15405 matches found
U.S. Dept Of Defense: CVE-2023-24488 xss on https://██████/
Vulnerability description not provided...
Cloudflare Public Bug Bounty: Ability to bypass Admin override on Cloudflare WARP Android
A security vulnerability allowed an attacker with local access to an Android device running Cloudflare WARP to bypass the Admin override feature by changing the device's date and time settings. This allowed the attacker to extend the maximum allowed disconnected time of the WARP client granted by...
Node.js: Policy-restricted modules can escalate to higher privileges by impersonating other modules in a policy list using module.constructor.createRequire()
A vulnerability was discovered in Node.js that allowed policy-restricted modules to gain higher privileges by impersonating other modules in a policy list using module.constructor.createRequire. This vulnerability affected all users using the experimental policy mechanism in Node.js versions 16.x...
Tennessee Valley Authority: Admin.MyTVA.com Customer lookup and internal notes bypass
The admin.mytva.com site had a vulnerability that allowed an attacker to bypass the login and access admin-only endpoints. This could lead to unauthorized access to customer information and the ability to add internal notes...
ownCloud: Cross-Site Request Forgery
A cross-site request forgery vulnerability was found in an application. Requests were not validating cross-site request forgery tokens, allowing an unauthorized user to perform administration functions by inserting valid session cookies into arbitrary requests. This could have enabled an attacker...
HackerOne: An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed
A vulnerability was found where users could create and modify the status of pentest opportunities without going through the intended review process...
curl: CVE-2023-32001: fopen race condition
A race condition vulnerability existed in the fopen function of the curl library. This vulnerability allowed an attacker to exploit the race condition between the stat and fopen functions, potentially leading to unauthorized file overwrites or the theft of sensitive data such as cookies. The...
Kubernetes: Code inject via nginx.ingress.kubernetes.io/permanent-redirect annotation
The nginx.ingress.kubernetes.io/permanent-redirect annotation was not properly sanitized when passed into the nginx configuration, allowing code injection from users able to create ingress objects. This allowed commands to be run on the ingress-nginx-controller pod and the Kubernetes API to be...
Automattic: Entering passwords on the Share Login Page can lead to a brute-force attack
The Share Login Page on the Crowdsignal platform had a vulnerability that allowed for brute-force attacks on passwords. This could potentially grant unauthorized access to sensitive information such as Results, Answer Details, Devices, Locations, and Participants...
MTN Group: Reflected XSS in https://nin.mtn.ng/nin/success?message=lol&nin=<VULNERABLE>
The reflected XSS vulnerability was found in the 'nin' parameter of the 'https://nin.mtn.ng/nin/success' endpoint. Successful exploitation allowed an attacker to execute arbitrary JavaScript in the victim's browser...
Acronis: [oem.acronis.com] Reflected Cross Site Scripting
The researcher discovered a reflected cross-site scripting XSS vulnerability on the oem.acronis.com website. The vulnerability was found on the /test/testenv.html page, where user-supplied input was not properly sanitized, allowing the execution of arbitrary JavaScript code...
Internet Bug Bounty: DiffieHellman doesn't generate keys after setting a key
A security vulnerability was discovered in the DiffieHellman module of Node.js. The module did not generate new keys after setting a private key, potentially leading to the reuse of nonces and compromising security measures such as forward secrecy and IND-CPA...
Node.js: Permission model bypass by specifying a path traversal sequence in a buffer,
A vulnerability was discovered in Node.js version 20, specifically within the experimental permission model. This flaw allowed for the bypassing of file permissions by specifying a path traversal sequence in a buffer. The vulnerability affected all users utilizing the experimental permission mode...
Automattic: Authentication bypass on JetPack SSO manager - Allows to access the administration panel of wordpress without user interaction
A vulnerability was found in the JetPack SSO manager plugin that allowed authentication bypass on WordPress sites using the plugin. By exploiting the plugin's account invitation and email verification features, an attacker could gain administrative access to WordPress sites with a user account...
Node.js: fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks.
A vulnerability was found in the fs.mkdtemp and fs.mkdtempSync functions in Node.js 20, which allowed malicious actors to bypass the permission model check and create arbitrary directories...
Mars: Stored XSS + CSRF in "apellido" value
A stored cross-site scripting and cross-site request forgery vulnerability was discovered in the "apellido" value of a user profile updating form, allowing unauthorized changes to be made to user accounts...
Mozilla: Subdomain takeover on one of the subdomain under mozaws.net
A dangling DNS record enabled subdomain takeover on a mozaws.net subdomain. Researchers exploited this to host content on the affected subdomain...
HackerOne: RXSS at image.hackerone.live via the `url` parameter
Vulnerability description not provided...
Frontegg: Bypassing the block of Security Domain Restriction and normally invite blocked domains with special characters “İ”
The vulnerability allows users to bypass the security domain restriction and invite blocked domains by using special characters such as "İ" instead of "I" or "i". The vulnerability was reported and could potentially have been abused to violate the owner's rules and invite blocked domains to the...
Internet Bug Bounty: HTTP Request Smuggling via Empty headers separated by CR
The llhttp parser in the Node.js http module did not strictly use the CRLF sequence to delimit HTTP requests, which allowed for HTTP Request Smuggling HRS. This vulnerability affected all active versions of Node.js...
HackerOne: Internal machine learning API endpoint for CWE classification is vulnerable to path traversal
Vulnerability description not provided...
HackerOne: An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name
An attacker could view any hacker or normal user's email on HackerOne by sending an invitation via a dummy report, thereby disclosing their private email...
Invision Power Services, Inc.: XSS with Visual Language Editor tags
A security vulnerability allowed an attacker to execute arbitrary code on a website by exploiting the Visual Language Editor tags. By injecting malicious code into a post or comment, the attacker could gain full control of the website and its data. The vulnerability has been patched...
Mozilla: Mozilla FuzzManager API Token Exposed in Git Commit
An API token for a Mozilla fuzzing service was exposed in a GitHub repository commit. The token provided read-write access to internal fuzzing data. The token was rotated and configured for write-only access...
Mars: CSRF to delete a pet
The /kisallataim/ANIMALID/delete API endpoint at myroyalcanin.hu was found to be vulnerable to Cross-Site Request Forgery CSRF attacks. This vulnerability could have been exploited to delete a user's pet from their account without their knowledge or consent...
Teleport: robots.txt file
The web server includes a robots.txt file that serves a crucial role in providing instructions to web robots, such as search engine crawlers, about the permissible areas of the website that they can crawl and index. While the presence of this file does not pose a direct threat to the security of...
Rocket.Chat: IDOR vulnerability leads to Deleting message after leaving/getting banned from group using message ID
The vulnerability discovered was an IDOR Insecure Direct Object Reference vulnerability. The issue allowed a user to delete messages in a channel they had been banned from or left, using the message ID obtained from a previous message sent in the channel. This vulnerability existed because the...
inDrive: #3 XSS on watchdocs.indriverapp.com
A cross-site scripting XSS vulnerability was discovered on the watchdocs.indriverapp.com website. The vulnerability allowed an attacker to execute arbitrary JavaScript code in the victim's browser by injecting malicious input into the URL parameters...
Glassdoor: IDOR vulnerability on profile picture changing mechanism which discloses other user's profile picture.
Vulnerability description not provided...
GitHub Security Lab: [Python] Unsafe Unpacking and TarSlip bug slaying
Vulnerability description not provided...
Nextcloud: Issuer not verified from obtained token in user_oidc
The issuer verification in the useroidc app of Nextcloud did not properly validate the issuer of the obtained token, potentially allowing for a Man-in-the-Middle attack...
U.S. Dept Of Defense: Blind Sql Injection https:/████████
A blind SQL injection vulnerability was discovered on a website, allowing an attacker to execute arbitrary SQL commands...
GitHub: Git Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code Execution
A vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling due to an incorrect diff comparison in re-opened pull requests. This affected all versions of GitHub Enterprise Server and was fixed in newer releases...
GitHub Security Lab: cpp: if (a+b>c) a=c-b is incorrect if a+b overflows
Vulnerability description not provided...
GitHub Security Lab: JavaScript: Add some new XSS sinks and sources of Next.js (and some extra improvements)
Vulnerability description not provided...
Snapchat: HTML injection on newsroom.snap.com/* via search?q=1
An unauthenticated HTML injection vulnerability was discovered on the newsroom.snap.com website. The vulnerability allowed attackers to inject arbitrary HTML code through the search engine's input parameter. This could lead to various malicious activities, such as defacement of the website or...
Mozilla: Subdomain takeover on one of the subdomain under mozilla.org
Vulnerability description not provided...
Mozilla: Internal Blind Server-Side Request Forgery (SSRF) allows scanning internal ports
Vulnerability description not provided...
inDrive: #2 XSS on watchdocs.indriverapp.com
An XSS vulnerability was discovered on watchdocs.indriverapp.com. The vulnerability allowed execution of JavaScript on the user's browser...
inDrive: #1 XSS on watchdocs.indriverapp.com
The security vulnerability found on watchdocs.indriverapp.com allowed for cross-site scripting XSS attacks. The vulnerability was triggered by crafting a specific URL that executed arbitrary JavaScript code when accessed by users...
Basecamp: Spam & Clearance checks disabled with existing referenced Message-ID
A vulnerability in the inbound email processing allowed crafted emails to bypass spam filtering and The Screener when they appeared to be in reply to an existing thread...
Automattic: Stored XSS on wordpress.com
A Stored XSS vulnerability was found on WordPress.com via app.crowdsignal.com. An attacker could execute malicious script code in the victim user's browser and redirect them to malicious sites by creating a poll with a specific payload and sharing the link on a WordPress post. The vulnerability w...
TikTok: CRLF to XSS & Open Redirection
Due to inadequate input validation, a vulnerability allowed for the injection of CRLF HTTP Response Splitting into a parameter on a TikTok seller endpoint. This could have resulted in Reflective XSS Cross-Site Scripting and open redirection attacks. The vulnerability has been resolved...
Nord Security: Subscription check bypass of NordVPN service
An issue was discovered in one of NordVPN's backend services that allowed users to bypass the subscription check and access the VPN service without a valid subscription. The exploitation of this issue required performing specific steps each time a user wanted to connect to the VPN service. The...
Internet Bug Bounty: [CVE-2023-22799] Possible ReDoS based DoS vulnerability in GlobalID
A ReDoS-based DoS vulnerability was discovered in the GlobalID gem, affecting versions 0.2.1 and above. Crafted input could cause the regular expression engine to consume excessive processing time, leading to a denial of service. The issue has been fixed in version 1.0.1...
Internet Bug Bounty: [CVE-2023-22796] Possible ReDoS based DoS vulnerability in Active Support’s underscore
A regular expression based Denial of Service DoS vulnerability was discovered in Active Support. The vulnerability allowed for a specially crafted string to cause the regular expression engine to enter a state of catastrophic backtracking, leading to excessive CPU and memory usage. The...
Internet Bug Bounty: [CVE-2022-44572] Possible Denial of Service Vulnerability in Rack’s RFC2183 boundary parsing
A denial of service vulnerability was discovered in the multipart parsing component of Rack. This vulnerability could be exploited by carefully crafted input to cause the RFC2183 multipart boundary parsing in Rack to consume an unexpected amount of time, potentially leading to a denial of service...
Internet Bug Bounty: [CVE-2022-44571] Possible Denial of Service Vulnerability in Rack Content-Disposition parsing
A denial of service vulnerability was discovered in the Content-Disposition parsing component of Rack. This vulnerability could be exploited by carefully crafted input to cause the parsing process to consume an unexpected amount of time, potentially leading to a denial of service attack. The...
Internet Bug Bounty: [CVE-2022-44570] Possible Denial of Service Vulnerability in Rack’s Range header parsing
A denial of service vulnerability was discovered in the Range header parsing component of Rack. This vulnerability could be exploited by sending carefully crafted input to the Range header, causing the parsing component to consume an unexpected amount of time and potentially leading to a denial o...
HackerOne: Asset Inventory Internal Descriptions are leaked in CSV export
An internal asset description in the Asset Inventory feature of HackerOne was leaked in the CSV export, potentially exposing sensitive information stored in the description...