15404 matches found
HackerOne: Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on Mobile
The domain highlighting functionality on the External Link Warning interstitial page was not working as intended on the Chrome and Microsoft Edge mobile browsers. The issue was reported to have been previously fixed by HackerOne, but it appears to have resurfaced. The vulnerability could have...
Nextcloud: External storage - global credentials returned to the client side in plaintext
The security advisory reported that external storage credentials were returned to the client side in plaintext...
U.S. Dept Of Defense: HTML Injection into https://www.██████.mil
HTML Injection vulnerability was identified on the website www.██████.mil. The vulnerability allowed attackers to inject malicious HTML code, which could have compromised the security and integrity of the website. Input validation and output encoding were recommended as mitigations to prevent suc...
Basecamp: Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)
The Basecamp mobile application was found to be vulnerable to a path traversal issue. By crafting a malicious deeplink with a specific "filename" parameter, an attacker could force the application to save user data to any directory on the device, including locations accessible to other applicatio...
Basecamp: Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com
The vulnerability in the Navgraph system allowed any third-party app to send and read requests from the server at app.hey.com...
U.S. Dept Of Defense: Subdomain takeover ██████
The subdomain █████ was found to be pointing to open-elb-prod-277276106.us-east-1.elb-amazonaws.com., and the domain elb-amazonaws.com was available for registration. This vulnerability could have been exploited to host unwanted content, receive email, and potentially execute cross-site scripting...
HackerOne: Private draft report exposure in a program a user is added as a viewer to
A vulnerability was identified where adding a user as a program viewer caused them to be subscribed to draft reports within that program. This subscription resulted in the program viewer receiving notifications for every comment posted on a draft report. The vulnerability led to the exposure of...
curl: Denial of Service in curl Request - HTTP headers eat all memory
Vulnerability description not provided...
curl: Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities
Vulnerability description not provided...
Shopify: Exposure of shopify employee summit page allows anonymous user to place orders for free books
Vulnerability description not provided...
curl: Unicode-to-ASCII conversion on Windows can lead to argument injection and more
Vulnerability description not provided...
Rocket.Chat: The initial E2EE password generated by Rocket.Chat mobile can be recovered in a practical timescale.
The initial E2EE password generated by Rocket.Chat mobile prior to version 4.5.1 was found to have insufficient entropy, allowing it to be recovered in a practical timescale by an attacker...
Enjin: Cloudflare /cdn-cgi/ path allows resizing images from unauthorised sources on enjinusercontent.com
The Cloudflare /cdn-cgi/ path on enjinusercontent.com was discovered to allow resizing and rendering of images from unauthorized sources without restriction. This behavior could have led to HTML injection, SSRF, and portal scanning attacks, as well as the unrestricted display of external resource...
Mozilla: Subdomain takeover on one of the subdomains under mozaws.net
Subdomain takeover was discovered on a subdomain under mozaws.net due to a dangling DNS record. The dangling record was registered by researchers, allowing them to host content under the affected subdomain...
HackerOne: Bypassing Two-Factor Authentication via Account Deactivation and Password Reset
Vulnerability description not provided...
Internet Bug Bounty: [CVE-2024-32464] ActionText ContentAttachment’s can Contain Unsanitized HTML
CVE-2024-32464 ActionText ContentAttachment's can Contain Unsanitized HTML Instances of ActionText::Attachable::ContentAttachment included within a richtextarea tag were discovered to potentially contain unsanitized HTML. This vulnerability was assigned the CVE identifier CVE-2024-32464. Versions...
MTN Group: FULL ACCOUNT TAKEOVER
The selfservice portal at https://mymtn.com.ng/ allowed an attacker to take over any Nigerian MTN phone number. The attacker was able to access the account holder's personal information, such as date of birth and full name. The attacker also had the ability to use any available airtime on the...
pixiv: Disclose Hidden Comments on Media Section of hub.vroid.com
A vulnerability was discovered in the Media section of the website where hidden comments could be disclosed. By intercepting a request to like a specific comment, the attacker was able to retrieve the content of the hidden comment, which should have only been visible to the original poster...
Mattermost: Posts sent via websockets aren't sanitized properly
The posts sent via websockets in the Mattermost application were not properly sanitized, allowing attackers to inject malicious content. The vulnerability enabled the creation of customized permalink embeds and YouTube embeds with arbitrary content, which could lead to denial-of-service issues an...
Automattic: Authentication & Registration Bypass in Newspack Extended Access
The Newspack Extended Access plugin omitted to verify JWT signing on the registration and login JSON endpoint. This permitted registration of accounts with arbitrary user-supplied details, and authentication bypass and account hijack if a target account email was known...
LinkedIn: Can see phone numbers of others by providing mail address
The vulnerability allowed an attacker to view a user's phone number by abusing the password reset functionality. The phone number was exposed in the input field after verifying the user's email address...
Ionity GmbH: HTML injection in swagger UI
A vulnerability was discovered in the Swagger UI that allowed for HTML injection. This vulnerability existed because the application failed to properly sanitize user-supplied input before rendering it in the HTML context. An attacker could have exploited this issue to execute arbitrary scripts in...
HackerOne: [ Spot Check ] Team members can edit a user's write-up
Team members could edit a user's spot check write-up. The write-up could be modified through a GraphQL request, even though there was no option to edit the write-up in the user interface. This was considered unintended functionality, as HackerOne had previously fixed vulnerabilities where team...
HackerOne: Improper Authentication - 2FA OTP Reusable
Vulnerability description not provided...
HackerOne: 2FA requirement bypass when claiming bounty
Vulnerability description not provided...
GitLab: IDOR Exposes All Machine Learning Models
The vulnerability allows an attacker to access any Machine Learning Model Registry in GitLab, including private models, by guessing the incremental model IDs. The attacker can also access different versions of the models. This vulnerability was present in GitLab versions 15.11 and 16.2...
Internet Bug Bounty: CVE-2024-31079 in nginx
CVE-2024-31079 was discovered in the NGINX HTTP/3 QUIC module. When NGINX Plus or NGINX OSS were configured to use this module, undisclosed HTTP/3 requests could cause NGINX worker processes to terminate or experience other potential impact. The vulnerability was classified as a stack-based buffe...
Internet Bug Bounty: CVE-2024-32760 in nginx
CVE-2024-32760 was discovered in the HTTP/3 QUIC module of NGINX Plus and NGINX OSS. When the module was configured, undisclosed HTTP/3 encoder instructions could cause NGINX worker processes to terminate or experience other potential impact...
Internet Bug Bounty: CVE-2024-35200 in nginx
CVE-2024-35200 was discovered in NGINX Plus and NGINX OSS when configured to use the HTTP/3 QUIC module. Undisclosed HTTP/3 requests were found to cause NGINX worker processes to terminate...
HackerOne: [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery"
A vulnerability was discovered that allowed hackers to disclose private metadata about Spot Checks, including the number of hackers and the selection criteria. The vulnerability was triggered by navigating to a specific URL and accessing the "SpotCheckSingleQuery" parameter, which returned this...
WakaTime: IDOR to view order information of users and personal information
Vulnerability description not provided...
RATELIMITED: Subdomain takeover in GitLab Pages [george.ratelimited.me]
A subdomain takeover vulnerability was discovered in GitLab Pages. Subdomains could be taken over without verification of domain ownership. The vulnerability allowed an attacker to gain control of the subdomain...
GitLab: Subdomain takeover in Gitlab pages
The vulnerability allowed an attacker to take over a dangling custom domain pointing to GitLab Pages using "instanceX.gitlab.io". The problem arose when adding a custom domain to GitLab Pages without verifying the domain, as it would still serve content for 7 days before being disabled...
Basecamp: Stored XSS on trix editor version 2.1.1
The Trix editor version 2.1.1 was vulnerable to stored cross-site scripting XSS attacks. The vulnerability was caused by improper sanitization of content pasted into the editor, allowing an attacker to embed malicious scripts that were executed within the context of the application...
U.S. Dept Of Defense: Self XSS
A self-XSS vulnerability was discovered in the search function at "https://█████████/ords/f?p=1001:2::::::" where a normal XSS payload could be injected and executed...
Internet Bug Bounty: Possible XSS Vulnerability in Action Controller
There was a possible XSS vulnerability when using the translation helpers translate, t, etc in Action Controller. The vulnerability was assigned the CVE identifier CVE-2024-26143. Affected versions were 7.0.0 and above. The issue was fixed in versions 7.1.3.1 and 7.0.8.1...
Internet Bug Bounty: Possible DoS Vulnerability with Range Header in Rack
A potential denial-of-service vulnerability was discovered in the Rack web server interface for Ruby. The vulnerability was assigned the CVE identifier CVE-2024-26141 and affected versions of Rack 1.3.0 and later. The vulnerability was caused by carefully crafted Range request headers, which coul...
U.S. Dept Of Defense: CVE-2023-26347 in https://████.mil/hax/..CFIDE/adminapi/administrator.cfc?method=getBuildNumber&_cfclient=true
CVE-2023-26347 was discovered in Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier. The vulnerability was an Improper Access Control issue that could result in a Security feature bypass. Unauthenticated access was possible to the administration CFM and CFC endpoints...
Basecamp: Account takeover via insecure intent handling
The Basecamp app was vulnerable to account takeover due to insecure intent handling. A malicious app installed on the same device could obtain the user's Oauth2 token and take over their account...
HackerOne: Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports
The vulnerability allowed an unauthorized user to close a report as a duplicate of another report from a different program or organization. The root cause was an improper access control check that did not account for limited disclosure reports or the original report being in the same organization...
Glassdoor: Cross-Site Leakage of Review Ownership via Navigation Detection
A vulnerability allowed detection of user login status by exploiting differences in Cross-Origin-Opener-Policy COOP headers between authenticated and unauthenticated states on the website. The issue was addressed by implementing consistent COOP headers across all domains...
Tools for Humanity: [Meetup][World ID][OIDC] Insufficient Filtering of "state" Parameter in Response Mode form_post leads to XSS and ATO
A lack of proper validation in the state parameter of the World ID OIDC authentication logic allowed the injection of HTML characters into the response body when using formpost as the OIDC response mode. This vulnerability was mitigated by the Content Security Policy CSP...
Mozilla: csrftoken not unique to session or specific user and csrfmiddlewaretoken can be altered
The CSRF token used in the application was not unique to the session or specific user, allowing an attacker to use a valid CSRF token obtained from another user to perform unauthorized actions on behalf of that user...
HackerOne: Program Member Could Duplicate Report To A Non Related Program Original Report
The vulnerability allowed a program member to duplicate a report to a report that was not related to the original program. This could lead to integrity issues, as the duplicate report should only be from reports within the original program...
U.S. Dept Of Defense: Out-Of-Bounds Memory Read on ███
Vulnerability description not provided...
Shopify: Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering
A reflected XSS vulnerability was reported in the AI chat bot greetings at help.shopify.com. The issue was caused by the rendering of a markdown image in the greeting, which allowed the attacker to inject a payload through the image URL. The vulnerability was addressed by removing the...
Nextcloud: Mail auto configurator can be tricked into sending account information to wrong servers
The mail auto configurator was vulnerable to being tricked into sending account information to unintended servers...
Booking.com: Default Admin Account lead to full access control at https://desk-demo.fareharbor.engineering
Login to the application at https://desk-demo.fareharbor.engineering/login with [email protected], password: test F3271060 2. Realizing that the login is successful, the attacker can use all functions in the application. F3271059 Impact attacker can use all admin functions...
GitHub: Information Leakage via Clicked Link in GitHub Repository (Fingerprinting)
A vulnerability was identified in GitHub Enterprise Server that allowed an attacker to retrieve metadata information of a user who clicks on an uploaded malicious asset URL. The vulnerability affected all versions prior to 3.14 and was fixed in later versions...