15693 matches found
Enjin: Cloudflare /cdn-cgi/ path allows resizing images from unauthorised sources on enjinusercontent.com
The Cloudflare /cdn-cgi/ path on enjinusercontent.com was discovered to allow resizing and rendering of images from unauthorized sources without restriction. This behavior could have led to HTML injection, SSRF, and portal scanning attacks, as well as the unrestricted display of external resource...
Mozilla: Subdomain takeover on one of the subdomains under mozaws.net
Subdomain takeover was discovered on a subdomain under mozaws.net due to a dangling DNS record. The dangling record was registered by researchers, allowing them to host content under the affected subdomain...
HackerOne: Bypassing Two-Factor Authentication via Account Deactivation and Password Reset
Vulnerability description not provided...
Internet Bug Bounty: [CVE-2024-32464] ActionText ContentAttachment’s can Contain Unsanitized HTML
CVE-2024-32464 ActionText ContentAttachment's can Contain Unsanitized HTML Instances of ActionText::Attachable::ContentAttachment included within a richtextarea tag were discovered to potentially contain unsanitized HTML. This vulnerability was assigned the CVE identifier CVE-2024-32464. Versions...
MTN Group: FULL ACCOUNT TAKEOVER
The selfservice portal at https://mymtn.com.ng/ allowed an attacker to take over any Nigerian MTN phone number. The attacker was able to access the account holder's personal information, such as date of birth and full name. The attacker also had the ability to use any available airtime on the...
pixiv: Disclose Hidden Comments on Media Section of hub.vroid.com
A vulnerability was discovered in the Media section of the website where hidden comments could be disclosed. By intercepting a request to like a specific comment, the attacker was able to retrieve the content of the hidden comment, which should have only been visible to the original poster...
Mattermost: Posts sent via websockets aren't sanitized properly
The posts sent via websockets in the Mattermost application were not properly sanitized, allowing attackers to inject malicious content. The vulnerability enabled the creation of customized permalink embeds and YouTube embeds with arbitrary content, which could lead to denial-of-service issues an...
Automattic: Authentication & Registration Bypass in Newspack Extended Access
The Newspack Extended Access plugin omitted to verify JWT signing on the registration and login JSON endpoint. This permitted registration of accounts with arbitrary user-supplied details, and authentication bypass and account hijack if a target account email was known...
LinkedIn: Can see phone numbers of others by providing mail address
The vulnerability allowed an attacker to view a user's phone number by abusing the password reset functionality. The phone number was exposed in the input field after verifying the user's email address...
Ionity GmbH: HTML injection in swagger UI
A vulnerability was discovered in the Swagger UI that allowed for HTML injection. This vulnerability existed because the application failed to properly sanitize user-supplied input before rendering it in the HTML context. An attacker could have exploited this issue to execute arbitrary scripts in...
HackerOne: [ Spot Check ] Team members can edit a user's write-up
Team members could edit a user's spot check write-up. The write-up could be modified through a GraphQL request, even though there was no option to edit the write-up in the user interface. This was considered unintended functionality, as HackerOne had previously fixed vulnerabilities where team...
HackerOne: Improper Authentication - 2FA OTP Reusable
Vulnerability description not provided...
HackerOne: 2FA requirement bypass when claiming bounty
Vulnerability description not provided...
GitLab: IDOR Exposes All Machine Learning Models
The vulnerability allows an attacker to access any Machine Learning Model Registry in GitLab, including private models, by guessing the incremental model IDs. The attacker can also access different versions of the models. This vulnerability was present in GitLab versions 15.11 and 16.2...
Internet Bug Bounty: CVE-2024-31079 in nginx
CVE-2024-31079 was discovered in the NGINX HTTP/3 QUIC module. When NGINX Plus or NGINX OSS were configured to use this module, undisclosed HTTP/3 requests could cause NGINX worker processes to terminate or experience other potential impact. The vulnerability was classified as a stack-based buffe...
Internet Bug Bounty: CVE-2024-32760 in nginx
CVE-2024-32760 was discovered in the HTTP/3 QUIC module of NGINX Plus and NGINX OSS. When the module was configured, undisclosed HTTP/3 encoder instructions could cause NGINX worker processes to terminate or experience other potential impact...
Internet Bug Bounty: CVE-2024-35200 in nginx
CVE-2024-35200 was discovered in NGINX Plus and NGINX OSS when configured to use the HTTP/3 QUIC module. Undisclosed HTTP/3 requests were found to cause NGINX worker processes to terminate...
HackerOne: [Spot Check] - Ability to disclose metadata about Spot Checks (Number of Hackers + Hackers Criteria) via "SpotCheckSingleQuery"
A vulnerability was discovered that allowed hackers to disclose private metadata about Spot Checks, including the number of hackers and the selection criteria. The vulnerability was triggered by navigating to a specific URL and accessing the "SpotCheckSingleQuery" parameter, which returned this...
WakaTime: IDOR to view order information of users and personal information
Vulnerability description not provided...
RATELIMITED: Subdomain takeover in GitLab Pages [george.ratelimited.me]
A subdomain takeover vulnerability was discovered in GitLab Pages. Subdomains could be taken over without verification of domain ownership. The vulnerability allowed an attacker to gain control of the subdomain...
GitLab: Subdomain takeover in Gitlab pages
The vulnerability allowed an attacker to take over a dangling custom domain pointing to GitLab Pages using "instanceX.gitlab.io". The problem arose when adding a custom domain to GitLab Pages without verifying the domain, as it would still serve content for 7 days before being disabled...
Basecamp: Stored XSS on trix editor version 2.1.1
The Trix editor version 2.1.1 was vulnerable to stored cross-site scripting XSS attacks. The vulnerability was caused by improper sanitization of content pasted into the editor, allowing an attacker to embed malicious scripts that were executed within the context of the application...
U.S. Dept Of Defense: Self XSS
A self-XSS vulnerability was discovered in the search function at "https://█████████/ords/f?p=1001:2::::::" where a normal XSS payload could be injected and executed...
Internet Bug Bounty: Possible XSS Vulnerability in Action Controller
There was a possible XSS vulnerability when using the translation helpers translate, t, etc in Action Controller. The vulnerability was assigned the CVE identifier CVE-2024-26143. Affected versions were 7.0.0 and above. The issue was fixed in versions 7.1.3.1 and 7.0.8.1...
Internet Bug Bounty: Possible DoS Vulnerability with Range Header in Rack
A potential denial-of-service vulnerability was discovered in the Rack web server interface for Ruby. The vulnerability was assigned the CVE identifier CVE-2024-26141 and affected versions of Rack 1.3.0 and later. The vulnerability was caused by carefully crafted Range request headers, which coul...
U.S. Dept Of Defense: CVE-2023-26347 in https://████.mil/hax/..CFIDE/adminapi/administrator.cfc?method=getBuildNumber&_cfclient=true
CVE-2023-26347 was discovered in Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier. The vulnerability was an Improper Access Control issue that could result in a Security feature bypass. Unauthenticated access was possible to the administration CFM and CFC endpoints...
Basecamp: Account takeover via insecure intent handling
The Basecamp app was vulnerable to account takeover due to insecure intent handling. A malicious app installed on the same device could obtain the user's Oauth2 token and take over their account...
HackerOne: Access Control Vulnerability Enabling Unauthorized Access to Limited Disclosure Reports
The vulnerability allowed an unauthorized user to close a report as a duplicate of another report from a different program or organization. The root cause was an improper access control check that did not account for limited disclosure reports or the original report being in the same organization...
Glassdoor: Cross-Site Leakage of Review Ownership via Navigation Detection
A vulnerability allowed detection of user login status by exploiting differences in Cross-Origin-Opener-Policy COOP headers between authenticated and unauthenticated states on the website. The issue was addressed by implementing consistent COOP headers across all domains...
Tools for Humanity: [Meetup][World ID][OIDC] Insufficient Filtering of "state" Parameter in Response Mode form_post leads to XSS and ATO
A lack of proper validation in the state parameter of the World ID OIDC authentication logic allowed the injection of HTML characters into the response body when using formpost as the OIDC response mode. This vulnerability was mitigated by the Content Security Policy CSP...
Mozilla: csrftoken not unique to session or specific user and csrfmiddlewaretoken can be altered
The CSRF token used in the application was not unique to the session or specific user, allowing an attacker to use a valid CSRF token obtained from another user to perform unauthorized actions on behalf of that user...
HackerOne: Program Member Could Duplicate Report To A Non Related Program Original Report
The vulnerability allowed a program member to duplicate a report to a report that was not related to the original program. This could lead to integrity issues, as the duplicate report should only be from reports within the original program...
U.S. Dept Of Defense: Out-Of-Bounds Memory Read on ███
Vulnerability description not provided...
Shopify: Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering
A reflected XSS vulnerability was reported in the AI chat bot greetings at help.shopify.com. The issue was caused by the rendering of a markdown image in the greeting, which allowed the attacker to inject a payload through the image URL. The vulnerability was addressed by removing the...
Nextcloud: Mail auto configurator can be tricked into sending account information to wrong servers
The mail auto configurator was vulnerable to being tricked into sending account information to unintended servers...
Booking.com: Default Admin Account lead to full access control at https://desk-demo.fareharbor.engineering
Login to the application at https://desk-demo.fareharbor.engineering/login with [email protected], password: test F3271060 2. Realizing that the login is successful, the attacker can use all functions in the application. F3271059 Impact attacker can use all admin functions...
GitHub: Information Leakage via Clicked Link in GitHub Repository (Fingerprinting)
A vulnerability was identified in GitHub Enterprise Server that allowed an attacker to retrieve metadata information of a user who clicks on an uploaded malicious asset URL. The vulnerability affected all versions prior to 3.14 and was fixed in later versions...
inDrive: Reflected XSS of media.indrive.com
Vulnerability description not provided...
IBM: IBM OpenPages vulnerable to exposure of sensitive information
The IBM OpenPages vulnerability that exposed sensitive information was reported, analyzed, and remediated. The vulnerability was discovered by an external researcher...
HackerOne: Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery
Vulnerability description not provided...
Brave Software: Brave Android: Incorrect URL Eliding in Brave Shields Pop Up
A vulnerability was discovered in the Brave Android browser where the URL was not properly elided from the front when displayed in the Brave Shields pop-up. This could have led to URL confusion or spoofing for users. The issue was not present in the desktop version of Brave...
GitHub: Access body and title of Internal Repo Issues in Projects
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and...
U.S. Dept Of Defense: Subdomain takeover ████████.mil
The subdomain ██████.mil was found to be pointing to a domain that is currently available for registration. This indicates a potential subdomain takeover vulnerability. The domain ████ was found to be unregistered and could have been used by an attacker to host unwanted or malicious content under...
GitLab: DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server
The report described a vulnerability in GitLab where an attacker could cause a denial of service by importing a malicious payload via the GitHub importer functionality...
IBM: S3 Bucket Takeover on apptio endpoint
The S3 bucket takeover vulnerability on the Apptio endpoint was reported, analyzed, and remediated. The external researcher who discovered the issue was thanked...
Nextcloud: Invisible Salamanders Attack against end_to_end_encryption in Nextcloud
Vulnerability description not provided...
MercadoLibre: Sale cancellations from other sellers without restrictions
The summary is as follows: A vulnerability was reported that allowed sale cancellations from other sellers without restrictions. The issue was acknowledged and addressed by MercadoLibre...
Truecaller : Lack of URL Validation in avatarUrl at /v4/profile
The endpoint "profile4-noneu.truecaller.com/v4/profile" was found to have a lack of URL validation in the "avatarUrl" parameter. The validation only checked if the URL started with "https" and contained the string "images-noneu.truecallerstatic.com", allowing attackers to craft fake URLs by addin...