15402 matches found
Mars: Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses
A publicly accessible JSON API endpoint was found to expose sensitive user information, including internal identifiers and email addresses. The vulnerability was classified as an information disclosure issue with a medium severity rating. The problem was remediated by implementing proper...
curl: SMTP Command Injection Vulnerabilities in curl
Summary Successfully reproduced SMTP command injection vulnerabilities in curl that allow attackers to inject arbitrary SMTP commands by using carriage return and line feed characters \r\n in email addresses. Vulnerabilities Confirmed 1. MAIL FROM Injection Description: Injection via --mail-from...
Nextcloud: Stored XSS Vulnerability via SVG File
A stored XSS vulnerability was discovered in Nextcloud related to the handling of SVG files. The vulnerability allowed the execution of arbitrary JavaScript code...
Node.js: Memory leak that enables remote Denial of Service against applications processing TLS client certificates
A memory leak was discovered in Node.js's OpenSSL integration when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. The vulnerability was triggered when applications called socket.getPeerCertificatetrue, causing steady memory growth through repeated TLS connectio...
Nextcloud: Mail stored HTML injection in subject text
A vulnerability was discovered in the mail stored HTML injection in subject text. The vulnerability allowed for arbitrary HTML code to be injected into the subject line of emails stored in the system...
Omise: 2FA requirement bypass when inviting team members
The application's requirement for users to enable 2FA before sending team invitations was bypassed by modifying client-side responses. This allowed invitations to be sent without enabling 2FA, defeating the security requirement...
curl: Race condition on global `gss_context` during SOCKS5 GSS-API negotiation in libcurl
Summary: Concurrent SOCKS5 GSS-API authentications share a file-scope global gsscontext without synchronization, causing data races and undefined behavior. - Global context defined at: 52:54:curl/lib/socksgssapi.c static gssctxidt gsscontext = GSSCNOCONTEXT; - Passed by address into the GSS init...
Sony: DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)
A DLL side-loading vulnerability was discovered in Sony Music Center for PC Ver. 2.7.2. The application insecurely searched for a missing DLL file in the system PATH environment, allowing an attacker with access to the victim's local machine to achieve arbitrary code execution by placing a...
curl: CVE-2025-10966: missing SFTP host verification with wolfSSH
Summary: When curl is built with the wolfSSH backend, the SSH/SFTP implementation in lib/vssh/wolfssh.c performs no server host key verification and exposes no host identity options in the curl tool. I verified this locally by building curl with wolfSSH binary reports wolfssh/1.4.20, observing th...
curl: Use-after-free when POST body buffer is freed before transfer
Summary: I locally reproduced a heap use-after-free in libcurl by setting CURLOPTPOSTFIELDSIZE and CURLOPTPOSTFIELDS to a heap buffer and then freeing that buffer before curleasyperform. AddressSanitizer ASan reports a heap-use-after-free read during the request send path. This demonstrates the...
U.S. Dept Of Defense: Cross-Site Scripting via URL on ███████
A Cross-Site Scripting XSS vulnerability was discovered on an official domain from the Department of Defense. The vulnerability could be exploited through the GET method, allowing an attacker to inject malicious scripts that could potentially be executed. No further details were provided...
SingleStore: Insecure Direct Object Reference (IDOR) allows creating folders.
An Insecure Direct Object Reference IDOR vulnerability was discovered in the backend API of a software product. The vulnerability allowed authenticated users with low privileges to create unauthorized folders and files in other users' workspaces within the same organization. The issue was reporte...
SingleStore: Delete any folder for any user within the organization
A vulnerability in the SingleStore backend API allowed low-privileged users to delete folders belonging to other users within the same organization by manipulating the folderid parameter in DELETE requests. The vulnerability was rated CVSS 3.0 Low 3.8 due to high attack complexity requiring...
SingleStore: Privilege Escalation – Access to the Alert Subscribers page for users with low privileges
A privilege escalation vulnerability was discovered in the SingleStore Helios alert management system. The vulnerability allowed users with low privileges to access the Alert Subscribers API endpoint and retrieve email addresses and alert severity level preferences of notification subscribers,...
U.S. Dept Of Defense: Cross-Site Scripting via URL on ███████
A Cross-Site Scripting XSS vulnerability was discovered on a website from the U.S. Department of Defense. The vulnerability was found in the GET method via the URL. Exploitation of this vulnerability could have led to the execution of malicious scripts. No further details about the vulnerability ...
U.S. Dept Of Defense: Publicly Accessible CDN Endpoint Exposing XML Metadata (including ETag)
A publicly accessible CDN endpoint was found that returned raw XML listing of stored objects, including metadata such as Key, LastModified, Size, StorageClass, and ETag. The ETag values, which can contain object hashes, were exposed publicly. This configuration allowed reconnaissance of the...
curl: Timing Attack Vulnerability in curl Digest Authentication via Non-Constant-Time String Comparison
Summary: A timing attack vulnerability exists in curl's Digest Authentication implementation due to the use of non-constant-time string comparison strcmp when comparing authentication algorithms in digest.c line 360. This allows attackers to determine the supported authentication algorithm throug...
curl: Security Analysis Report: CURL Integer Overflow Vulnerability
Vulnerability Overview Vulnerability Type: Integer Overflow in HTTP chunked encoding Location in Source: lib/httpchunks.c line 173 lib/curlx/strparse.c lines 185–186 Impact: Integer overflow leads to memory corruption Can cause buffer overflow Results in Denial of Service DoS for curl Potential...
curl: int overflow in krb5_read_data() leads to (possible) massive `recv()` write
Summary: Note: AI created the PoC, not the report. In the krb5readdata function here, there are two issues one of which I am very surprised hasn't been caught before. Issue 1 is that this block can result in an int overflow, where the following check becomes invalid if the value is wrapped to a...
IBM: IBM Aspera HTTP Gateway stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.
The IBM Aspera HTTP Gateway stored sensitive information in clear text in easily obtainable files, which could be read by an unauthenticated user. The issue was submitted to IBM, analyzed, and remediated...
curl: Stack Buffer Overflow in cURL Cookie Parsing Leads to RCE
Summary I discovered a critical stack-based buffer overflow vulnerability in cURL's cookie parsing mechanism that can lead to remote code execution. The vulnerability occurs when processing maliciously crafted HTTP cookies, affecting all applications that use libcurl for HTTP requests. Descriptio...
Nextcloud: Approval app allows users to request approval for other users file
A security vulnerability was discovered in the Approval app that allowed users to request approval for other users' files. The vulnerability was addressed in a security advisory...
curl: Multiple Unsafe strcpy() Function Calls Leading to Potential Buffer Overflow Vulnerabilities in cURL 8.16.1-DEV
Summary: During a comprehensive security audit of the cURL codebase, multiple instances of unsafe strcpy function usage were identified in critical code paths. These implementations violate secure coding practices and represent latent security risks that could lead to buffer overflow...
Django: SQL Injection in Django ORM via Unvalidated `_connector` in Q Objects
A critical SQL injection vulnerability was discovered in the Django ORM's handling of Q objects. The internal WhereNode.assql method used unsafe string formatting to inject the query connector, which could be controlled by an attacker through the connector key when creating a Q object. This allow...
curl: TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation Bypass
I've discovered a Time-of-Check to Time-of-Use TOCTOU vulnerability in how libcurl handles persistent HTTP/2 connections. During the initial handshake, libcurl correctly validates the server's certificate against the user-provided CA bundle. However, it then assumes this trust is permanent for th...
Nextcloud: Nextcloud Tables v1 Share Enumeration Without Authorization (Regression of CVE-2024-52507)
A vulnerability was discovered in Nextcloud Tables v1 that allowed unauthorized users to enumerate shares. The vulnerability was a regression of a previously addressed issue, CVE-2024-52507...
curl: Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure)
Summary: During a security assessment of curl.se, multiple misconfigurations were identified that led to information disclosure or weakened the security posture of the website. Affected version: Website: https://curl.se Tested on: 09-09-2025 curl version: curl/8.8.0 x8664-pc-linux-gnu Steps To...
curl: CVE-2025-10148: predictable WebSocket mask
No AI was involved. Summary: The curl WebSocket implementation generates a fixed masking key at the beginning of a connection an re-uses it for every frame: Generation of masking key enc.mask in Curlwsaccept: https://github.com/curl/curl/blob/455afa1de5182b95a5dcc988f18cdff584b95239/lib/ws.cL1340...
SingleStore: 2FA bypass possible on https://authsvc.singlestore.com
A vulnerability was discovered that allowed the 2FA authentication mechanism to be bypassed completely. An attacker could access the victim's account by only knowing the email address and password, without requiring the 2FA code...
Basecamp: Improper bot-authentication allows to impersonate any user when sending messages in a room
A vulnerability was discovered in the bot authentication mechanism. The issue allowed an unauthenticated user to impersonate any user and post messages in rooms the impersonated user had access to. The bot authentication function failed to properly validate the bot key, allowing a partial key to...
U.S. Dept Of Defense: Exposed wp-config.php file in ███ National Guard website
A WordPress configuration file containing sensitive information, such as the MySQL database password, was found exposed on a website of the National Guard. The file was accessible at a public endpoint...
Django: Path traversal via archive.extract - CVE 2021-3281 incomplete patch
A vulnerability was discovered in the "extract" function of the ZipArchive and TarArchive classes in the Django framework. The vulnerability was caused by the use of the "abspath" function, which removes terminating path separators. This made the guard logic protection insufficient to protect...
Bykea: Lack of minimum value bid wheel verification on customer_bid in Rental Trips
A missing validation on the customerbid field when creating rental trips allowed passengers to submit arbitrary bid amounts, including very low fares. Proper validation was added to prevent unrealistic values...
AWS VDP: Existence of completed pods allows for bypass of Kubernetes NetworkPolicy
Description The Amazon VPC CNI controller, when configured to manage NetworkPolicy rules, will incorrectly apply firewall rules for Completed pods as if the pods are still running, causing these rules to be applied to other unrelated pods that happen to receive the same IP address as a Completed...
Mozilla: User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon
A vulnerability was discovered in the Mozilla Pontoon application that allowed users to delete other users' personal access tokens at the /delete-token/tokenid/ endpoint without proper permission checks. The vulnerability was caused by the absence of user permission verification in the deletetoke...
curl: libcurl: Host-Only Cookies Leak to Alternate IPv4 Forms
libcurl canonicalizes numeric IPv4 hostnames during URL parsing and redirect handling example: 127.000.000.001 to 127.0.0.1. When a host-only cookie no Domain= attribute is set, it is stored in the cookie jar with the host string 127.0.0.1. On redirect, even if the Location: contains an alias hos...
U.S. Dept Of Defense: Account Takeover via Unverified Email Change and Improper Session Handling
A vulnerability was discovered in the email change functionality of the system. When the email was changed to an unregistered email address, the system accepted the change without proper verification. If the victim later registered using the same email, the attacker's existing session was not...
curl: Heap-buffer-overflow (Out-of-Bounds Read) in DoH hostname encoding
Summary: I found a heap-buffer-overflow in the dohreqencode function in lib/doh.c. The bug happens when curl processes a DNS-over-HTTPS request for a hostname that is an empty string. The code gets the string length as 0, then tries to access hostlen - 1, which becomes host-1. This is an...
Cloudflare Public Bug Bounty: [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth
A vulnerability was discovered in Cloudflare Access that could allow for unauthorized approvals within the Temporary Auth workflow. The issue was resolved after the researcher reported it to Cloudflare...
PlayStation: Double fdrop on a socket through sys_netcontrol
The netcontrol syscall in the kernel had a vulnerability where the socket file descriptor was not properly validated when removing a socket from a netevent structure. This allowed an attacker to cause a double fdrop on a socket, potentially leading to a use-after-free condition...
curl: Incorrect Parsing of IPv6 Zone ID in curl
I'm Zehui Miao from NISL@THU. During recent research, our team identified a parsing inconsistency in the curl. 0x01 Affected components 1.1 Affected components • C Curl • Versions: tested in 8.4.0 • CLAIMS TO FOLLOW: RFC-3986 1.2 Attack scenario The threat model illustrated in Figure 1 explains t...
U.S. Dept Of Defense: Information Disclosure via Publicly Accessible Debug Log
A publicly accessible WordPress debug log file was discovered on the target system. The log file contained PHP warnings and deprecated notices that disclosed sensitive server paths and plugin details. This exposure may have assisted an attacker in fingerprinting the environment or exploiting know...
Cloudflare Public Bug Bounty: Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATO
The vulnerability in the MCP Server Portal Apps was caused by missing sanitization of the redirecturi parameter, leading to a second-order XSS vulnerability. An attacker could craft a malicious redirecturi containing JavaScript code, obtain a clientid for this URI, and reuse it when a victim had ...
Dynatrace: OneAgent Unprivileged NTLM User Coercion
Vulnerability description not provided...
curl: Missing Security Headers
Missing Security Headers Low Target: https://curl.se/ OWASP Mapping: A05 Misconfiguration / A02 Crypto Vulnerability ID: sec-headers-0f70ef5bcb Description A Missing Security Headers issue was discovered. This may allow an attacker to exploit the application. Proof of Concept Using cURL bash curl...
Monero: Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node Paralysis
A deadlock vulnerability was discovered in the Monero JSON-RPC interface that allowed a remote, unauthenticated attacker to completely paralyze any Monero node with a single HTTP request containing specific batch methods, leading to permanent denial of service. The vulnerability affected all...
curl: curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/Tor
Summary: When using curl with a SOCKS5 proxy e.g. Tor on 127.0.0.1:9050, glibc getaddrinfo performs direct UDP connect probes to the target’s IP:443. These syscalls bypass the proxy and expose the user’s route to the destination, breaking anonymity expectations. The IPs I got in my case:...
curl: Curl parse_connect_to_string Heap-Overread Leading to Denial of Service via CURLOPT_CONNECT_TO
Summary: A heap-buffer-overread occurs in Curl's parseconnecttostring function when using the CURLOPTCONNECTTO option with crafted input. This can lead to a segmentation fault and crash of the application, resulting in a denial-of-service. The issue is triggered by malformed host strings containi...
Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner...
WakaTime: Invalid
Summary: While testing the OAuth implementation on your platform, I discovered a critical vulnerability that allows a malicious attacker to take over any victim’s account and maintain persistent access even if the victim later verifies their email or changes their password. This issue arises...