15405 matches found
Internet Bug Bounty: ASAR Integrity bypass via filetype confusion
A vulnerability was discovered in Electron that allowed bypassing ASAR integrity checks via filetype confusion. Maliciously crafted directories could trick apps into loading non-validated code. This impacted apps with certain fuses enabled on macOS that relied on filesystem protections. The issue...
Ruby: DoS in bigdecimal's sqrt function due to miscalculation of loop iterations
Vulnerability description not provided...
Valve: Web API key registration allows registering multiple keys by reusing `request_id`
A vulnerability was found in the Steam API key registration process that allowed multiple API keys to be registered for an account by reusing the request ID. The issue was fixed by updating the request ID after successful confirmation. Accounts with multiple keys were corrected...
Internet Bug Bounty: OpenSSL vulnerable to the Marvin Attack (CVE-2022-4304)
A timing side channel vulnerability in OpenSSL RSA decryption was discovered that could allow plaintext recovery. By measuring decryption time, an attacker could recover RSA plaintext from captured ciphertexts after a large number of decryption attempts. All RSA padding modes were affected. The...
Deriv.com: Mailgun subdomain takeover
Summary: I have found an unclaimed subdomain of deriv.cloud. Which is successfully claimable. Platforms Affected: email.mailgun.deriv.cloud Steps To Reproduce: You just need a mailgun account and the you can successfully claim this domain. Supporting Material/References:...
CS Money: Authentication Bypass to (CVE-2023-2982)
An authentication bypass vulnerability was discovered in an older version of the WordPress plugin WordPress Social Login and Register Discord, Google, Twitter, LinkedIn...
Mozilla: Subdomain takeover on one of the subdomain under mozaws.net
A subdomain takeover vulnerability was identified on a mozaws.net subdomain due to a dangling DNS record. The researchers were able to host content under the affected subdomain...
Node.js: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)
A timing side-channel vulnerability in the crypto library's privateDecrypt API allowed attackers to remotely exploit and decrypt or forge signatures when processing encrypted messages...
Mars: Blind SQL Injection on █████ via URI Path
The vulnerability involved a time-based SQL injection attack on the target system via the URI path. The attack capitalized on vulnerabilities in the application's interactions with the database, allowing the attacker to extract information by purposefully delaying database processing and observin...
Fastly VDP: Open Redirect on ███████
The vulnerability was an open redirect issue on the website. A user could be redirected to a malicious site by modifying the "redirecturl" parameter. This could have been exploited for phishing attacks or malware infections...
Glassdoor: Web Cache Deception
A web caching issue was discovered on an endpoint which inappropriately cached a user's feed page under certain conditions...
SideFX: Port 587 SMPT Open: Can send any mail remotely from the internal mail users to company mail id's.
Port 587 SMTP open. Attacker can send emails remotely to company email addresses. This allows phishing, spamming, or other malicious emails to be sent from what appears to be a legitimate internal company email account...
EXNESS: Unrestricted Access to Celery Flower Instance
The publicly accessible Celery Flower instance allowed unrestricted access, exposing sensitive information, and the ability to manipulate tasks...
HackerOne: Cloud Computer Hackerone Triager can be Accessible for everyone [[email protected]] computer
Vulnerability description not provided...
Nextcloud: Open redirect in user_saml via RelayState parameter
An open redirect vulnerability was reported in the usersaml authentication module of Nextcloud. The vulnerability allowed redirecting users to arbitrary URLs via the RelayState parameter...
Internet Bug Bounty: Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucket
A misconfiguration in the AWS CloudFront CDN configuration for rubygems.org caused content to be served from an unclaimed S3 bucket. This could have enabled an attacker to serve malicious content and affect availability. Artifactory instances were observed accessing files, presenting a potential...
Mars: Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████
During a reconnaissance phase, a directory named 'SSO' was discovered on the website ████████. Upon accessing this directory, it redirected to ██████████, where sensitive employee and customer data, including usernames, emails, purchase history, payment history, bills, phone numbers, customer...
HackerOne: Server Side Request Forgery (SSRF) via Analytics Reports
We recently received a critical server-side request forgery SSRF vulnerability report through our bug bounty program. The issue allowed attackers to make internal requests from our application servers by exploiting a lack of output sanitization in an error message. By crafting malicious requests,...
U.S. Dept Of Defense: Default Admin Username and Password on ███
A vulnerability was found where default administrator credentials could be used to access an application. This could have allowed unauthorized access...
Mars: CSRF to delete a pet on ██████
The /pets/delete endpoint on ████ was susceptible to Cross-Site Request Forgery CSRF attacks. This vulnerability enabled the deletion of a pet from the targeted user's account without authorization...
Mozilla: MozillaVPN: Elevation of Privilege via a Race Condition Vulnerability
A race condition vulnerability was discovered in Mozilla VPN that led to local privilege escalation to root on macOS. The vulnerability existed during the installation or update process, where a local attacker could replace the VPN binary with a malicious one that would execute as root. The issue...
Node.js: Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipes
Vulnerability description not provided...
Node.js: Multiple permission model bypasses due to improper path traversal sequence sanitization
A vulnerability in the path traversal sanitization of Node.js versions 20 and 21 allowed bypass of the experimental filesystem permission model through path traversal attacks...
Automattic: Timeline API returns private post when target of a push notification
The Timeline API was able to return private posts when the target of a push notification, even though the user did not have access to the post...
Internet Bug Bounty: CVE-2023-46695: Potential denial of service vulnerability in UsernameField on Windows
A potential denial of service vulnerability was discovered in the UsernameField component in Django before versions 4.2.7, 4.1.13, and 3.2.23. The vulnerability allowed a denial of service attack via malformed input containing a large number of Unicode characters. The issue was addressed by...
X (Formerly Twitter): Bypassing x profile verification to receive instant blue checkmark and unlimited profile changes
The vulnerability allowed users to bypass the profile verification process on X by upgrading and downgrading their plan immediately after changing their profile picture. This permitted continuous profile picture changes without review...
Node.js: Improper handling of wildcards in --allow-fs-read and --allow-fs-write
A vulnerability was found in the Node.js permission model documentation regarding improper handling of wildcards in the --allow-fs-read and --allow-fs-write options. The documentation did not make clear that wildcards should only be used as the last character of a file path. This could result in...
GitLab: Stored-XSS injected in Wiki page via Banzai pipeline
A vulnerability was found in the AbstractReferenceFilter class of the GitLab project that could be exploited to inject arbitrary HTML elements, leading to a stored cross-site scripting XSS vulnerability. The issue was caused by the way the application handled the processing of wiki page content,...
Mozilla: Exposure of account recovery hint by querying by user email
The account recovery hint was exposed by querying the API with a user email. This allowed obtaining the hint and could enable phishing attacks...
Internet Bug Bounty: Path traversal through path stored in Uint8Array in Node.js 20
A path traversal vulnerability was discovered in Node.js 20 through paths stored in Uint8Array objects. The vulnerability allowed bypassing path sanitization protections and reading arbitrary files outside of a restricted directory. The issue was addressed by properly sanitizing Uint8Array paths ...
Sony: SQL injection at ███████
A Sony website was vulnerable to an error-based SQL injection that allowed data extraction...
Hyperledger: CVE-2023-46132
A vulnerability was discovered in which the way transactions were hashed in Fabric blockchain blocks allowed an attacker to manipulate the transaction data while keeping the block hash unchanged. This could enable an adversary to fork the blockchain network state through malicious blocks that...
Mozilla: Remote code execution and exfiltration of secret tokens by poisoning the mozilla/fxa CI build cache
Remote code execution and data exfiltration were possible by poisoning a cache used in a CI build process. A proof of concept demonstrated the ability to exfiltrate sensitive data by re-uploading a modified cache artifact. The vulnerability required access to the source code repository to be...
Nextcloud: Notes app can be tricked into using a received share created before the user logged in
The Nextcloud Notes app was found to be vulnerable to a security issue that allowed it to be tricked into using a received share created before the user logged in...
curl: Buffer overflow and affected url:-https://github.com/curl/curl/blob/master/docs/examples/hsts-preload.c
Vulnerability description not provided...
TikTok: RXSS via region parameter
A cross-site scripting vulnerability was discovered in a TikTok endpoint. User-supplied data in the 'region' parameter was reflected without appropriate escaping, allowing JavaScript injection...
Nextcloud: Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist
Improper handling of request URLs allowed guest users to bypass application allowlist in Nextcloud guests app...
Nextcloud: Non-admin users can reset app allowlist to the default
A vulnerability was disclosed where non-administrative users could reset the application allowlist to the default state. This could have allowed malicious apps to be installed...
Internet Bug Bounty: CVE-2023-47037: Airflow Broken Access Control Vulnerability
A broken access control vulnerability in Apache Airflow versions before 2.7.3 allowed authenticated users with DAG view authorization to modify some DAG run detail values when submitting notes, potentially altering details such as configuration parameters and start date...
Nextcloud: Authentication bypass in Global Site Selector allows an attacker to log in as any user
Authentication bypass vulnerability in software allowed attacker to bypass authentication and log in as any user...
U.S. Dept Of Defense: Unauthenticated File Read Adobe ColdFusion
A vulnerability allowing unauthenticated arbitrary file read in Adobe ColdFusion was discovered. This could result in unauthorized access to sensitive data on affected systems. The vulnerability impacts ColdFusion versions 2021 Update 5 and earlier, and 2018 Update 15 and earlier. Mitigation is t...
Nextcloud: RCE on Wordpress website
A remote code execution vulnerability was exploited on a WordPress website due to unsafe deserialization of user input. This allowed arbitrary code execution as the web server user...
FetLife: Able to see highest poll result without voting or view result
Vulnerability description not provided...
Nextcloud: Can download files by zipping the folder
A vulnerability was identified where files could be downloaded without proper permissions by zipping and downloading a folder, despite not having direct download access. This allowed circumvention of view-only restrictions...
U.S. Dept Of Defense: Unauthorized access to Argo dashboard on █████
The Argo deployment on █████ was found to be vulnerable to unauthorized access, allowing manipulation of workflows and sensors. This could lead to compromise of sensitive data. Urgent mitigation is advised...
GitHub: Self XSS in Tag name pattern field /<username>/<reponame>/settings/tag_protection/new
A self-XSS vulnerability was discovered in the tag name pattern field of the tag protections UI in GitHub Enterprise Server. The vulnerability allowed a malicious website that required user interaction and social engineering to make changes to a user account via a CSP bypass with created CSRF...
Nextcloud: App PIN code can be bypassed in Files iOS
A vulnerability was discovered in the PIN code implementation of the Files iOS app version 4.9.1 that allowed an attacker to bypass the PIN code protection via brute force due to lack of rate limiting, enabling unauthorized access to the app...
X (Formerly Twitter): Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS File
The vulnerability allowed the retrieval of a user's X username and user ID from a dynamically generated JavaScript file hosted on Twitter. An attacker could force a victim to import the file from a malicious website, bypassing the Same-Origin Policy and exposing the user's sensitive information...
Internet Bug Bounty: Cookie headers are not cleared in cross-domain redirect in undici-fetch
Cookie headers were not always cleared in cross-domain redirects in undici-fetch CVE-2023-45143. Undici did not clear Cookie headers on cross-origin redirects as intended by the specification. This could lead to accidental leakage of cookies to third-party sites or malicious attackers controlling...
Mars: Information Exposure due to enabled debug mode
The server was found to be exposing system information to unauthenticated users due to the enabled debug mode. The disclosed information included details about the technologies and versions being used in the production system, such as the Python version, Django version, and the database driver in...