Mozilla: Potential Spoofing Risk through Firefox Private Relay Service

A potential spoofing risk was identified in the Firefox Private Relay service. Adversaries were able to send spoofing emails to users by leveraging the service. The design of the service allowed these spoofing emails to bypass security measures and reach the target inbox. This was due to the...

Nextcloud: Error when editing a calendar appointment returns stacktrace and query

A vulnerability was found where editing a calendar appointment and changing the ID to a non-existent value returned an error exposing internal server paths and an SQL query. The issue allowed disclosure of sensitive information...

Nextcloud: Admins can change authentication details of user configured external storage

A vulnerability was found where admins could change authentication details of user configured external storage. This allowed malicious admins to modify global credentials for other admin and user external storage...

Basecamp: AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in Basecamp

Sensitive data, including AWS keys and user cookies, could be leaked due to an uninitialized memory leak in an outdated version of librsvg used by Basecamp. This vulnerability allowed an attacker to upload a specially crafted SVG image as an avatar, triggering the memory leak. By extracting...

Mars: subdomain takeover at █████████

A subdomain takeover vulnerability was discovered. The subdomain had been pointing to an inactive third-party resource, allowing an attacker to claim the resource and take control of the subdomain. The attacker was then able to serve arbitrary content on the subdomain...

HackerOne: Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameter

A reflected cross-site scripting RXSS vulnerability was discovered on the image.hackerone.live website. The vulnerability allowed an attacker to bypass the fix implemented for a previous RXSS issue. By modifying the server's response to a HEAD request, the attacker could change the Content-Type a...

Mozilla: CSRF to Information disclosure on password reset

The vulnerability allowed an attacker to obtain the victim's IP address and browser details by tricking the victim into clicking on a malicious password reset link. The vulnerability was caused by a cross-site request forgery CSRF in the password reset functionality...

Rootstock Labs: DOS of RSKJ server

The RSKJ server was vulnerable to a Denial of Service DoS attack. The vulnerability was due to a flaw in the RLP Recursive Length Prefix decoding function, which could return a negative value, leading to a length of 0. This caused the server to process only one UDP packet forever, preventing it...

GitLab: Maintainer can leak sentry token by changing the configured URL (fix bypass)

A malicious Maintainer could have leaked the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365...

Internet Bug Bounty: (CVE-2023-32003) fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks

The fs.mkdtemp and fs.mkdtempSync functions in Node.js were found to be missing getValidatedPath checks, allowing for a path traversal attack. This vulnerability could be exploited to create arbitrary directories...

Internet Bug Bounty: (CVE-2023-32006) Permissions policies can impersonate other modules in using module.constructor.createRequire()

A vulnerability was discovered in Node.js that allowed permissions policies to impersonate other modules using the module.constructor.createRequire function. This could bypass the policy mechanism and enable the loading of modules outside of the defined policy. The vulnerability affected all user...

Internet Bug Bounty: (CVE-2023-32004) Permission model bypass by specifying a path traversal sequence in a Buffer

A vulnerability was discovered in Node.js version 20, specifically within the experimental permission model. It allowed for a bypass of the permission model by specifying a path traversal sequence in a Buffer, leading to improper handling of file permissions...

Nextcloud: user_ldap app logs user passwords in the log file on level debug

User passwords were logged in Nextcloud application logs when using LDAP authentication and debug log level settings...

HackerOne: Able to see Bonus amount given to a report even if the bounty and Bonus is not visible to public or mentioned in {Report-Id}.json

A vulnerability allowed users to see the bonus amount given to a report, even if the bounty and bonus were not visible to the public or mentioned in the report's JSON file. This resulted in the exposure of confidential information...

HackerOne: HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organization

A vulnerability was discovered where SAML signup domain enforcement for new signups belonging to SAML-enabled organizations could be bypassed by appending control characters, allowing unauthorized access. This was leveraged to access the HackerOne PullRequest organization and view source code in...

WakaTime: Waketime Payment Gateway Vulnerability

Vulnerability description not provided...

GitLab: Information Disclosure - Pvt Gitlab Issue Disclosing Through GitLab Unfiltered YouTube channel.

A private issue report containing sensitive information was inadvertently disclosed through a video on the GitLab Unfiltered YouTube channel. The video showcased specific URLs, code snippets, and vulnerability descriptions, posing a potential security risk. Immediate action was recommended to...

HackerOne: Staff and Triage can modify the initial post of a report, including of already disclosed reports

The initial post of a report on HackerOne could be modified by program members and Triage, allowing them to change the information and potentially manipulate the narrative of the report...

8x8 Bounty: Jitsi: Bridge Message Spoofing due to Improper JSON Handling leads to Prototype Pollution

The Jitsi VideoBridge failed to properly handle JSON messages with duplicate colibriClass keys, enabling clients to send messages interpreted differently by the bridge and resulting in unauthorized actions within video conferences. Jitsi Security Advisory has been published...

Internet Bug Bounty: Cargo not respecting umask when extracting crate archives

Cargo did not respect the umask when extracting crate archives on UNIX-like systems, potentially allowing a local attacker to modify the source code compiled and executed by the current user...

Nextcloud: Password of talk conversations can be bruteforced

The password of talk conversations could be bruteforced by adding the password as a parameter on the GET request of the frontpage instead of sending a POST to the authentication endpoint. This allowed bypassing brute force protection of public talk conversation passwords...

Cloudflare Public Bug Bounty: Yet Another CASB Integration Takeover of Active Integrations

A vulnerability was found in a cloud access security broker's Microsoft integration where an attacker could bypass confused deputy protections. By manipulating the casing of a tenant UUID, a new integration could be created that surfaced sensitive customer information. This issue was addressed by...

Node.js: Integrity checks according to policies can be circumvented

The Node.js policy feature, which checks the integrity of a resource against a trusted manifest, could be circumvented by intercepting the operation and returning a forged checksum, effectively disabling the integrity check. This vulnerability affected all users using the experimental policy...

Cosmos: RCE and DoS in Cosmovisor

Vulnerability description not provided...

Node.js: Permission model improperly protects against path traversal

Vulnerability description not provided...

Node.js: Bypass network import restriction via data URL

A security flaw in Node.js was discovered that allowed bypassing of network import restrictions. By embedding non-network imports in data URLs, arbitrary code execution was possible, compromising system security. The vulnerability was verified on various platforms and was mitigated by forbidding...

Internet Bug Bounty: OpenSSL engines can be used to bypass and/or disable the Node.js permission model

Arbitrary OpenSSL engines could be loaded in Node.js 20, bypassing and disabling the permission model. This allowed for the execution of arbitrary code, unaffected by the permission model...

IBM: RXSS in hidden parameter

RXSS in hidden parameter was reported to IBM, analyzed, and has been remediated. The vulnerability was a reflected cross-site scripting issue found in a hidden parameter...

U.S. Dept Of Defense: Adobe ColdFusion Access Control Bypass - CVE-2023-38205

A vulnerability in Adobe ColdFusion was discovered that allowed bypassing access controls by using malicious path traversal in URLs targeting the /CFIDE/wizards/common/utils.cfc endpoint. This enabled attackers to reach endpoints that should have been restricted. The issue affected Adobe ColdFusi...

Mars: Reflected XSS on formaction parameter

The formaction parameter of the target application was found to contain a reflected Cross-Site Scripting XSS vulnerability. User-supplied data was reflected back without proper sanitization, allowing for the injection of malicious JavaScript code. The issue was compounded by potential cache...

Yelp: yelp.com and biz.yelp.com ATO via XSS + Cookie Bridge

The researcher discovered an XSS vulnerability on biz.yelp.com where the unverified email was reflected in a message, allowing for arbitrary JavaScript execution. This XSS was combined with Yelp's cookie bridge functionality to target other users, leaking HttpOnly session cookies and enabling...

Liberapay: Disavowed an email without any authentication

Vulnerability description not provided...

Yahoo!: Bitly link takeover

A vulnerability was discovered in which a Bitly link referred to in the description of a Yahoo Twitter handle was broken and redirected to an unintended destination. This situation presented an opportunity for attackers to potentially hijack the link and direct users to a malicious website for...

Daimler Truck: Blind xss at https://homologation.omniplus.com/

Hello team, I have found a blind xss leads to admin panel exposed with cookie StepToReproduce 1- Navigate to https://homologation.omniplus.com/ 2- You will face a submit form contains 6 pages 3- At each input field you have to put your blind xss payload , for me I used xss.report just go there an...

Cloudflare Public Bug Bounty: Permanent CASB Integration Takeover due to Improper Access Controls+Confused Deputy Problem

A security vulnerability was discovered in Cloudflare's Cloud Access Security Broker CASB integration, allowing potential unauthorized access to sensitive information. The vulnerability, known as the "confused deputy problem," affected a limited set of integrations. Cloudflare promptly addressed...

HackerOne: Takeover of hackerone.engineering via Github

The hacker was able to take over the hackerone.engineering domain after a brief misconfiguration window on GitHub. They claimed the domain in their own repository while the DNS records were still pointing towards GitHub. The issue has been resolved and no malware was found on the site during the...

IBM: IDOR in upload videos of a Channel on https://video.ibm.com

Vulnerability description not provided...

Node.js: WASI sandbox escape via symlink

A WASI + WASM program was discovered to be able to use pathsymlink to read arbitrary files on the host machine by creating a symlink in a preopen to a different location on the local file system, thereby escaping the WASI sandbox...

U.S. Dept Of Defense: Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/

The host https://██████/ had a vulnerability in the /jenkins/script directory that allowed users to execute system commands on the host. This could have led to the disclosure of AWS IAM credentials, which could have been used by an attacker to manage various AWS resources, create and delete...

IBM: IDOR in channel ID leads to customer email disclosure on https://video.ibm.com

Vulnerability description not provided...

HackerOne: Register & create a ticket as somebody else on HackerOne Support

A vulnerability was discovered on HackerOne Support that allowed an attacker to register and create tickets as different individuals. The issue was resolved by adjusting a setting in the Freshdesk Software...

U.S. Dept Of Defense: Adobe ColdFusion - Access Control Bypass [CVE-2023-38205] at ██████

An access control bypass vulnerability was discovered in Adobe ColdFusion, allowing attackers to bypass the restriction on external access to the ColdFusion Administrator...

HackerOne: Bypass report submit restriction/ban using the API key

A vulnerability was discovered that allowed banned researchers to submit reports through API keys, bypassing reporting restrictions. By creating an API key after an account was banned from submitting reports, a researcher could still submit reports to programs without restrictions, potentially...

LinkedIn: Deny Admin from Editing LinkedIn Company Page using Gen Form Visibility via POST /voyager/api/voyagerOrganizationDashCompanies/{id}

Vulnerability description not provided...

U.S. Dept Of Defense: LDAP Anonymous Login enabled in ████

LDAP Anonymous Login was enabled in ██████████, allowing unauthorized users to connect to the LDAP server without providing any authentication credentials. This could lead to unauthorized access and retrieval of sensitive information stored in the LDAP directory...

U.S. Dept Of Defense: Blind Sql Injection in https://█████/qsSearch.aspx

A blind SQL injection vulnerability was discovered in the qsSearch.aspx page of the application. An attacker could exploit this vulnerability to bypass authentication and retrieve sensitive information from the database. The vulnerability has been mitigated by implementing appropriate security...

HackerOne: Unauthorized Ticket can be created by an Attacker in user's Helpdesk account

An unauthorized user was able to create tickets in any user's helpdesk account without authorization or knowledge...

Node.js: Permission model improperly processes UNC paths

The vulnerability in the istreegranted function in fspermission.cc assumed that any path starting with two backslashes had a four-character prefix that could be ignored, which was not always true. This led to vulnerable edge cases on Windows systems...

Mozilla: Exposing Django Debug Panel and Sensitive Infrastructure Information at https://dev.fxprivaterelay.nonprod.cloudops.mozgcp.net

The Django Debug Panel was exposed in a development environment, allowing sensitive infrastructure information to be accessed. This included details about the locations of databases, user information, and internal IP addresses. The exposure of this information posed significant security risks and...

Internet Bug Bounty: CVE-2023-30587 Process-based permissions can be bypassed with the "inspector" module.

A vulnerability in Node.js version 20 allowed for the bypassing of restrictions set by the --experimental-permission flag using the built-in inspector module. This vulnerability affected Node.js users who were using the permission model mechanism in Node.js 20...