Node.js: Proxy-Authorization header is not cleared in cross-domain redirect in undici

A vulnerability was found in undici prior to version 6.5.0 where the Proxy-Authorization header was not cleared during cross-domain redirects, potentially leaking credentials to third party sites...

curl: cookie is sent on redirect

Vulnerability description not provided...

IBM: XSS in IBM InfoCenter

The IBM InfoCenter was found to have an XSS vulnerability. The issue was reported to IBM, analyzed, and has been remediated...

MTN Group: Improper Access Controls(Admin Path)

The vulnerability involved improper access controls that allowed the admin path "/wp-admin/admin-ajax.php" to be accessed on the "https://nin.mtn.ng/" website. This could have potentially allowed unauthorized access to sensitive information...

Internet Bug Bounty: CVE-2024-0853: OCSP verification bypass with TLS session reuse

CVE-2024-0853 was a vulnerability in the cURL library where OCSP verification was bypassed when reusing a TLS session. The vulnerability was caused by cURL inadvertently keeping the SSL session ID in its cache even when the OCSP stapling verification failed. This allowed subsequent transfers to t...

Mars: Account takeover using reset password link

A vulnerability was found in the Mars website where the reset password functionality could be manipulated. The reset password link sent via email contained a parameter that specified the path of the reset password page. An attacker could modify this parameter to redirect users to a domain under...

Internet Bug Bounty: Apache Airflow: Bypass permission verification to read code of other dags

CVE-2023-50944: Apache Airflow: Bypass permission verification to read code of other dags Severity: low Affected versions: Apache Airflow before 2.8.1 Description: Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to...

LinkedIn: Blocking a company page admin prevents him from delete paid media admin or edit his roles

A company page admin was prevented from managing deleting or editing roles of a paid media admin when the paid media admin blocked the company page admin. This created an access control vulnerability where administrative privileges were circumvented through the platform's social blocking feature...

IBM: XSS Refelected on jazz.net

A cross-site scripting vulnerability was reported on jazz.net. The issue was analyzed and remediated by IBM...

Monero: RPC service DOS

The RPC service running on port 18081 or 28081, 38081 was vulnerable to a denial-of-service attack due to a loop iterating until the maximum range of a 64-bit unsigned integer. The vulnerability was present in all versions after the commit b030f207517f59a5122409398549a02ac23829ae, up to and...

Sheer: Cleartext Transmission of password via Email

The password was sent to the user's email in cleartext after successful signup as a fan...

ownCloud: Authentication Bypass with usage of PreSignedURL

The ownCloud Infinite Scale oCIS was identified to be vulnerable to an authentication bypass vulnerability due to an issue with the default-enabled PreSignedURL feature. The vulnerability allowed access to any file without authentication, given the prior knowledge of the username and filename. Th...

GitHub: Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise Server

An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported...

Internet Bug Bounty: Pickle deserialization vulnerability in XComs

CVE-2023-50943: Apache Airflow: Potential pickle deserialization vulnerability in XComs Severity: low Affected versions: - Apache Airflow before 2.8.1 Description: Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the...

Ruby on Rails: Path traversal in AcitveStorage, and lead RCE

Vulnerability description not provided...

Publitas: CVE-2018-6389 exploitation - using scripts loader

An unauthenticated denial of service vulnerability in WordPress was discovered, tracked as CVE-2018-6389. By requesting a large number of JavaScript files through the load-scripts.php endpoint, an attacker could consume excessive resources on the server. This vulnerability could allow denial of...

U.S. Dept Of Defense: Improper Authentication (Login without Registration with any user) at ████

The ████ system was vulnerable to an improper authentication issue. Attackers could log in as any user without registration by exploiting the signin parameter in the ██████████ endpoint. This allowed them to authenticate and change the session of a victim to any other user...

Internet Bug Bounty: Denial of Service caused by HTTP/2 CONTINUATION Flood

A denial of service vulnerability was discovered in Apache Tomcat versions 11.0.0-M1 to 11.0.0-M16, 10.1.0-M1 to 10.1.18, 9.0.0-M1 to 9.0.85, and 8.5.0 to 8.5.98. The vulnerability was caused by the way Tomcat processed HTTP/2 requests that exceeded configured limits for headers. A fix was releas...

Publitas: CORS Misconfiguration on █████

A cross-origin resource sharing misconfiguration was found that could allow an attacker to steal sensitive user information or force unwanted actions. The misconfiguration allowed credentials and enabled CORS for external domains. A proof of concept was shown that could exploit this to exfiltrate...

GitHub: Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forward

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring audit log forwarding. This vulnerability affected all versions of GitH...

GitHub: Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring SMTP options. This vulnerability affected all versions of GitHub...

8x8 Bounty: Open Redirect via Non-Latin Subdomain in vcc-*.8x8.com/AGUI/█.php

The report described an Open Redirect vulnerability in the vcc-.8x8.com/AGUI/█.php endpoint, where a filter that prevented the use of 1-9 and a-z characters in the subdomain parameter could be bypassed by utilizing a non-Latin domain. The vulnerability was demonstrated by redirecting to the...

GitHub: Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in collectd

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting the username and password for collectd configurations. This vulnerability affected all version...

GitHub: Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ng

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the syslog-ng configuration file. This vulnerability affected all versions of GitHub Enterprise Server...

Internet Bug Bounty: CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)

SECURITY CVE-2024-21733 Apache Tomcat - Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0-M11 to 9.0.43 Apache Tomcat 8.5.7 to 8.5.63 Description: Incomplete POST requests triggered an error response that could contain data fr...

Enjin: Lack of Tenant Scoping Enables Limited Cross-Tenant Data Querying and Mutation

A vulnerability was demonstrated on the Enjin Platform that allowed for limited cross-tenant data querying and mutation, enabling querying or mutating of someone else's data in certain cases. A full assessment found this had not been exploited outside of the report...

Nextcloud: Deck app allows to spoof file extensions by using RTLO characters

The Deck app was found to allow spoofing of file extensions by using RTLO characters...

Internet Bug Bounty: Argo CD CSRF leads to Kubernetes cluster compromise

Cross-Site Request Forgery CSRF in github.com/argoproj/argo-cd CVE-2024-22424 Severity: High Impact The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.16 are vulnerable to a cross-server request forgery CSRF attack when the attacker has the ability to write HTML to a page on the sa...

GitHub: Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-check

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting up an HTTP proxy. This vulnerability affected all versions of GitHub Enterprise Server prior t...

HackerOne: Program admins could add verified domains to an organization

Program admins could add verified domains to an organization in HackerOne despite lacking organization admin permissions. This allowed program admins to access restricted features and escalate privileges...

GitHub: Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in actions-console

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the actions-console docker container while setting a service URL. The vulnerability affected all versio...

MTN Group: Insecure direct Object Reference(Horizontal Escalation)

The vulnerability allowed for insecure direct object reference horizontal escalation. Specifically, the user's dashboard was accessed without authentication, and the text content was modified through client-side inspection and manipulation...

HackerOne: Being able to disclose IBB bounty table of any public program

A private Internet Bug Bounty IBB bounty table was disclosed. The IBB bounty table contained information about the reward amounts for critical, high, medium, and low vulnerabilities in open-source projects...

MTN Group: DOM Based Reflected Cross Site Scripting

The outdated version of Swagger used by the notification-server-v2.sz-my.mtn.com asset was found to be vulnerable to a DOM-based reflected cross-site scripting vulnerability. The vulnerability was triggered by crafting a malicious URL that resulted in the execution of arbitrary scripts in the...

MTN Group: Broken Access Control(Horizontal Privilege Escalation).

The vulnerability allowed unauthorized users to gain access to sensitive information by modifying the phone number parameter in the URL. This led to a breach of access controls and potential security risks...

Node.js: "Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash

A vulnerability was discovered in the Node.js HTTP/2 stack http2 package. An attacker could send a small amount of TCP packets with HTTP/2 frames, causing the Node.js server to crash due to an assertion failure in the Http2Session destructor. The issue occurred when headers with HTTP/2 CONTINUATI...

Drugs.com: Email OTP/2FA Bypass

The application had a 2FA functionality by email OTP. The vulnerability allowed bypassing the 2FA by deleting the "bbrefresh" cookie during the authentication process. This enabled successful login without the required 2FA...

Monero: Transactions in invalid blocks are kept in tx-pool without undergoing certain checks.

The transactions in invalid blocks were kept in the tx-pool without undergoing certain checks. When adding blocks to the blockchain, monerod first added the transactions to the tx pool with relaymethod::block, which allowed the tx-pool to skip certain checks like fee and extra field size. However...

Mars: CSRF resulting in adding pet at ███████

A Cross-Site Request Forgery CSRF vulnerability was discovered in the application, allowing an attacker to forge requests to add pets to the victim's account, provided the attacker knew the victim's account ID...

U.S. Dept Of Defense: Full Access to sonarQube and Docker

The vulnerability involved the exposure of sensitive credentials and IP addresses in a JavaScript file. The researcher gained access to the organization's Hub Docker account and Sonar projects, allowing them to identify and assess the issue. The vulnerability was caused by a JavaScript file withi...

U.S. Dept Of Defense: Time based SQL injection at████████

A time based SQL injection vulnerability was found in the /pubs/index.php endpoint on ██████. The 'years' and 'authors' parameters were vulnerable, allowing time delays to be introduced in database queries. This could have led to sensitive data exfiltration from the database. The issue could be...

Enjin: Weak Email Verification: Newly Registered Users Can Bypass Email Verification Step and Log In

Newly registered users were able to bypass email verification and log in. This vulnerability has since been addressed...

Enjin: Revocation API Token by Bypassing The XSRF Token

The revocation API token was bypassed by bypassing the XSRF token. This allowed the demonstration that the Enjin Platform's GraphQL interface lacked appropriate CSRF protection when utilizing a session token...

HackerOne: View Titles of Private Reports with pending email invitation

A vulnerability was discovered where anonymous users could view the titles of private reports with pending email invitations for collaboration. This was possible by sending a GraphQL request or running JavaScript code while logged out. It only worked for anonymous users when the collaboration...

Nextcloud: Directory Listing of publicly available assets

The directory listing was configured to publicly display the files in the directory. This configuration is not recommended, as it may expose sensitive or confidential information...

HackerOne: New Hacktivity features:Bounty rewards leakage Where programs doesn’t decide to disclose bounty in limited disclosure report

The report describes a vulnerability where users could access hidden bounty information on the HackerOne Hacktivity page. Specifically, by using a filter to search for reports with a specific total awarded amount, the actual bounty amount was revealed, even if the program chose to limit the...

MTN Group: CVE-2023-41763 Business Elevation of Privilege vulnerability on [.mtn.com]

The Microsoft Skype for Business installation on the remote host was missing security updates. The flaw was actively exploited. Attackers could access some sensitive information but not alter or restrict access to it. The impact related primarily to confidentiality. Multiple vulnerabilities were...

Mars: Sensitive Information Exposed at █████

Sensitive information was exposed in a JavaScript file, revealing configuration details, credentials, and file paths related to the deployment of a JavaScript application. This could enable unauthorized access to sensitive data...

IBM: XSS in Aspera documentation website

The XSS vulnerability in the Aspera documentation website was reported to IBM, analyzed, and subsequently remediated. The external researcher who discovered the flaw was acknowledged for their contribution...

Mars: Datadog api keys exposed can be used to do all the read and write access to the instance

A vulnerability was identified where Datadog API keys were exposed in a JavaScript file, which could have enabled unauthorized access to Datadog services. The issue was responsibly disclosed along with a proof-of-concept demonstration...