Mars: RXSS in ███ via S parameter

A Reflected Cross-Site Scripting RXSS vulnerability was identified in the search functionality of the application. The vulnerability was triggered when a user manipulated the search parameter 's'. User input was not properly sanitized before being reflected back to users...

Ruby on Rails: DoS with crafted "Range" header

The vulnerability was discovered in the Active Storage component of Ruby on Rails. The vulnerability allowed an attacker to craft a "Range" header that could lead to a Denial of Service DoS attack. The attack was possible due to the lack of validation on overlapping ranges in the...

Nextcloud: Code injection in Nextcloud Desktop Client for macOS

The Nextcloud Desktop Client for macOS was found to be vulnerable to code injection. The vulnerability allowed untrusted input to be executed as code, potentially leading to a security breach...

Node.js: Path traversal by drive name in Windows environment

A vulnerability has been identified in the handling of drive names in the Windows environment of Node.js. Certain Node.js functions do not treat drive names as special on Windows, resulting in a path that refers to the root directory instead of a relative path as assumed. This vulnerability affec...

TikTok: Stored-XSS-ads.tiktok.com

A stored cross-site scripting XSS vulnerability was found on a TikTok Ads endpoint, allowing MP4 video files or files with HTML or JS code to be executed in a user's browser...

Nextcloud: Email not verified when changing afterwards on apps.nextcloud.com

The email verification bypass vulnerability was discovered in the web application apps.nextcloud.com. The vulnerability allowed attackers to create accounts with any email address without verification, effectively taking over victim accounts...

Ruby on Rails: XSS when using `translate` in Action Controller (Rails 7.0, 7.1)

The vulnerability allows cross-site scripting XSS when using the translate method in Action Controller in Rails versions 7.0 and 7.1. The vulnerability was caused by the implementation of translate in Action Controller, which did not properly escape the values passed to it. The vulnerability was...

Teleport: A member with “editor” permissions can create an access list that cannot be modified, viewed, or deleted

Summary: A member who has “editor” permissions can add an access list that cannot be modified, viewed, or deleted, also he can add a rule that cannot be modified or deleted. Using these two bugs , a suspicious member with “editor” permissions can create a access list, put the members and rules he...

HackerOne: Server Side Request Forgery (SSRF) in webhook functionality

Server Side Request Forgery SSRF vulnerability found in webhook functionality. Attacker able to bypass anti-SSRF protections by using IPv6 address mapped to IPv4. This allowed unauthorized access to internal AWS EC2 metadata instance...

inDrive: SSRF in https://couriers.indrive.com/api/file-storage

A server side request forgery vulnerability was present in the url parameter of the https://couriers.indrive.com/api/file-storage endpoint, allowing arbitrary external websites to be requested and their content returned in responses...

Internet Bug Bounty: Request Smuggling in Apache Tomcat (Important, CVE-2023-45648)

A vulnerability in Apache Tomcat versions 11.0.0-M1 to 11.0.0-M11, 10.1.0-M1 to 10.1.13, 9.0.0-M1 to 9.0.80, and 8.5.0 to 8.5.93 allowed HTTP request smuggling due to improper parsing of trailer headers. This could be exploited by a remote attacker to bypass security controls when Tomcat was...

LinkedIn: Employee-only Area Bypass

An improper access control issue allowed unauthorized access to an employee-only area, leading to information disclosure...

TikTok: HTML Injection on TikTok Ads

A HTML injection vulnerability was found in a TikTok Ads endpoint. The vulnerability could have allowed arbitrary HTML or phishing content to be injected. The issue was responsibly disclosed...

Nextcloud: xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack.

The xmlrpc.php and wp-cron.php files were found to be enabled on the target website, which could allow attackers to perform denial of service attacks. Username enumeration via the RSS generator identified several valid usernames. The xmlrpc.php file could be used to cause a DDOS attack by sending...

curl: CVE-2024-0853: OCSP verification bypass with TLS session reuse

A vulnerability was identified in cURL version 8.5.0 that allowed revoked certificates to be accepted when reusing a TLS session. The issue was caused by a correction that inadvertently skipped OCSP stapling verification during TLS session reuse. This allowed revoked certificates to be accepted i...

curl: Buffer Overflow Vulnerability in WebSocket Handling

Vulnerability description not provided...

U.S. Dept Of Defense: Resource Injection - [████████]

The Swagger UI prior to version 4.1.3 was vulnerable to spoofing attacks. By crafting a URL with a malicious payload, an attacker could have displayed remote OpenAPI definitions on the affected host...

TikTok: Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended Products

The "Search Product" function in the TikTok Shop Seller API contained a vulnerability that allowed access to inactive or suspended products by manipulating the "live" parameter in the API request. The vulnerability was reported to the team and remediated...

Teleport: Improper session management - Failure to invalidate old session after password change

Failure to Invalidate Session on Password Change Failure to invalidate a session after a password change is a vulnerability which allows an attacker to maintain access on a service. Most users have the expectation that when they reset their password, no one else can access their account. When...

U.S. Dept Of Defense: ███ leaking PII of tour visitors (names, email addresses, phone numbers) via misconfigured record permissions

The ████████ portal was found to be leaking sensitive personal information, including full names, email addresses, and phone numbers of its users. The issue was caused by a misconfiguration that allowed registered users to access records of other users, potentially exposing the data of hundreds o...

Internet Bug Bounty: CVE-2023-49920: Apache Airflow: Missing CSRF protection on DAG/trigger

A vulnerability in Apache Airflow versions 2.7.0 through 2.7.3 allowed triggering of DAGs without CSRF validation, enabling malicious websites to trigger DAG execution without consent in browsers where a user was logged into Airflow. Users were advised to upgrade to 2.8.0 or later...

Internet Bug Bounty: Command Injection using malicious hostname in expanded proxycommand

A vulnerability in the handling of ProxyCommand and ProxyJump hostname parameters in libssh versions 0.10.x, 0.9.x and 0.8.x was reported. The issue enables malicious code injection through unchecked hostname syntax. User interaction is required for exploitation...

EXNESS: GraphQL attribute Batching DOS can take down pwapi.ex2b.com

Summary: Hi team! I hope you are having a great day! pwapi.ex2b.com instances work with a GraphQL API. This GraphQL endpoint is at / and can be called by unauthenticated users. This Graphql endpoint allows you to perform a query with the same attribute multiple times on a single request. The more...

GitLab: Account Takeover via Password Reset without user interactions

The report submitted to GitLab described a vulnerability that allowed account takeover via the password reset form. The vulnerability was triggered by modifying the JSON request to include the victim's email along with the attacker's email. This resulted in the password reset email being sent to...

IBM: Improper Authentication on Alertmanager instance

Improper authentication was configured on an alertmanager instance. The issue was reported to IBM, analyzed, and remediated...

LinkedIn: An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.

An information disclosure vulnerability was discovered in the Request Services feature that allowed attackers to obtain project details of other users. The issue was resolved and a bounty was paid to the researcher who reported it...

Nextcloud: Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4

A security vulnerability in Nextcloud version 28 was discovered, which had been previously fixed in version 25.0.4...

MercadoLibre: Account Takeover / Arbitrary File read and deletion / Partial code execution (intent redirection)

The vulnerability allowed for account takeover, arbitrary file read and deletion, and partial code execution through intent redirection. MercadoLibre acknowledged the issue and worked on a fix internally...

Nextcloud: Can reshare read&share only folder with more permissions

The vulnerability allowed a user with read-only access to a folder to reshare that folder with additional permissions, such as read and write access. This could potentially allow the user to gain more permissions than they were originally granted...

Nextcloud: see card comments after remove shared board

The vulnerability allowed unauthorized access to card comments after a shared board was removed...

Mozilla: Subdomain takeover on one of the subdomain under mozaws.net

A subdomain takeover vulnerability was discovered on a subdomain under mozaws.net due to a dangling DNS record. The researchers were able to host content on the affected subdomain...

Mozilla: Subdomain takeover on one of the subdomain under mozaws.net

A subdomain takeover vulnerability was discovered on a mozaws.net subdomain due to a dangling DNS record. The researchers were able to host content under the affected subdomain...

Liberapay: Avatar URL is exposed in patron export for secret donations

The avatar URL was exposed in the patron export for secret donations, which could potentially identify donors who wished to remain anonymous...

TikTok: Authentication Bypass on TikTok Seller Signup Process Allows Account Creation Without Phone Verification

The authentication bypass vulnerability on the TikTok Seller signup process allowed account creation without phone verification...

Mozilla: Subdomain takeover on one of the subdomain under mozaws.net

A subdomain takeover vulnerability was discovered on a mozaws.net subdomain due to a dangling DNS record. The researchers were able to host content under the affected subdomain...

HackerOne: How the Arch Angel stole Live Events

A vulnerability in a live hacking event's infrastructure allowed an attacker to impersonate an administrator, close valid bug reports, and disrupt the event. The attacker was able to log in as an administrator and invalidate bug reports, but the event proceeded successfully regardless...

Node.js: Denial of Service by resource exhaustion in fetch() brotli decoding

A denial of service vulnerability was identified in Node.js related to resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The issue stems from fetch always decoding Brotli content, allowing an attacker controlling the URL to cause resource exhaustion...

Teleport: access list owner can escalate his role to the highest roles

Summary: 1. Go to your-domain.teleport.sh/web/accesslists. 2. Create a new access list and add a role to "Roles Granted," e.g., "reviewer" role. 3. Add a user as the Access List Owner. 4. The user, as the Access List Owner, can escalate the role of the list to higher roles, thereby escalating the...

TikTok: RXSS on TikTok endpoints

A cross-site scripting vulnerability was discovered in two TikTok incentive endpoints due to improper output encoding of user-supplied data. This allowed JavaScript code injection into the affected endpoints...

Internet Bug Bounty: Possibility of Request smuggling attack

A vulnerability in Apache Tomcat allowed request smuggling due to incorrect parsing of HTTP trailer headers. A specially crafted trailer header exceeding the size limit could cause Tomcat to treat a single request as multiple requests, enabling request smuggling attacks when behind a reverse prox...

MetaMask: total Failure of password protection while extracting seed phrase! increases attack surface area for scammers

The MetaMask browser extension UI was able to access a user's seed phrase without requiring password confirmation, which violated expected security boundaries between the UI and background process. The issue was resolved in MetaMask Extension version 11.7.1, which now enforces password confirmati...

Internet Bug Bounty: curl HSTS long file name clears contents

When saving HSTS data using curl, a vulnerability was found where using an excessively long file name could result in the clearing of all contents. This caused subsequent requests using that file to be unaware of the HSTS status they should have used. The reason was that curl appended a suffix to...

Shopify: HTTP Response Header Injection in shopify/pitchfork + Rack 3

The HTTP response header injection vulnerability was discovered in the Pitchfork library version 0.10.0 when used with Rack 3. The issue stemmed from improper handling of header values containing newline characters in the appendheader method of the HTTP response module. When Rack 3 was used, the...

PortSwigger Web Security: CSP bypass on PortSwigger.net using Google script resources

A cross-site scripting vulnerability was discovered on PortSwigger.net. The site's content security policy allowed resources from Google's reCAPTCHA domain, which contains AngularJS. This could be abused to bypass the CSP and load arbitrary scripts from other domains. The issue allowed an attacke...

PortSwigger Web Security: Changing the administrator password via admin console does not invalidate other sessions

The vulnerability is that changing the administrator password via the admin console does not invalidate other active sessions. This means that even after changing the password, the previous sessions can still be used to access the administrator account...

PortSwigger Web Security: A user with only [MODIFY_SETTINGS] permmision could takeover any user accounts

The vulnerability allowed a user with only the "MODIFYSETTINGS" permission to take over any user accounts. By configuring the email settings to use a public SMTP server, the attacker could capture the email and password reset link whenever an administrator or user with permissions to edit or add...

HackerOne: Some limited confidential information can still be accessed after a user exits a private program

Vulnerability description not provided...

PortSwigger Web Security: The role "CI-driven scan initiator" provides excessive read access

The reporter noticed that all authenticated users were able to access certain non-sensitive information such as metadata about third-party integrations. This was found to be by design, and the documentation was updated to clarify the information available to all authenticated users...

Internet Bug Bounty: curl cookie mixed case PSL bypass

A vulnerability in curl allowed a malicious HTTP server to set "super cookies" that bypassed the Public Suffix List check, enabling cookies to be sent to unrelated sites and domains...

Internet Bug Bounty: ASAR Integrity bypass via filetype confusion

A vulnerability was discovered in Electron that allowed bypassing ASAR integrity checks via filetype confusion. Maliciously crafted directories could trick apps into loading non-validated code. This impacted apps with certain fuses enabled on macOS that relied on filesystem protections. The issue...