manipulating response using Auto Reply function of Lark
A IDOR Insecure Direct Object Reference vulnerability was found within the "AutoReply" functions of Lark. This vulnerability could have allowed malicious users to fetch the files of other users if they knew the specific file ID which was an alphanumeric value. We thank @imrannisar for reporting...
GitLab: Drive-by arbitrary file deletion in the GDK via letter_opener_web gem
Summary When running gitlab in development, an extra gem used to view emails that have been sent: https://gitlab.com/gitlab-org/gitlab/-/blob/v14.3.0-ee/config/routes/development.rbL14 ruby mount LetterOpenerWeb::Engine, at: '/rails/letteropener' One of the routes it adds is to delete a letter:...
Nextcloud: Cards in Deck are readable by any user
Sensitive deck card contents were readable by any user, allowing unauthorized access to the information...
Affirm: Open Redirect
Open Redirect Vulnerability: URL : https://www.affirm.com/ User can be redirect to malicious site POC:https://www.affirm.com///google.com/?www.affirm.com/?category=interview&page=2 I hope you know the impact of open redirect and more info refer https://cwe.mitre.org/data/definitions/601.html Impa...
GitLab: Stored XSS in markdown via the DesignReferenceFilter
Summary When rendering markdown, links to designs are parsed using the following linkreferencepattern: https://gitlab.com/gitlab-org/gitlab/-/blob/v13.12.1-ee/app/models/designmanagement/design.rbL168 ruby def self.linkreferencepattern @linkreferencepattern ||= begin pathsegment =...
GitLab: Clipboard DOM-based XSS
Summary A clipboard DOM-based XSS exists on several Markdown text fields. Technical details The app/assets/javascripts/behaviors/markdown/copyasgfm.js file is used to get and set GFM GitHub Flavored Markdown data on the clipboard on different parts of the GitLab application. If a user copies data...
Mail.ru: [Plazius] SSRF через некорректно сконфигурированный Fiddler 46.148.201.206:10121
SSRF on ucs.ru...
GitHub Security Lab: [Java] CWE-522: Insecure LDAP authentication
This bug was reported directly to GitHub Security Lab...
Internet Bug Bounty: Canonical Snapcraft vulnerable to remote code execution under certain conditions
Preface: I apologize for previously submitting this bug to hacker1 before it was fully addressed by the Ubuntu Security Team I have reported this issue to the Ubuntu Security team and it has been fixed: CVE-2020-27348 Bug link: https://bugs.launchpad.net/snapcraft/+bug/1901572 Ubuntu Security Tea...
Mail.ru: subdomain takeover disney.samokat.ru
Unused disney.samokat.ru subdomain was delegated to readymag.com and not claimed...
Ruby on Rails: HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection.
When a site is configured to use the .tkte.ch leading dot short form for domain name, ex: ruby config.hosts You are being redirected. Where the controller is simply: ruby class RedirectController ApplicationController def main redirectto action: 'main' end end The host header poisoning was report...