15403 matches found
Brave Software: SameSite restrictions are lifted, and SameSite:Strict cookie are being sent.
A vulnerability was discovered where SameSite=Strict cookies were being sent during cross-site navigations, even though they should have been restricted under the SameSite policy. This was caused by the absence of the Sec-Fetch-Site: cross-site header, which is normally used to prevent such...
U.S. Dept Of Defense: Exposed wp-config.php file
A copy of the WordPress configuration file wp-config.php was found at an endpoint. The file contained sensitive information, such as MySQL and AWS credentials, and various keys...
Khan Academy: 337k users and 1 employee leaked credentials
The Khan Academy website experienced a data breach, resulting in the leakage of 337.7k user accounts and one employee account. The leaked credentials, including email addresses and passwords, were discovered on a website called "leakradar.io"...
curl: Disk Space Exhaustion leading to a Denial of Service (DoS)
Description The tooldebugcb function can write large amounts of debug data to a log file if the --trace or --trace-ascii options are used with a large volume of data. If an attacker can cause cURL to download or upload a very large amount of data e.g., via a very large HTTP response or an unlimit...
8x8: █.8x8.vc/index.js: Exposed Google Maps API Key Allowing Potential Abuse of Paid Services
The Google Maps API key was inadvertently exposed in client-side code, allowing potential unauthorized access to some Google Maps services. The issue was promptly addressed by implementing appropriate API key restrictions where feasible...
curl: Uncontrolled File Write/Arbitrary File Creation
Description The dumpeasysrc function in the provided code snippet allows an attacker to specify an arbitrary file path for outputting the generated libcurl source code via the global-libcurl variable. If the global-libcurl value is not properly sanitized or restricted, a malicious user could...
curl: HTTP Request Smuggling Vulnerability Analysis - cURL Security Report
HTTP Request Smuggling Vulnerability Report - cURL Summary: cURL does not explicitly reject HTTP requests that contain both Transfer-Encoding and Content-Length headers, which can lead to HTTP request smuggling vulnerabilities CWE-444 when the request passes through intermediary systems proxies,...
ExpressionEngine: SQL injection in structure plugin
An SQL injection flaw was discovered in ExpressionEngine's Structure plugin. User input from the channelids parameter was passed directly into SQL queries without proper sanitization. The vulnerability required admin panel access...
Nextcloud: Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet Library
A path traversal vulnerability was discovered in Nextcloud Tables. This vulnerability allowed the exfiltration of any files supported by the PhpSpreadsheet library...
Bykea: MongoDB Query Logs & Schema Leak via Unauthenticated Endpoint
MongoDB Query Logs & Schema Leak via Unauthenticated Endpoint An unauthenticated health check endpoint was discovered that exposed basic system and infrastructure details...
WakaTime: Not a Vuln: Race Condition Allows Creation of Multiple Organizations with the Same Name
Summary: A race condition vulnerability exists in the organization creation logic that allows an attacker to create multiple organizations with the same name, violating the expected uniqueness constraint enforced by the UI. This could lead to confusion, broken business logic, or potential misuse...
Nextcloud: Deck app allowed user with "Can share" permission to modify permissions of other non-owners
The Deck app in Nextcloud allowed users with "Can share" permission to modify the permissions of other non-owners...
Nextcloud: Participants were able to blindly delete poll drafts of other users by ID
Participants were able to blindly delete poll drafts of other users by ID...
curl: Default Minimum TLS Version Set to TLS v1.0 (Cryptographic Weakness)
Summary: Curl sets TLS v1.0 as the default minimum version, which is outdated and vulnerable to attacks like BEAST, posing a risk to data integrity and confidentiality. This was found through manual code review. No AI was used in identifying the issue or generating this report. Affected Version:...
Mozilla: Microsoft `x-apikey` Exposed in Mozilla CI Public Logs
A Microsoft telemetry API key x-apikey was found exposed in publicly accessible Mozilla CI logs. The key appeared in HTTP POST requests sent to Microsoft's telemetry endpoint during automated Firefox testing and was captured via mitmproxy logs. The security impact was considered minimal as the...
U.S. Dept Of Defense: Critical PII Data Exposure in ORDER_ERROR_LOG
A critical security vulnerability was identified in the application's error logging system. The ORDERERRORLOG file contained complete database insertion statements that exposed personally identifiable information of customers in plain text format. The error handling mechanism was logging full SQL...
curl: Arbitrary File Read via file:// Protocol in cURL
cURL’s file:// protocol handler is enabled by default, allowing access to local files on the system. This behavior enables an attacker with the ability to run cURL commands to read arbitrary files on the host by specifying file paths or using directory traversal techniques. Steps to reproduce: 1...
curl: Use-After-Free in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurl
Summary: A Use-After-Free UAF vulnerability exists in libcurl when the OpenSSL SSLCTXsetkeylogcallback is set. The callback may be invoked after the associated SSL object has been freed via SSLfree, leading to access to a dangling pointer and potential crash or information leak via SSLgetexdata...
curl: Disclosure of email addresses
https://github.com/curl/curl/blob/master/.mailmap Impact Summary: Disclosure of email addresses...
curl: access notes without permission
https://web.archive.org/web//https://github.com/curl/curl Impact Summary: access notes without permission...
Monero: Reported Denial of Service
A vulnerability was reported in the Monero RPC server that could cause a denial of service. The issue was found in the "calcpow" RPC endpoint, where specially crafted input could cause the server to crash with the message "Cryptonight variant 1 needs at least 43 bytes of data". The problem was th...
Monero: Reported RPC Overflow
A stack buffer overflow was reported in the Monero RPC server. Specifically, on line 1291 of the corerpcserver.cpp file, an overflow could occur if the size of the b.data did not match the size of the crypto::keyimage. Additionally, a missing return statement was found following line 1289. The...
U.S. Dept Of Defense: Reflected XSS Vulnerability in SSL VPN Endpoint — CVE-2025-0133
A reflected Cross-Site Scripting XSS vulnerability was discovered in a SSL VPN endpoint. The vulnerability was assigned the CVE number CVE-2025-0133. The vulnerability allowed an unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of a victim who clicked on a...
curl: Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations
Summary: The HTTP/2 proxy implementation in curl contains potential integer overflow vulnerabilities in buffer size calculations that could lead to memory corruption or denial of service. AI Usage Statement: This report was prepared by a human security researcher after manual code review. No AI w...
LinkedIn: Improper Access Control - Access to "Active Hiring" (Premium feature) filter results
An access control vulnerability was identified in LinkedIn's people search functionality that allowed unauthorized access to premium "Active Hiring" filter results. The vulnerability was found in the GraphQL API endpoint where premium feature restrictions were not properly enforced, allowing user...
curl: CRLF injection in libcurl's SMTP client via --mail-from and --mail-rcpt allows SMTP command smuggling
Summary: libcurl's SMTP client is vulnerable to CRLF injection via the --mail-from and --mail-rcpt parameters. An attacker can inject newline characters to smuggle SMTP commands like VRFY, potentially enabling user enumeration or protocol abuse. While curl may fail after injection, the injected...
U.S. Dept Of Defense: SQL Injection in URI Path Leading to Full Database Disclosure on ████████
A time-based blind SQL injection vulnerability was discovered in the URI path of the /home/server-ocsp/ endpoint on a U.S. Government Public Key Infrastructure website. The vulnerability allowed an unauthenticated attacker to interact with the backend MySQL database and extract sensitive...
curl: HTTP Proxy Bypass via `CURLOPT_CUSTOMREQUEST` Verb Tunneling
Summary A logic flaw in libcurl version 8.14.1 allows an attacker to bypass restrictive HTTP proxy firewalls by "tunneling" an arbitrary HTTP verb within a CONNECT request. By setting CURLOPTCUSTOMREQUEST to CONNECT for a standard http:// URL, an attacker can trick libcurl into creating a hybrid...
Lichess: CSRF at Network feature
A CSRF vulnerability was found in the network feature, where an attacker could change the Network Routing settings by sending a CSRF script to the victim...
curl: Stack-based Buffer Overflow in TELNET NEW_ENV Option Handling
Title: Stack-based Buffer Overflow in TELNET NEWENV Option Handling Vulnerability Description: Summary: A stack-based buffer overflow vulnerability exists in the libcurl TELNET handler. When libcurl connects to a malicious TELNET server, the server can trigger an overflow by sending a NEWENVIRON...
curl: Heap Buffer Overflow in libcurl curl_slist_append via Unterminated String
Summary A heap buffer overflow vulnerability exists in libcurl's curlslistappend function in lib/slist.c:94. When the function is called with a non-null-terminated string, the internal strdup call triggers strlen to read beyond allocated buffer boundaries, leading to a heap buffer overflow. This...
Mars: Account Takeover in Password Reset Function
A critical authentication bypass vulnerability was present in the password reset functionality of the website. The vulnerability allowed attackers to take over any user account without requiring access to the victim's phone number or one-time password. The security flaw existed in the...
Bykea: Critical Information Disclosure via /talos/api/v1/files/upload
A vulnerability was discovered in the file upload functionality, where uploaded files were first stored on the server before being sent to S3. Due to a configuration flaw, memory chunks from the server were included in some uploaded files. This issue was classified as critical and was addressed a...
SingleStore: Exceeding the limit of Workspaces via Race Condition
The reporter discovered a race condition vulnerability in backend.singlestore.com that allowed free-tier users to bypass the 5-workspace limit by sending multiple simultaneous CreateWorkspace requests. This issue was patched by SingleStore as of October 3rd, 2025...
curl: arbitrary file read via `file://` path traversal with `--path-as-is`
Summary: Using --path-as-is with a file:// URL skips normalization of .. segments allowing reading of any local file the process can access Affected version curl 8.15.0-DEV commit 2a9dfe275, June 27, 2025 on Kali Linux 2024.3, x8664 Steps To Reproduce: 1. bulild curl with debug and ASan: git clon...
curl: OS Command Injection in scripts/firefox-db2pem.sh via untrusted certificate nicknames
On AI usage: Only for grammar/formatting suggestions/POC code troubleshooting; all vulnerability discovery, POC code creation, and analysis were done manually. Hey folks, I noticed something I think is worth bringing to you-- scripts/firefox-db2pem.sh helper in the curl source uses eval certutil ...
SingleStore: Exceed the maximum number of subscribers using Race Condition
A race condition vulnerability was discovered in the SingleStore control panel that allowed bypassing the maximum limit of five subscribers for alerts. The issue was patched and deployed to production...
SingleStore: IDOR - Scheduled data leak to other accounts By "projectID"
The Insecure Direct Object Reference IDOR vulnerability was discovered in the GetNotebookScheduledPaginatedJobs endpoint on backend.singlestore.com. The API failed to verify the requestor's permission to access the specified project, allowing an authenticated user to access scheduled job...
AWS VDP: Remote Code Execution in Amazon MWAA due to outdated Apache Airflow version
Explanation: I am a penetration tester working with Siemens. During a collaborative security assessment with an internal team, I discovered a Remote Code Execution RCE vulnerability in an Amazon Managed Workflows for Apache Airflow MWAA environment. I initially reported this issue to the AWS...
curl: Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c
Summary : -When parsing a netrc. file, the macdef keyword fails to clear previously loaded credentials. If a redirect follows, these credentials are leaked to the new host. This is a new variant of CVE-2024-11053, triggered by a different code path 'macdef' instead of 'default'. No, this...
curl: Sensitive information disclosure with malicious netrc file
libcurl at commit 879b6075a1132c137920060ed262b3f5a58c18c2 contains a vulnerability where it can be coerced into reading over the boundaries of a heap-chunk and sending the resulting data over the network to an attacker. This can lead to a disclosure of sensitive data, including pointers or other...
Cloudflare Public Bug Bounty: `use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using it
The authorizeEndpoint parameter from use-mcp version was susceptible to XSS. Sanitization of that parameter was added in version 0.0.10 of use-mcp. A skilled attacker was able to turn this XSS into code execution on the client...
Omise: PII Exposure via Email Confirmation Link – Email Embedded in Token & Leaked via Wayback Machine
The vulnerability involved the exposure of personally identifiable information PII, specifically email addresses, through an email confirmation link used by Omise. The email address was embedded directly in a token that was visible in the URL. This token was subsequently archived by the Wayback...
U.S. Dept Of Defense: Reflected XSS via user parameter on getconfig.esp endpoint
The getconfig.esp endpoint was found to reflect unsanitized user input provided in the user parameter directly into the HTML response, resulting in a Reflected Cross-Site Scripting XSS vulnerability. The affected product was Fortinet SSL VPN FortiOS version 3.0.1-10...
AWS VDP: XSS on Amazon Aquisition: elemental
The XSS vulnerability on Amazon's acquisition of Elemental was identified and addressed. The summary provided a brief overview of the issue...
U.S. Dept Of Defense: Reflected XSS via user Parameter in /ssl-vpn/getconfig.esp
A reflected Cross-Site Scripting XSS vulnerability was discovered in the user parameter of the /ssl-vpn/getconfig.esp endpoint. This allowed an attacker to inject and execute arbitrary JavaScript in a user's browser. The vulnerability was found on a .mil domain associated with a VPN configuration...
U.S. Dept Of Defense: Reflected XSS via user Parameter on getconfig.esp Endpoint
A reflected Cross-Site Scripting XSS vulnerability was discovered in the /ssl-vpn/getconfig.esp endpoint, where user input in the 'user' parameter was not properly sanitized and allowed the injection of arbitrary JavaScript. This could have enabled remote attackers to execute malicious scripts in...
Automattic: Woocommerce SQL Injection in WC_Report_Coupon_Usage
A SQL injection vulnerability was found in the WooCommerce plugin version 9.9.3. The vulnerable parameter was 'couponcodes' in the '/wp-admin/admin.php?page=wc-reports&tab=orders&report=couponusage' endpoint. The vulnerability required the privilege to view reports...
Hemi VDP: WordPress Version Exposure via ███████ on hemi.xyz
The WordPress CMS version was exposed in the XML file at https://hemi.xyz███. This disclosure allowed attackers to fingerprint the CMS version...
MainWP: Reflected XSS in "Cost Tracker" Notes Field
The reflected Cross-Site Scripting XSS vulnerability was discovered in the "Notes" input field of the Cost Tracker section in MainWP Version 5.4.0.11. Arbitrary user input in this field was reflected back and executed immediately upon saving, due to the lack of proper input sanitization and outpu...