15693 matches found
inDrive: Change phone number OTP flaw leads to any phone number takeover
Vulnerability description not provided...
U.S. Dept Of Defense: Email Takeover leads to permanent account deletion
The security vulnerability found allowed an attacker to change the email address of a victim's account, leading to the permanent deletion of the victim's account. The vulnerability was caused by improper authentication on the change email functionality...
U.S. Dept Of Defense: Cross Site Scripting
The researchers discovered a cross-site scripting XSS vulnerability on the www.███.██████████ website. The vulnerability was found to only work in the Firefox browser. The affected product and version were not specified. No CVE numbers were provided. The vulnerability allowed for the execution of...
Mars: Reflected HTML Injection via contact (faq) search parameter on ██████████
The report describes a reflected HTML injection vulnerability in the contact faq search parameter on the ██████████. A specific HTML payload entered into this parameter was reflected back in the response without proper sanitization, allowing for the execution of arbitrary HTML and potentially...
Internet Bug Bounty: moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)
Moderate: Apache HTTP Server proxy encoding problem CVE-2024-38473 An encoding problem was discovered in modproxy in Apache HTTP Server versions 2.4.59 and earlier. This issue allowed request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via...
U.S. Dept Of Defense: IDOR : Modify other users demographic details
The IDOR vulnerability allowed a malicious user to modify other user's demographic details on the vulnerable domain www.█████████. The vulnerability was present in the /JOINOnline/Board/SubmitDoc endpoint, where the user ID parameter was not properly validated, allowing an attacker to update the...
U.S. Dept Of Defense: IDOR leads to view other user Biographical details (Possible PII LEAK)
The researcher discovered an Insecure Direct Object Reference IDOR vulnerability in the www.██████████ domain. The vulnerability allowed a user to access other users' biographical details, leading to a potential Personally Identifiable Information PII leak. The vulnerable endpoints were located i...
U.S. Dept Of Defense: Restrict any user from Login to their account
A security vulnerability was discovered where an attacker could change their email address to the victim's email, effectively restricting the victim from accessing their account. The vulnerability stemmed from improper authentication on the "Update Profile" functionality of the website...
U.S. Dept Of Defense: IDOR leads to PII Leak
The vulnerability allowed the disclosure of other users' email addresses through Insecure Direct Object Reference IDOR. A user could access other users' profile information by modifying the user ID in the URL...
ProductBoard, Inc.: Insecure Invitation Link Handling
The invitation link handling process of satismeter.com was found to have a critical security vulnerability. The issue allowed unauthorized users to join an organization using invitation links sent to different email addresses, bypassing the email verification process. The vulnerability occurred...
Internet Bug Bounty: CVE-2024-34750 Apache Tomcat DoS vulnerability in HTTP/2 connector
CVE-2024-34750: Apache Tomcat Denial of Service Vulnerability A vulnerability was discovered in Apache Tomcat versions between 11.0.0-M1 and 11.0.0-M20, 10.1.0-M1 and 10.1.24, and 9.0.0-M1 and 9.0.89. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers...
MetaMask: Missing Line Terminator on allowedOrigins enables origin spoofing
The vulnerability identified by @pkkr was related to the Snaps allowedOrigins functionality, which allows Snap developers to control which origins can interact with certain Snap APIs. Due to a missing regex terminator, the origin control could be bypassed, enabling a malicious domain to access...
Internet Bug Bounty: moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)
moderate: Apache HTTP Server: HTTP response splitting CVE-2023-38709 Faulty input validation in the core of Apache allowed malicious or exploitable backend/content generators to split HTTP responses. This issue affected Apache HTTP Server through version 2.4.58...
Internet Bug Bounty: moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573) CWE-20 Improper Input Validation
moderate: Apache HTTP Server proxy encoding problem CVE-2024-38473 An encoding problem was discovered in modproxy in Apache HTTP Server versions 2.4.59 and earlier. This issue allowed request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via...
Internet Bug Bounty: important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
important: Apache HTTP Server: Crash resulting in Denial of Service in modproxy via a malicious request CVE-2024-38477 A null pointer dereference vulnerability was discovered in modproxy in Apache HTTP Server versions 2.4.59 and earlier. This vulnerability allowed an attacker to crash the server ...
Internet Bug Bounty: important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)
The Apache HTTP Server vulnerability CVE-2024-38476 was discovered in versions 2.4.0 through 2.4.59. The vulnerability allowed the use of exploitable or malicious backend application output to run local handlers via internal redirect. Users were recommended to upgrade to version 2.4.60, which fix...
Internet Bug Bounty: important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
The Apache HTTP Server was found to have a vulnerability in modrewrite where improper escaping of output allowed attackers to map URLs to filesystem locations that were permitted to be served by the server but were not intentionally/directly reachable by any URL. This resulted in potential code...
Internet Bug Bounty: important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
The Apache HTTP Server on Windows contained a SSRF vulnerability CVE-2024-38472 that allowed potential leakage of NTLM hashes to a malicious server. The vulnerability was reported through the official Apache HTTP Server security email on April 1, 2024 and was fixed in version 2.4.60 released on...
Internet Bug Bounty: important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)
The Apache HTTP Server versions 2.4.0 through 2.4.59 were affected by a substitution encoding issue in modrewrite that allowed attackers to execute scripts in directories permitted by the configuration, but not directly reachable by any URL, or disclose the source of scripts meant to be executed ...
Internet Bug Bounty: ReDoS Vulnerability in HTTP Accept Headers Parsing
A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Rack::Request::Helpers module when parsing HTTP Accept headers. The vulnerability was caused by a lack of fix in the Rack v3.1 release series until v3.1.5...
TikTok: DOM XSS in tiktok.com/login via the redirect_url parameter
A DOM Cross-Site Scripting XSS vulnerability was found in the redirecturl parameter on the tiktok.com/login page. The vulnerability was reported and confirmed to be resolved...
Informatica: No rate limiting on form[register]
The vulnerability overview is as follows: There was a lack of rate limiting on the formregister endpoint, allowing an attacker to send a large number of requests to the server in rapid succession without any restrictions. This could potentially have led to accelerated service usage and resource...
HackerOne: Private data related to program exposed via /reports/<id>.json endpoint to external user participant
Vulnerability description not provided...
Rocket.Chat: NoSQL injection leaks visitor token and livechat messages
The Rocket.Chat application was affected by two NoSQL injection vulnerabilities. The first vulnerability allowed leaking visitor tokens by exploiting the livechat:loginByToken method, while the second vulnerability enabled leaking livechat messages by exploiting the livechat:loadHistory method...
GitHub: SAML Signature verification bypass allows logging into any user (with specific conditions)
The vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response and gain unauthorized access to the instance, including site administrator privileges, by exploiting a signature verification bypass. The vulnerability affected all versions of...
Mars: Reflected HTML Injection via contact (faq) search parameter on ███]=
The reflected HTML injection vulnerability was identified in the search parameter of the contact FAQ page on ███████. The vulnerability allowed for the injection and execution of arbitrary HTML and script code in the context of other users' web browsers. The issue was demonstrated through the...
Node.js: Worker permission bypass via InternalWorker leak in diagnostics
The vulnerability allowed for a worker permission bypass through a diagnosticschannel leak that exposed internal workers, enabling the retrieval of their constructor for malicious usage. This affected Permission Model users on Node.js versions 20, 22, and 23...
HackerOne: Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA
Vulnerability description not provided...
U.S. Dept Of Defense: XML External Entity (XXE) Injection
The vulnerability is an XML external entity XXE injection flaw. XXE vulnerabilities occur when an application parses XML input that contains a reference to an external entity. When the XML parser is improperly configured to process external entities, it can lead to unauthorized access to sensitiv...
HackerOne: Business Logic error leads to bypass 2FA requirement
Vulnerability description not provided...
HackerOne: Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program
Vulnerability description not provided...
Smule: Possible Subdomain Takeover For Inbound Emails
The affected URL email.smule.com pointed to sendgrid.net via a DNS CNAME record. As a result, a subdomain takeover was possible by registering the subdomain email.smule.com on Sendgrid...
U.S. Dept Of Defense: XML E██████ternal Entity (XXE) Injection in ███
The vulnerability described in CVE-2022-2414 was an XML External Entity XXE injection flaw. XXE vulnerabilities occur when an application improperly processes XML input containing references to external entities. This allowed access to arbitrary files on the server...
curl: NULL dereference when encoding DN of x509 certificate
Vulnerability description not provided...
curl: CVE-2024-6197: freeing stack buffer in utf8asn1str
The libcurl library at commit 04739054cdac5a0614fb94e3655e313c03399f35 contained an invalid invocation of the free function in the utf8asn1str function. The buffer being freed was located on the stack, which posed a security risk as the freed address could have been later returned by malloc calls...
Rootstock Labs: Crafted smart contract can take ~23 seconds to execute due to immense error string construction
The crafted smart contract can take approximately 23 seconds to execute due to the immense error string construction. The vulnerability was caused by the native contract's implementation, which constructed the entirety of the input message as a hex string for logging and throwing an exception. Th...
U.S. Dept Of Defense: █████████ (Android): Vulnerable to Javascript Injection and Open redirect
A vulnerability was discovered in the WebView components of two apps, ████ and ██████████, which allowed an attacker to execute JavaScript and open any URL through a link or a malicious app. The root cause of this issue was that certain activities were exported and set as browsable, exposing them...
HackerOne: Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on Mobile
The domain highlighting functionality on the External Link Warning interstitial page was not working as intended on the Chrome and Microsoft Edge mobile browsers. The issue was reported to have been previously fixed by HackerOne, but it appears to have resurfaced. The vulnerability could have...
Nextcloud: External storage - global credentials returned to the client side in plaintext
The security advisory reported that external storage credentials were returned to the client side in plaintext...
U.S. Dept Of Defense: HTML Injection into https://www.██████.mil
HTML Injection vulnerability was identified on the website www.██████.mil. The vulnerability allowed attackers to inject malicious HTML code, which could have compromised the security and integrity of the website. Input validation and output encoding were recommended as mitigations to prevent suc...
Basecamp: Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)
The Basecamp mobile application was found to be vulnerable to a path traversal issue. By crafting a malicious deeplink with a specific "filename" parameter, an attacker could force the application to save user data to any directory on the device, including locations accessible to other applicatio...
Basecamp: Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com
The vulnerability in the Navgraph system allowed any third-party app to send and read requests from the server at app.hey.com...
U.S. Dept Of Defense: Subdomain takeover ██████
The subdomain █████ was found to be pointing to open-elb-prod-277276106.us-east-1.elb-amazonaws.com., and the domain elb-amazonaws.com was available for registration. This vulnerability could have been exploited to host unwanted content, receive email, and potentially execute cross-site scripting...
HackerOne: Private draft report exposure in a program a user is added as a viewer to
A vulnerability was identified where adding a user as a program viewer caused them to be subscribed to draft reports within that program. This subscription resulted in the program viewer receiving notifications for every comment posted on a draft report. The vulnerability led to the exposure of...
curl: Denial of Service in curl Request - HTTP headers eat all memory
Vulnerability description not provided...
curl: Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities
Vulnerability description not provided...
Shopify: Exposure of shopify employee summit page allows anonymous user to place orders for free books
Vulnerability description not provided...
Nintendo: [Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE
Vulnerability description not provided...
curl: Unicode-to-ASCII conversion on Windows can lead to argument injection and more
Vulnerability description not provided...
Rocket.Chat: The initial E2EE password generated by Rocket.Chat mobile can be recovered in a practical timescale.
The initial E2EE password generated by Rocket.Chat mobile prior to version 4.5.1 was found to have insufficient entropy, allowing it to be recovered in a practical timescale by an attacker...