15688 matches found
curl: CURLOPT_PROXY_CRLFILE / CURLOPT_PROXY_ISSUERCERT / CURLOPT_PROXY_ISSUERCERT_BLOB silently ignored on backends that don't support them
From the Mythos report 2026-05-06 F1. CURLOPTPROXYCRLFILE / CURLOPTPROXYISSUERCERT / CURLOPTPROXYISSUERCERTBLOB silently ignored on backends that don't support them — severity Low https://github.com/curl/curl/blob/455bebc2c7/lib/setopt.cL1786-L1797...
curl: CVE-2026-6276: stale custom cookie host causes cookie leak
Summary: libcurl keeps a stale data-state.aptr.cookiehost after a request that uses a custom Host: header. On later requests on the same easy handle, when no custom Host: is used, libcurl still reuses that stale value for outgoing cookie selection lib/http.c:2560-2563 and incoming Set-Cookie...
GitHub: GitHub user to server tokens can create issues in any public repository
A vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. The authorization check only verified that the installation had read...
Lovable VDP: Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameter
A bypass was discovered for a previously patched open redirect vulnerability on a web application. The original fix blocked certain payloads, but failed to account for path traversal sequences combined with double slashes. By supplying a specific redirect value, an attacker could still redirect...
curl: AWS SigV4 Signature Disclosure via Verbose Logging in libcurl
Summary When libcurl is built with AWS SigV4 support, enabling verbose logging CURLOPTVERBOSE or --verbose causes the library to print both the string-to-sign and the final HMAC signature into logs. Because signatures remain valid for several minutes and are derived directly from AWS credentials,...
curl: SMTP Command Injection Vulnerabilities in curl
Summary Successfully reproduced SMTP command injection vulnerabilities in curl that allow attackers to inject arbitrary SMTP commands by using carriage return and line feed characters \r\n in email addresses. Vulnerabilities Confirmed 1. MAIL FROM Injection Description: Injection via --mail-from...
Rocket.Chat: NoSQL injection leaks visitor token and livechat messages
The Rocket.Chat application was affected by two NoSQL injection vulnerabilities. The first vulnerability allowed leaking visitor tokens by exploiting the livechat:loginByToken method, while the second vulnerability enabled leaking livechat messages by exploiting the livechat:loadHistory method...
U.S. Dept Of Defense: Reflected Cross-site Scripting via search query on ██████
The summary is as follows: A reflected cross-site scripting vulnerability was discovered in the search query functionality of the ████████ website. An attacker could execute arbitrary JavaScript code in the victim's browser by injecting malicious payload into the search query parameter...
Liberapay: Disavowed an email without any authentication
Vulnerability description not provided...
Cloudflare Public Bug Bounty: Privilege escalation to root in Pages build image v2
Vulnerability description not provided...
Nextcloud: Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log]
Hi team , i found wp-content/debug.log endpoint public accessible That lead to full path disclosure Steps : Open : https://nextcloud.com/wp-content/debug.log You can See Internal paths disclosed and date is : 02-Nov-2022 02-Nov-2022 08:50:36 UTC PHP Fatal error: Uncaught Error: Call to undefined...
Rocket.Chat: Low authorization level at server side API operation e2e.updateGroupKey, let an attacker break the E2E architecture.
The E2E encryption feature in open.rocket.chat server had a vulnerability that allowed an attacker to break the encryption of a secure chat room. The vulnerability was caused by a low authorization level at the server-side API operation e2e.updateGroupKey, which allowed an attacker to insert or...
Cloudflare Public Bug Bounty: Bypass two-factor authentication
Due to lack of validation, a malicious actor could brute force OTP 2fa and guess a correct number after multiple failures. The issue was fixed by the Engineering team by implementing restrictions on 2FA attempts...
Ruby on Rails: Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style)
Intro The Rails HTML sanitzier allows to set certain combinations of tags in it's allow list that are not properly handled. Similar to the report 1530898, which identified the combinationselect and style as vulnerable, my fuzz testing from today suggests that also svg and style as well as math an...
GitHub Security Lab: C# : Add query to detect Server Side Request Forgery
This bug was reported directly to GitHub Security Lab...
PortSwigger Web Security: Information disclosure on error message
Hai team, First of all , Thank you creating a wonderful place for learning web app pentesting : . In accessing a lab at the academy , my internet connection suddenly went down, I dont know the problem is on the lab or in academy, But the error message reveals some node codes.I attached a screensh...
Rocket.Chat: Message ID Enumeration with Regular Expression in getReadReceipts Meteor method
Summary The getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs. Description Authenticated users are able to query the getReadReceipts Meteor server method to enumerate existing...
Nextcloud: User files is disclosed when someone called while the screen is locked
Summary: User files in the server is disclosed while the screen is locked when someone called. Steps To Reproduce: add details for how we can reproduce the issue 1. Make 2 Accounts, Lets call them Account A and Account B 2. Using Account A login to https://nextcloud/apps/spreed/ 3. Using Account ...
Nextcloud: User deletion is not handled properly everywhere
So I came across this when going over https://nextcloud.com/compare/ And noticed the section: "BUILT IN DATA-REQUEST/ACCOUNT DELETION" However looking at this it seems this is not handled properly everywhere in Nextcloud. I understand that the GDPR etc do consider shared data differently. For...
GitLab: Clipboard DOM-based XSS
Summary A clipboard DOM-based XSS exists on several Markdown text fields. Technical details The app/assets/javascripts/behaviors/markdown/copyasgfm.js file is used to get and set GFM GitHub Flavored Markdown data on the clipboard on different parts of the GitLab application. If a user copies data...
Nextcloud: public webdav endpoint not bruteforce protected
Again related to https://hackerone.com/reports/1173684 I am having some trouble finding the code. However if you do curl -u "RANDOM1:RANDOM2" -X PROPFIND https://server/public.php/webdav And then check your ocbruteforceattempts table. You'll see there is no entry registered. Impact Low just like ...
GitLab: Cache poisoning Denial of Service affecting assets.gitlab-static.net
Summary Hi, Gitlab.com is hosting JS and CSS on https://assets.gitlab-static.net/ and uses them on gitlab.com/ The static files seem to be stored on a gcp host, which by default accepts the x-http-method-override header. Since the CDN is using Varnish to cache files, I was able to combine the GCP...
Stripe: Verifying email bypass
A vulnerability was discovered in Stripe's Connect API that allowed an attacker to create an account without verifying the email address. This allowed the attacker to impersonate a real company and generate invoices and payments on their behalf. The invoices appeared valid as they were sent by...
CS Money: Blind Based SQL Injection in 3d.sc.money
Greetings, Hope Y'all good and fine! Summary: I found a Boolean Blind based SQL Injection in your website = 3d.cs.money It's a URI path injection. The vulnerability tested on the Original IP behind the CloudflareWAF and I've already reported this in my other report 1105673 The Affected URI :...
OpenMage: Very long names on demo.openmage.org could redirect victim users to malicious url redirects via email contacts.
Summary: We found that the maximum length of the first and last name fields was not set to 32 characters at registration and to 1000 characters when using the profile update form. The attacker can use this method as a malware attack, the user will redirect to a website that contains malware or...
Informatica: Html injection on ██████.informatica.com via search.html?q=1
hello dear I have found HTML injection on ██████.informatica.com parameters injectable search.html?q=1 URL : https://████████.informatica.com/search.html?q=1%22%3E%3Cimg%20src=https://www.no-gods-no-masters.com/imagesdesigns/anonymous-gandhi-d001001207265.png%3E%E2%80%[email protected]%20%22 payload ; 1"”@x...
Mail.ru: subdomain takeover disney.samokat.ru
Unused disney.samokat.ru subdomain was delegated to readymag.com and not claimed...
Ruby on Rails: HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection.
When a site is configured to use the .tkte.ch leading dot short form for domain name, ex: ruby config.hosts You are being redirected. Where the controller is simply: ruby class RedirectController ApplicationController def main redirectto action: 'main' end end The host header poisoning was report...
pixiv: Open Redirect at https://oauth.secure.pixiv.net
Summary: Hello @pixiv security team, i hope you are well, i noticed you can redirect users to another domain if you send an invalided scope. Vulnerable Url...
Mail.ru: [performancemarketing.geekbrains.ru] Tilda Subdomain Takeover
Unused subdomain of geekbrains.ru was delegated to tilda.cc and unclaimed...
Mail.ru: Private files exposed to other apps
Insecure handling of external intent in ICQ for Android allowed another local application to force ICQ private files to be copied to insecure location...
Staging.every.org: No Rate Limit On Reset Password
Summary: A rate limiting algorithm is used to check if the user session or IP address has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame, HTTP servers can respond with status code 429: Too Many Requests. wikipedia I...
Node.js third-party modules: [Limited bypass of #793704] Blind SSRF in Ghost CMS
Blind SSRF vulnerability in Ghost allows for internal port scanning, or reading oembed contents from internal network...
Mail.ru: [v7lk.relap.io] Sending arbitrary emails to any user
Mail sending API endpoint at relap.io was publicly accessible...
FileZilla: FileZilla 3.46.3 - 'Scale factor' Buffer Overflow
Summary: FileZilla in has a problem in the "Scale Factor" field is vulnerable to a Buffer Over Flow attack or a denial attack. Adding random characters in an entry that must accept only Float input type values. Steps To Reproduce: A python file of name generatepaste.py was generated for the...
Starbucks: Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/
@iampuky — thank you for reporting the original vulnerability and for confirming the resolution. While analyzing the Starbucks Korea mobile application, i noticed that it called an API at https://msr.istarbucks.co.kr:6443/appif/. It was found that the application running under that directory was...
MTN Group: OTP bypass - Unintended disclosure of OTP to client allows attacker to manage users' subscriptions
Summary: https://play.mtn.co.za/ authenticates subscribers via OTP before their subscriptions to be changed. However, the request which sends the OTP also returns the OTP in the network response, allowing an attacker to manage a user's usbscriptions. Steps To Reproduce: 1. Visit...
Mail.ru: XSS на сайте https://warofdragons.my.games/.
Reflected XSS via GET parameter in https://warofdragons.my.games...
Dropbox: Leaking API_KEY of testrail of HelloSign gives read/write access
The APIKEY and testrail config details were leaked on Github, which attackers could use to access testrail accounts of HelloSign and perform read/write actions. Impact: Access to testrail account of HelloSign...
Bumble: Leak of authorization urls leads to account takeover
The researcher was able to pass verification to another account by finding confirmation data in response from the server...
Ping Identity: Google Maps API key leaked during device pairing
Summary: just on intercepting and going through the request i made from ort-admin.pingone.com . i found that the google map api key was leaking through get request . i was able to validate that the leaked key was a valid one Steps To Reproduce: 1.login to account goto setup tab ping iD device...
curl: krb5: double-free in read_data() after realloc() fail
Summary: In 'lib/security.c', there is a double-free of the reference 'buf-data' on the teardown path if 'Curlsaferealloc' fails. Also, since we read 'len' from the 'fd', the sender might be able to remotely trigger a realloc failure, and then the double-free, by sending the value 0x7fffffff...
Grammarly: Can register any mobile number in MFA without current code.
@chackmate identified a vulnerability that allows a user to connect arbitrary phone numbers with their account. No users affected...
Mail.ru: web.icq.com XSS in chat message via contact info
web.icq.com XSS in chat message via contact info...
Mail.ru: XSS при загрузке изображения на [games.mail.ru]
Do-it-yourself XSS self-XSS via crafted file name in support request on games.mail.ru Insufficient filtering of dangerous tags when uploading images on games.mail.ru in technical support tickets...
VK.com: Бесконечный доступ к аккаунту если мы смогли хотя бы раз зайти на аккаунт.
Временная возможность продлить сессию после получения полного доступа к странице...
Shopify: XSS on services.shopify.com
Hy security, i Got a stored xss in one of your sub-domain "services.shopify.com" steps: 1- Go to https://yourstore.myshopify.com/admin/apps/expertsmarketplace/servicesmarketplace 2- Then Go to All servicesMarketing and salesemail marketing Design custom email templates click select 3- fill al the...
TomTom: CSRF allows attacker to manage customer's shopping cart.
The following endpoint https://www.tomtom.com:443/enus/store/basket-add.html had no CSRF checks / tokens .. whatsoever , which allows a malicious user add massive amounts of a any product to a victim's cart or empty the cart. the CSRF POC file included adds 50 items of the giving product the a...
Node.js: Vulnerability in http-parser & embedded NULL header handling
Due to a snafu in how [email protected] is setup to forward see https://github.com/envoyproxy/envoy/issues/5155, the following bug report was not made available prior to disclosure. For completeness, I'm providing the original e-mail below. Please note that this has been fixed in http-parser...