HackerOne: Able to Create Testimonials for myself using Sandbox

The vulnerability allowed hackers to create and display self-authored testimonials on their public profiles. This was achieved by creating a sandbox program on HackerOne and inviting an alternate account. The alternate account could submit reports to the sandbox program, and the primary account,...

Rootstock Labs: Crafted smart contract can take 1.5 minutes to execute due to inefficient CODESIZE implementation

The crafted smart contract can take 1.5 minutes to execute due to an inefficient implementation of the CODESIZE operation in the VM. The issue was caused by the VM.doCODESIZE method, which retrieved the entire code array instead of just the code length. This behavior could be exploited to transfe...

HackerOne: Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint

The Insecure Direct Object Reference IDOR vulnerability allowed viewing private report details through the /bugs.json endpoint. Any private reports could be accessed by sending a POST request to the endpoint with the organization ID and a single-digit text query. This gave access to sensitive...

HackerOne: Two-factor authentication bypass lead to information disclosure about the program and all hackers participate

Vulnerability description not provided...

GitHub: GitHub Apps can access suspended installations via scoped user-to-server tokens

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a suspended GitHub App to retain access to the repository via a scoped user access token. This vulnerability was only exploitable in public repositories. The vulnerability affected all versions of...

Nextcloud: Incomplete sanitization in SVG preview provider

The SVG preview provider in Nextcloud suffered from incomplete sanitization, allowing potential exploitation...

HackerOne: [IDOR] Improper Access Control on Embedded Submission Form

The researcher discovered an improper access control vulnerability that allowed them to access sensitive program information for private/inactive embedded submission forms by leveraging the form's UUID. The researcher used reconnaissance techniques to obtain a list of UUIDs for various private...

HackerOne: Payload delivery via Social Media urls on H1 profile

The Hackerone platform allowed users to add social media profiles to their profiles, where users could provide their usernames. Due to improper sanitization, users were able to construct their own URLs, except for Twitter which was sanitized. This allowed attackers to hide malicious payloads behi...

HackerOne: 2FA Bypass via Leaked Cookies

Vulnerability description not provided...

Nextcloud: Events information leaked with shared calendars on recurrence exceptions

Events information leaked with shared calendars on recurrence exceptions...

U.S. Dept Of Defense: reflected xss [CVE-2020-3580]

The application was vulnerable to cross-site scripting XSS due to insufficient input validation. This allowed an attacker to inject malicious scripts that could be executed in the victim's browser...

HackerOne: Confirmed #2118458: Intentional redirect from www.hackerone.com to domain which is up for sale

The report describes an intentional redirect from www.hackerone.com to a domain that is currently for sale. The report states that the endpoint https://www.hackerone.com/node/9386 automatically redirects to https://www.iotna.com/, and that the domain iotna.com is currently up for sale...

LY Corporation: Client-Side Path Traversal on LINE Developers Console

The LINE Developers Console had a Client-Side Path Traversal vulnerability that led to an effective CSRF. The operations that could be enforced with the CSRF were limited...

pixiv: Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}

The server-status endpoint was accessible, allowing access to internal logs and information...

Automattic: Authentication & Registration Bypass in Newspack Extended Access

The Newspack Extended Access plugin failed to validate the JWT signing on the registration and login JSON endpoint. This allowed for the registration of accounts with arbitrary user-supplied details and authentication bypass if a target account email was known...

Node.js: fs.fchown/fchmod bypasses permission model

A vulnerability was identified in Node.js that affected users of the experimental permission model when the --allow-fs-write flag was used. The vulnerability allowed operations such as fs.fchown or fs.fchmod to be used with a "read-only" file descriptor to change the owner and permissions of a...

Hyperledger: Code exec on Github runner via Pull request name

A command injection vulnerability was discovered in the GitHub Actions workflow of the Hyperledger Cacti repository. The vulnerability allowed an attacker to inject arbitrary commands and execute them on the GitHub runner by crafting a malicious pull request title. The vulnerability was present i...

U.S. Dept Of Defense: [███] .NET Framework ObjRefs Disclosure (CVE-2024-29059)

A vulnerability was discovered in Microsoft .NET Framework that could allow a remote attacker to obtain sensitive information. The vulnerability was caused by the potential disclosure of ObjRef URIs, which could be used to perform .NET Remoting attacks via HTTP. The vulnerability was assigned the...

GitHub: View private repository NWO of deploy key via internal LFS API

The vulnerability allowed an attacker to enumerate the names of private repositories that utilized deploy keys in GitHub Enterprise Server. The vulnerability did not provide unauthorized access to any repository content besides the repository names. This vulnerability affected all versions of...

HackerOne: Session Not Expire / 2FA Bypass

Vulnerability description not provided...

U.S. Dept Of Defense: GlobalProtect - OS Command Injection #█████████

A command injection vulnerability was discovered in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations. This vulnerability could have enabled an unauthenticated attacker to execute arbitrary code with root privileges on...

Mozilla: Jira Credential Disclosure within Mozilla Slack

The Jira admin API keys were disclosed within a Mozilla Slack channel by a staff member. The exposed credentials allowed for the verification of the user's elevated privileges, including being a Jira Administrator, Administrator, and Jira Service Desk user...

Liberapay: Unsafe yaml load can lead to remote code execution

The YAML load function can lead to remote code execution vulnerability. The vulnerability allows the construction of arbitrary Python objects from untrusted YAML data, which can be exploited by an attacker...

HackerOne: Two factor authentication bypass

Vulnerability description not provided...

HackerOne: 2fa can't be activated on app.pullrequest.com

Vulnerability description not provided...

Node.js: Bypass incomplete fix of CVE-2024-27980

The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arose from improper handling of batch files with all possible extensions on Windows via childprocess.spawn and childprocess.spawnSync. A malicious command line argument could have been used ...

PortSwigger Web Security: Incorrect logic when buy one more license which may lead to extend the expire date of existing license

Vulnerability description not provided...

Nextcloud: Event create can create attachments that link to other websites

The vulnerability allowed the creation of attachments that could link to other websites during the event creation process...

IBM: Insecure Direct Object Reference Protection bypass by changing HTTP method in IBM Your Learning endpoint.

The Insecure Direct Object Reference vulnerability in the IBM Your Learning endpoint was reported, analyzed, and remediated. The vulnerability allowed bypassing the protection by changing the HTTP method...

Mars: Sqli on ██████ search functionality

A SQL injection vulnerability was reported on the search functionality of the ██████ website. The vulnerability allowed an attacker to inject malicious SQL code into the search query...

Internet Bug Bounty: Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash

The Node.js HTTP/2 server was affected by a vulnerability that caused it to crash instantly after receiving a small number of HTTP/2 frames. The issue was caused by a race condition that occurred when the Http2Session destructor was triggered while header frames were still being processed, leavin...

Internet Bug Bounty: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

The Apache HTTP Server vulnerability CVE-2024-27316 was recently discovered. HTTP/2 incoming headers exceeding the limit were temporarily buffered in nghttp2 to generate an HTTP 413 response. However, if the client did not stop sending headers, this led to memory exhaustion. The vulnerability was...

Internet Bug Bounty: Proxy-Authorization header not cleared on cross-origin redirect in undici.request

The Proxy-Authorization header was not cleared on cross-origin redirects in the Undici HTTP client library. This issue was reported and patched in later versions of Undici...

MTN Group: Unauthorized access to PII leads to Administrator account Takeover

The vulnerability arises from insufficient restrictions placed on the list of post authors, which could be exploited by remote attackers to obtain sensitive information through wp/v2/users/15 requests. The sensitive information, including email addresses, could be obtained and used in further...

HackerOne: Any user could upload attachments to pentest scoping form they don't have access to

The root cause of this issue was insufficient access controls implemented in the attachment upload functionality for pentest scoping forms. The endpoint responsible for handling attachment uploads did not properly validate the user's access rights to the specific scoping form, allowing any...

Internet Bug Bounty: CVE-2019-1551: rsaz_512_sqr overflow bug on x86_64

The CVE-2019-1551 vulnerability was an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli in the OpenSSL library. The vulnerability was found and reported by researchers. The issue was mitigated in the 1.1.1 and 1.0.2 versions of OpenSSL...

Nextcloud: User can copy locked folders and gain access to the contents

A vulnerability in Nextcloud allowed users to copy locked folders and access their contents...

Mars: sqli on █████████ search functionality

A SQL injection vulnerability was found in the search functionality of the █████████ website...

Nextcloud: Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com

Security researchers discovered a vulnerability in the Secure Shell SSH cryptographic network protocol, known as Terrapin CVE-2023-48795. This vulnerability could have allowed an attacker to downgrade the security of the secure channel. Weak SSH algorithms were also identified on various subdomai...

Internet Bug Bounty: [CVE-2024-25126] Denial of Service Vulnerability in Rack Content-Type Parsing

A denial of service vulnerability was discovered in the content type parsing component of Rack. The vulnerability was assigned the CVE identifier CVE-2024-25126. The vulnerability affected versions 0.4 and above of Rack, and was addressed in versions 3.0.9.1 and 2.2.8.1...

Internet Bug Bounty: [CVE-2024-26146] Header Parsing leads to Possible Denial of Service Vulnerability

The Rack header parsing library in Ruby on Rails was found to have a potential denial of service vulnerability. The vulnerability was assigned the identifier CVE-2024-26146. It was discovered that carefully crafted headers could cause the header parsing routines to take longer than expected,...

Internet Bug Bounty: [CVE-2024-26142] ReDoS vulnerability in Accept header parsing in Action Dispatch

A ReDoS vulnerability was discovered in the Accept header parsing in Action Dispatch. The vulnerability was assigned the CVE identifier CVE-2024-26142. Affected versions were 7.1.0 to 7.1.3, while versions prior to 7.1.0 and 7.1.3.1 and later were not affected. The vulnerability was reported and ...

Mars: CSRF in Delete Pet Function

The Delete Pet functionality on the ████████ platform was found to be vulnerable to Cross-Site Request Forgery CSRF. The vulnerability was discovered in the pet deletion endpoint, where the pet ID parameter could be manipulated to force authenticated users to delete their pets without their...

U.S. Dept Of Defense: Reflected XSS via Moodle on ███ [CVE-2022-35653]

A reflected XSS vulnerability was identified in the LTI module of Moodle. The vulnerability was caused by insufficient sanitization of user-supplied data in the LTI module. A remote attacker could have tricked a victim into following a specially crafted link, which could have executed arbitrary...

TikTok: Account Takeover via Authentication Bypass in TikTok Account Recovery

An improper authentication mechanism in TikTok's account recovery process was identified. The vulnerability was reported and has been completely fixed. There was no evidence of exploitation...

Teleport: SSRF in region parameter that leads to AWS Teleport role AWS account takeover

You have an Integration page in Teleport where one of the options is AWS OIDC which will allow people in Teleport to add resources fluently without actually having initial access to these resources or installing any agents on them. You will need to have connected and ready OIDC integration with A...

Internet Bug Bounty: CVE-2024-2398: HTTP/2 push headers memory-leak

A memory leak was found in libcurl when handling HTTP/2 push headers. The vulnerability was caused by libcurl's failure to properly release the allocated memory when aborting a server push due to the maximum allowed limit being exceeded. This could lead to denial of service due to memory exhausti...

U.S. Dept Of Defense: Missing Access Control Allows for User Creation and Privilege Escalation

The RSI Test Environment application had a vulnerability that allowed unauthenticated users to create new user accounts and grant them administrator privileges. This provided unauthorized access to restricted information and documents within the application...

HackerOne: Attachment disclosure via summary report

A critical vulnerability was discovered in the HackerOne platform that allowed an attacker to gain unauthorized access to attachments belonging to other users through the report summary editing functionality. By manipulating attachment IDs in the request, an attacker could view sensitive files th...

passhash: Potential DoS due to PasswordPoliciesNotMet in errors.go

Summary: Possible DoS depending on amount of PasswordPolicyError instances that can be created in a short time type PasswordPoliciesNotMet struct UnMetPasswordPolicies PasswordPolicyError func e PasswordPoliciesNotMet Error string errorStrs := makestring, 0, lene.UnMetPasswordPolicies for , ppe :...