15405 matches found
Mars: **"CSRF Vulnerability in ███████ Website Allows Attackers to Change User Profile Picture at ███████"**
The identified vulnerability is a CSRF vulnerability that allowed an attacker to change the user's profile picture on the ███████ website. The vulnerability was successfully reproduced by creating an account, navigating to the profile picture upload section, and utilizing the provided exploit cod...
Internet Bug Bounty: CVE-2023-40611: Apache Airflow Dag Runs Broken Access Control Vulnerability
A vulnerability was found that allowed unauthorized modification of details in Apache Airflow dag runs. Users with dag view authorization could alter configuration parameters and start dates in some dag run details by modifying values when submitting notes. This issue was addressed in Apache...
U.S. Dept Of Defense: authentication bypass
An authentication bypass vulnerability was discovered in the login page of a web portal, allowing unauthorized access without providing valid credentials...
Mozilla: Subdomain takeover on one of the subdomain under mozgcp.net
A subdomain takeover was reported on one of the subdomains under mozgcp.net due to a dangling DNS record. Content was hosted under the subdomain by researchers who registered the record...
Mars: 0 Click account takeover via timed requests to ███████forgot-password (single-packet attack)
A vulnerability was present in the forgot password functionality of the platform. By sending carefully timed requests, an attacker was able to obtain the password reset token for any account using only the victim's email address...
Mozilla: Subdomain takeover on one of the subdomain under mozgcp.net
A subdomain takeover was reported on one of the subdomains under mozgcp.net due to a dangling DNS record. Content was able to be hosted under the subdomain by researchers who had registered the record...
X (Formerly Twitter): Ability to see hidden likes
The ability to see hidden likes on Twitter/X was a vulnerability. Authenticated users could view another user's hidden likes by making a specific GraphQL API request, even if the target user had their likes set to be hidden...
Snapchat: Intent Leads To Unauthorised Video Call Initiation Leaking Surrounding Informations Of Victim
The Snapchat Android application was found to contain a vulnerability that allowed a malicious user to initiate an unauthorized video call with a victim. The vulnerability was triggered by a deep link that, when clicked by the victim, forced the victim's Snapchat application to initiate a video...
HackerOne: IDOR: Authorization Bypass in LockReport Mutation for public reports
An authorization bypass vulnerability allowed an attacker to lock any public report, potentially disrupting the reporting process...
IBM: Jenkins server access due to weak password
Jenkins server access was gained due to a weak password. The issue was reported to IBM, analyzed, and remediated...
Internet Bug Bounty: Context isolation bypass via nested unserializable return value
A vulnerability was discovered in Electron that allowed for a bypass of context isolation. This meant that code running in the main world context in the renderer could access the isolated Electron context and perform privileged actions. The vulnerability was fixed in versions 25.0.0-alpha.2,...
Mozilla: Mozilla Mastodon Staging Instance Admin API Key Disclosure Through Slack
Admin Mastodon API keys were inadvertently disclosed in the trust-and-safety-eng channel on Mozilla's Slack workspace, potentially granting unauthorized access to the Mastodon server and compromising user data. Immediate action is required to mitigate this vulnerability...
Mozilla: Subdomain takeover on one of the subdomain under mozaws.net
Vulnerability description not provided...
HackerOne: Hackers two email disclosed on submission at hackerone hactivity
Sensitive information, including the email addresses of two hackers/reporters, was inadvertently disclosed in a video proof-of-concept POC on a HackerOne submission...
Mozilla: Subdomain takeover on one of the subdomain under mozaws.net
A dangling DNS record enabled subdomain takeover on a mozaws.net subdomain. Researchers exploited this to host content on the affected subdomain...
Liberapay: Password Reset Token Leak Via Referrer
Vulnerability description not provided...
Mars: IDOR to account takeover on POST to █████████ by changing member_id parameter
Website endpoint was vulnerable to account takeover by changing member ID parameter...
LinkedIn: Attackers can *Upgrade and claim offer* on the Premium Trial Subscription with a total price of *IDR0.00* from the original *IDR7,022,061.82*
The reporter found a method to tamper with the premium pricing flow, allowing an attacker to subscribe to the LinkedIn Sales Navigator Core offering for free. This issue has been fixed and resolved...
Mozilla: Subdomain takeover on one of the subdomain under mozaws.net
A dangling DNS record enabled subdomain takeover on a mozaws.net subdomain. Researchers exploited this to host content on the affected subdomain...
Lichess: Unauthorized Blogs Creation
A vulnerability was identified on the lichess.org website that allowed unauthorized blog creation. By manipulating certain requests and leveraging the session cookies of a different account, an attacker could bypass account-specific limitations and create a blog post on an account that was not ye...
Mozilla: Subdomain takeover on one of the subdomain under mozaws.net
A dangling DNS record enabled subdomain takeover on a mozaws.net subdomain. Researchers exploited this to host content on the affected subdomain...
FetLife: fetlife.com/signup_step_profile expose access_token of mapbox.com
Vulnerability description not provided...
Daimler Truck: Default credential to login at site management panel
Summary: Hi Team During recon on shodan I came across an IP pointing towards lre.daimlertruck.com Here is the shodan link https://www.shodan.io/host/20.219.79.49 On port 8443, there was a login panel at https://20.219.79.49:8443/Site/ and using default credential admin admin I was able to login...
Internet Bug Bounty: CVE-2023-40195: Apache Airflow Spark Provider Deserialization Vulnerability RCE
Apache Airflow Spark Provider before 4.1.3 was affected by a deserialization vulnerability that allowed remote code execution RCE. Attackers could exploit this vulnerability by configuring a malicious Spark server address through the Airflow UI, which would then manipulate the PySpark clients...
Mozilla: Subdomain takeover on one of the subdomain under mozaws.net
A dangling DNS record enabled subdomain takeover on a mozaws.net subdomain. Researchers exploited this to host content on the affected subdomain...
U.S. Dept Of Defense: [██████] Reflected XSS via Keycloak on ██████
A cross-site scripting XSS vulnerability was discovered in Keycloak 8.0 and earlier versions. This vulnerability allowed an attacker to execute arbitrary script and potentially steal authentication credentials. The vulnerability was due to a lack of input validation, which allowed an attacker to...
U.S. Dept Of Defense: [█████████] Information disclosure due unauthenticated access to APIs and system browser functions
Multiple information exposure vulnerabilities were discovered in a Jira Server instance, allowing unauthenticated access to APIs and system browser functions. These vulnerabilities could be exploited by an attacker to gain unauthorized access to sensitive data and run arbitrary code on the server...
Internet Bug Bounty: [CVE-2023-23913] DOM Based Cross-site Scripting in rails-ujs for contenteditable HTML Elements
A DOM-based cross-site scripting vulnerability was discovered in rails-ujs, affecting versions 5.1.0 and above. By pasting malicious HTML content with specific attributes into a contenteditable element, an attacker could execute arbitrary JavaScript on the affected origin. The vulnerability has...
Liberapay: Twitter account hijack @Costalfy
A broken link on the Liberapay website allowed attackers to hijack the Twitter account of Andy Costanza, potentially leading to scams or phishing attempts...
inDrive: Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`
The vulnerability allowed an unlimited increase of the passenger's rating in the city-to-city shared ride feature. The request to the /api/v1/reviews/ride//driver endpoint was manipulated by changing the rating value to a higher number, which was accepted by the application and resulted in an...
Tor: 'Request English versions of web pages for enhanced privacy' keeps previous (grayed out) settings
The vulnerability allowed an attacker to identify users who had changed their language settings in the Tor Browser. By exploiting JavaScript and HTTP fingerprinting techniques, the attacker could determine the user's language preferences, even if the user had enabled the "Request English versions...
Mozilla: Subdomain takeover on one of the subdomain under mozgcp.net
A dangling DNS record for a subdomain of mozgcp.net was discovered, allowing researchers to host content on the subdomain...
Internet Bug Bounty: SSRF Vulnerability through Connection test feature
A security vulnerability was found in Apache Airflow versions prior to 2.7.0. An authenticated user with Connection edit privileges could exploit this vulnerability to access connection information and perform a denial of service attack on the server. Upgrading to version 2.7.0 or newer is...
Internet Bug Bounty: Argocd's web terminal session doesn't expire
A vulnerability was discovered in all versions of Argo CD starting from v2.6.0, where open web terminal sessions did not expire. This allowed users to send websocket messages even after their session token had expired, potentially exposing sensitive information. The issue has been patched in...
U.S. Dept Of Defense: [███████] Information disclosure due unauthenticated access to APIs and system browser functions
Multiple vulnerabilities were exposed in a Jira Server instance allowing unauthenticated access to APIs and system browser functions. This included the ability to run arbitrary code on an internal network server. Project categories, resolutions, and usernames could be listed without authenticatio...
Mars: debug.log File Exposure that exposes (user/████) username and password at █████████
A debug log file exposure vulnerability was discovered that allowed sensitive information to be viewed. The debug log file contained a username and password, which could enable unauthorized access to the application if exploited. To address this, restricting access to the debug log file and...
Cloudflare Public Bug Bounty: Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seat
Server-side validation checks were implemented after access to SaaS apps protected via ZT's Access could be gained when a user account was deleted or disabled by preserving metadata of the Access JWT and using another active user account within the same organization, despite lacking proper...
HackerOne: IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query
All licenses and certifications in HackerOne could be deleted by changing the ID number in the CreateOrUpdateHackerCertification GraphQL query...
HackerOne: Names not completely redacted despite "Redact the names of the involved users" is selected
An edge case was discovered in the Export PDF function where names ending with a . were not properly redacted despite selecting the "Redact the names of the involved users" option. The vulnerability allowed for the disclosure of sensitive information...
Internet Bug Bounty: CVE-2023-40273: Session fixation in Apache Airflow web interface
A session fixation vulnerability was discovered in Apache Airflow web interface. This vulnerability allowed an authenticated user to continue accessing the webserver even after their password had been reset by the admin. The issue has been addressed in version 2.7.0 of Apache Airflow...
Internet Bug Bounty: Dependency Policy Bypass via process.binding
A vulnerability was discovered in Node.js that allowed for the bypassing of permissions policies via the use of the process.binding API. This vulnerability allowed an attacker to run arbitrary code outside of the limits defined in a policy.json file. The vulnerability affected all users using the...
Nextcloud: Bypass password confirmation via Context-dependent access control (CDCA)
A vulnerability was found in Nextcloud server that allowed bypassing password confirmation for deleting workflows. By directly sending a DELETE request to the workflow delete endpoint, an attacker could delete workflows without providing the expected password confirmation. This broken...
Cosmos: Circuit Breaker Authorization Issue
Vulnerability description not provided...
pixiv: clickjacing can lead to account takeover
An endpoint on the website https://sketch.pixiv.net/draw was discovered to be vulnerable to clickjacking. Proof-of-concept code was provided to demonstrate how a user could be tricked into performing unintended actions on the website...
Nextcloud: DNS pin middleware can be tricked into DNS rebinding allowing SSRF
A vulnerability was disclosed where the DNS pin middleware could be tricked into DNS rebinding, allowing SSRF...
Nextcloud: Enabling Birthday Contact to any user
The "Birthday Contacts" feature could be enabled for any user, including administrators and super administrators, from a low privileged account within the Nextcloud application by navigating to the calendar settings and intercepting a specific request...
Mozilla: Stored Xss on bugzilla.mozilla.org via comment edit feature from non-admin to admin.
A stored XSS vulnerability was discovered on the comment edit feature of bugzilla.mozilla.org. This allowed an attacker to execute malicious JavaScript code when an admin attempted to edit a comment. The vulnerability was reported and a bug report was filed...
Nextcloud: Memcached used as RateLimiter backend is no-op
A vulnerability was discovered where the Memcached cache was used as the backend for rate limiting. This resulted in cache entries being wiped and rate limit attempts and bruteforce protection being bypassed...
Tools for Humanity: Race Condition Enables Bypassing Verification Check
A race condition was discovered in the WorldID platform that could enable bypassing the verification check limits. The issue resided in the enforcement of maximum allowed verifications, which was not properly synchronized across parallel requests to the cloud backend service. The fix implemented...
HackerOne: Support Tickets can be created on behalf of other users using spoofed email | Bypass of #2001913
A vulnerability allowed an attacker to create support tickets on behalf of other users by sending a fake email to [email protected]. This bypassed a previous fix implemented by HackerOne to prevent support tickets from being created via email...