15693 matches found
HackerOne: Ability to access policy and updates for unauthorized program
The vulnerability allowed an unauthorized user to access the policy and updates for a restricted program using an API key. The user was able to retrieve sensitive data from the unauthorized program, even though they were only granted access to one of the two programs in the organization...
Autodesk: Insecure Direct Object Reference (IDOR) Vulnerability in Autodesk User Profile
An Insecure Direct Object Reference IDOR vulnerability was discovered in the Autodesk User Profile. The vulnerability was found in the "id" parameter, which could have allowed an attacker to edit another user's profile...
Autodesk: Django Debug Mode Enabled - Information Disclosure on api.wwm-dev.autodesk.com
The domain api.wwm-dev.autodesk.com was discovered to have Django debug mode enabled, which led to information disclosure. The issue was fixed by Autodesk...
Top Echelon Software: Clickjacking in main domain https://topechelon.com/
The target website was vulnerable to Clickjacking, a web-based attack that tricked users into interacting with a hidden or disguised iframe. The vulnerability could have been exploited to manipulate user actions, potentially leading to unauthorized activities...
U.S. Dept Of Defense: 2FA Bypass via Response Manipulation on Login Page
A vulnerability was discovered in the Two-Factor Authentication 2FA mechanism of the website. The vulnerability allowed bypassing the 2FA verification process by intercepting and manipulating the server's response. As a result, an attacker could gain unauthorized access to an account after...
Autodesk: IDOR Vulnerability Allowing Unauthorized Profile Picture Change
An IDOR vulnerability was found on the Autodesk User Profile, which allowed an attacker to edit another user's profile picture. The vulnerability was reported and has been fixed by Autodesk...
curl: curl allows SSH connection even if host is not in known_hosts
Summary: Curl does not fail if the SSH host identity cannot be verified due to the host not being included in the .ssh/knownhosts file. This makes using curl to login into an previously unknown ssh host system vulnerable to meddler in the middle attacks. When using key based authentication it wil...
MTN Group: SQLi | in URL paths
The vulnerability summary is as follows: A SQL injection vulnerability was discovered in the customerId parameter of the URL path. The vulnerability was demonstrated by adding a quote in the customerId parameter, which resulted in an error indicating that the application was vulnerable to SQL...
Brave Software: Null Pointer Dereference by Crafted Response from AI Model
The Brave browser was affected by a null pointer dereference vulnerability caused by a crafted response from an AI model. The vulnerability was triggered when the user set a malicious endpoint as the AI model's server endpoint. The code handling the server response assumed a specific structure...
XVIDEOS: Open redirect
Summary: An open redirect vulnerability was discovered on the website https://www.xnxx.com/todays-selection/1. This issue allows attackers to modify URLs to redirect users to arbitrary external websites, including malicious or phishing sites. The vulnerability can be exploited by manipulating...
XVIDEOS: Stored XSS via SMTP Error Message
A Stored Cross-Site Scripting XSS vulnerability was identified on the /account/email page for www.xvideos.com. The vulnerability arose from the improper handling of SMTP error messages, which were passed into the html method without proper sanitization, allowing an attacker to store and execute...
curl: CVE-2025-0725: gzip integer overflow
The libcurl library contained a vulnerability in the gzip content encoding function that allowed a malicious HTTP server to craft an arbitrary heap chunk in the memory of the victim and trigger a free of that forged chunk. This was possible due to an integer overflow in the handling of gzip...
IBM: Weak credentials found in Jenkins endpoint
Weak credentials were discovered in a Jenkins endpoint. The issue was reported to IBM, analyzed, and remediated...
U.S. Dept Of Defense: ASBS Analytics Dashboard
A dashboard was found to provide authenticated users with access to user and session analytics for the platform. The dashboard allowed users to view information such as active boards, total candidates, vote rate, and estimated completion in the last 12 days. The affected product version was...
U.S. Dept Of Defense: ASBS viewing other soldiers PII/Board/Board Voters/ETC
The vulnerability allowed an authenticated user to run GraphQL queries that returned sensitive information on other users, such as their personally identifiable information, board information, and clearance details. The vulnerability was present in version 1.09.00.0 of the affected system and...
curl: CVE-2025-0665: eventfd double close
Summary: GitHub issue 15725 describes a double close in libcurl 8.11.1. I believe that a double close in multi threaded code should be considered a security vulnerability. A fix already exists for this, so it should be good in the next release. I am not 100% sure this is the place to be making su...
AWS VDP: Non-Production API Endpoints for the bedrock Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
The bedrock service was found to have 5 non-production API endpoints that could be used with standard IAM credentials to enumerate permissions without logging to CloudTrail. The impacted endpoints allowed the invocation of bedrock:ListImportedModels and bedrock:ListModelImportJobs actions. This...
U.S. Dept Of Defense: Applicant security exam Attachments/Documents accessible through an IDOR/BAC on the custom Apex controller on https://█████.mil
The applicant security exam contained an Insecure Direct Object Reference IDOR vulnerability on the custom Apex controller on the https://█████.mil portal. The vulnerability allowed an attacker to switch the ownership of any Attachment record and access the files, which contained sensitive...
Yelp: RXSS AT https://proze.yelp.com/tmsubscribe.net/vidsn.aspx
The proze.yelp.com domain was vulnerable to Cross-Site Scripting XSS attacks, which allowed the injection of malicious scripts that could affect the security of users of the domain...
Nextcloud: Sensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/
A cache control vulnerability was identified on the https://apps.nextcloud.com/account/ page. After logging out, sensitive information such as the user's first name, last name, and email address remained accessible by using the browser's back button. This occurred due to improper caching of...
curl: Authorization Header Leak via --location-trusted in Curl
Curl's --location-trusted Option Leaks Authorization Header Across Domains The --location-trusted option in Curl forwards the Authorization header when following cross-origin redirects, exposing Basic Authentication credentials to untrusted hosts. - If an attacker controls a redirecting endpoint,...
Yelp: Unauthorized Reservation Cancellation Through IDOR Vulnerability
Vulnerability description not provided...
curl: Elevation of Privileges (EoP) vulnerabilities related to the some easy_options on Windows
Summary An Elevation of Privileges EoP vulnerability can occur in a Windows privileged process that uses CURLOPTCOOKIEJAR, CURLOPTHSTS, or CURLOPTALTSVC. This vulnerability arises due to the differences in the implementation of the unlink function between Windows and Linux, as well as the behavio...
Internet Bug Bounty: CVE-2024-56374: Denial-of-service vulnerability in IPv6 validation
A denial-of-service vulnerability was discovered in Django's IPv6 validation. The lack of an upper bound limit enforcement in strings passed during IPv6 validation could lead to a potential denial-of-service attack. The vulnerable functions, cleanipv6address and isvalidipv6address, as well as the...
Internet Bug Bounty: CVE-2024-56374 Potential denial-of-service in IPv6 validation
CVE-2024-56374: Potential denial-of-service vulnerability in IPv6 validation A potential denial-of-service vulnerability was discovered in the IPv6 validation functions of Django. The lack of an upper bound limit on the length of input strings passed to the private functions cleanipv6address and...
HackerOne: Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information
Publicly available GitHub repositories for HackerOne-managed triage team profiles were found to contain private HackerOne vulnerability reports. Several repositories were identified that reproduced exploits for private bug bounty programs. The disclosed information included details such as access...
Stripo Inc: [my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to Zapier
A critical Blind SSRF Server-Side Request Forgery vulnerability was identified in the export service of the Stripo app. The vulnerability existed in the endpoint /exportservice/v3/exports/WEBHOOK/accounts, where malicious input could be provided in the webhookUrl parameter, triggering SSRF and...
Basecamp: Improper Cache Handling Allows Access to Post-Logout Pages
The report detailed how some browsers' bfcache allowed access to post-logout pages...
Internet Bug Bounty: #2931639 ActionView sanitize helper bypass with math-related tags
There is a vulnerability in Rails-HTML-Sanitizer 1.6.0, which is also used by Rails ActionView. The vulnerability allows for bypassing the sanitization process when certain math-related tags, such as "math", "mtext", "table", "style", and "mglyph" or "malignmark", are allowed. This could lead to...
Internet Bug Bounty: ActionView sanitize helper bypass with style
The Rails-html-sanitizer, which Rails ActionView also uses, failed to sanitize input when the style tag was allowed, leading to a potential XSS vulnerability. The vulnerability affected version 1.6.0 of the sanitizer and was addressed in version 1.6.1...
Internet Bug Bounty: ActionView sanitize helper bypass with style and math
The Rails-html-sanitizer version 1.6.0 was affected by a vulnerability that could lead to a bypass of the sanitization process, resulting in potential cross-site scripting XSS attacks. The vulnerability was addressed in version 1.6.1...
Internet Bug Bounty: ActionView sanitize helper bypass with 'style' and 'svg' tags
The Rails-html-sanitizer, which Rails ActionView also uses, failed to sanitize input when svg and style or math and style tags were allowed. This resulted in a potential XSS vulnerability in applications that used the sanitize helper...
Internet Bug Bounty: ActionView sanitize helper bypass with noscript
The Rails-html-sanitizer 1.6.0 contained a vulnerability that allowed bypassing the sanitization process when the noscript tag was used. This could have led to potential cross-site scripting XSS attacks in applications that used the vulnerable version of the sanitizer, including those using the...
Cosmos: Attacker can use any non-enabled capability
The Capabilites implementation in CosmWasm contracts was found to have a vulnerability. Even if the executing chain did not allow a specific capability, a CosmWasm contract could still execute actions that required that capability. This was due to a naive implementation of capabilities and...
U.S. Dept Of Defense: ASP.NET Application Trace Enabled
The ASP.NET application trace feature was enabled on a public-facing URL, which exposed sensitive internal information, including Session ID values and the physical file paths of server-side resources. This vulnerability could have allowed attackers to gain unauthorized insights into the server...
U.S. Dept Of Defense: Public google drive link Exposes Military Orders Containing PII (Name, SSN etc..) and Operational Details
A public Google Drive link was found that exposed military orders containing personally identifiable information PII such as full names, Social Security numbers, home addresses, and security clearance levels. The vulnerability was discovered on a website located at...
AWS VDP: Non-Production API Endpoints for the ssm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
The non-production API endpoints for the ssm service were found to fail to log to CloudTrail, resulting in silent permission enumeration. Eighteen non-production endpoints were identified that can be used with standard IAM credentials without generating CloudTrail logs...
Nextcloud: Blind SSRF Vulnerability in Appstore Release Upload Form
Vulnerability description not provided...
1Password - Enterprise Password Manager: API Key Exposed in JavaScript File on 1Password Developer Site
An API key has been exposed in the JavaScript file accessible via the public developer documentation for 1Password. This exposure could potentially allow unauthorized access to APIs or services that rely on this key, leading to a range of security issues, including data leakage or unauthorized...
Doppler: WAF bypass and java script incomplete handling of Unicode characters might leads to dom-xss
hello, WAF : doppler uses cloudfare firewall to prevent unwanted malicous injections "https://share.doppler.com/ext/jquery/dist/jquery.min.js?c=%22%3Cscript%3Ealert%27XSS%27%3C/script%3E%22" by accessing the endpoint you'll get to know that! But I found that this code ""%0D%0A%0D%0A" bypass the...
TikTok: Unauthorized Access to Private Video Description via Translation API for Private Accounts
A vulnerability was discovered in the TikTok translation API endpoint that could have allowed unauthorized access to video descriptions contained in private accounts...
Internet Bug Bounty: Deadlock in x86 HVM standard VGA handling
The Xen hypervisor contained a vulnerability in its handling of standard VGA memory accesses for HVM guests. The locking mechanism used had an unusual discipline that could lead to a deadlock when emulating an instruction with two memory accesses to VGA memory. The vulnerability was acknowledged ...
IBM: There is a POST based CSRF issue over IBM endpoint leading to modification of contact information.
There was a CSRF vulnerability found in an IBM endpoint that allowed modification of contact information through a POST request...
Informatica: XSS1
The XSS vulnerability was discovered in the search functionality of the Informatica website. The vulnerability allowed an attacker to inject arbitrary JavaScript code into the search results, which could be executed by the user's browser...
Cosmos: Replacing ICA active channel during the upgrade and a bit more
The active channel on the ICA controller was set during the channel acknowledgement, which was a check-then-act operation that was not atomic. The active channel on the ICA host was set during the channel open confirmation, but the check for the channel existence was not atomic. This allowed an...
curl: CVE-2025-0167: netrc and default credential leak
Summary: The fix for CVE-2024-11053 seems to be incomplete.The information leak problem could be reproduced again if use netrc in step1. Affected version all Steps To Reproduce: 1. Adapt test479 to use netrc like belowboth of user and password are not provided for b.com: machine a.com login alice...
Trendyol: Cache Poisoning Allows Zero Interaction Store XSS
The vulnerability allowed an attacker to perform a cache poisoning attack, which resulted in a zero-interaction stored cross-site scripting XSS vulnerability on the Trendyol website. The attack was achieved by modifying the User-Agent header and adding a malicious parameter to the URL, which was...
Mozilla: Netlify Authentication Token Exposed in Public Mozilla CI Logs
A critical vulnerability was discovered involving the exposure of a Netlify authentication token within publicly accessible logs. The token provided full access to the "Mozilla IT Web SRE" Netlify account, bypassing all restrictions. The token's permissions encompassed roles such as Owner,...
XVIDEOS: Lack of Rate Limiting on Account Creation Endpoint
A vulnerability was identified in the account creation process. The affected endpoint lacked proper rate limiting mechanisms, allowing for the automated creation of multiple user accounts without restrictions. This security flaw could be exploited using tools to generate a large number of fake...
curl: Git repository found
Summary: Hello team , When i research I found domain vuln to downliad git repository and i will explain that. Steps To Reproduce: 1. Add DotGit extention on your browser 2. Now try to access to that domain https://curl.dev/ 3. You will show that extention is alert and can download that bucket...