15405 matches found
Weblate: Logging in without knowing credentials after logged out action
A vulnerability was discovered where a user could remain logged in to a website even after logging out, and the next person who accesses the site could be automatically logged in as the previous user without needing their credentials. This could potentially lead to sensitive data exposure and...
Weblate: CSRF with logout action
A vulnerability was discovered in Weblate that allowed a bad actor to log out a user by tricking them into clicking a specially crafted link or button. This vulnerability was caused by a lack of CSRF protection on the logout action...
inDrive: XSS on terra-6.indriverapp.com
A Cross-Site Scripting XSS vulnerability was discovered on the terra-6.indriverapp.com domain that allowed javascript code execution in users' browsers...
HackerOne: Insecure Direct Object Reference (IDOR) - Delete Campaigns
An insecure direct object reference IDOR vulnerability was discovered on a website, which allowed an attacker to delete any campaign based on the campaign ID. By modifying the campaign ID parameter in the request, an attacker could delete campaigns on any program. This vulnerability could have...
Rocket.Chat: Rocket.Chat Desktop client fails to open browser on 3rd party external actions from PDF documents
A persistent Cross-Site Scripting XSS vulnerability was identified in the Rocket.Chat Electron desktop application affecting versions 6.3.4 and older. The vulnerability could be exploited through the upload and subsequent user interaction with files containing specially crafted links...
Node.js: fs module's file watching is not restricted by --allow-fs-read
The fs module's file watching feature in Deno was not restricted by the --allow-fs-read flag, allowing attackers to watch files they did not have read access to...
Node.js: fs.openAsBlob() bypasses permission system
The fs.openAsBlob method in Node.js, when used with the --experimental-permission flag, allowed bypassing the permission system and reading files without the required permissions...
Reddit: Huge amount of Subdomains Takeovers at Reddit.com
Vulnerability description not provided...
Internet Bug Bounty: CVE-2023-28710 Apache Airflow Spark Provider Arbitrary File Read via JDBC
A vulnerability was discovered in Apache Airflow Spark Provider before version 4.0.1. The vulnerability allowed an attacker to read arbitrary files on the system by passing malicious schema parameters during the connection establishment process. This could be exploited by connecting to a maliciou...
Unikrn: An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashier
Vulnerability description not provided...
Mars: ████ ' can add animal to other account ' at ██████
The report indicates that a vulnerability was discovered that allowed an individual to add animals to other user accounts. The vulnerability was addressed by Cyber Defense...
Nextcloud: Text does not respect 'Allow download' permissions
A security vulnerability was discovered in Nextcloud that allowed users to bypass the 'Allow download' permission for sensitive images shared in a folder. This vulnerability allowed unauthorized users to download the images, potentially leading to the leakage of sensitive information...
LinkedIn: CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*
A CSRF vulnerability was identified that could potentially cause a LinkedIn user to follow an attacker-controlled account without additional confirmation by clicking a specially crafted URL...
Omise: Subdomain takeover http://accessday.opn.ooo/
Vulnerability description not provided...
Reddit: Regression on dest parameter sanitization doesn't check scheme/websafe destinations
A vulnerability was discovered in Reddit's login page where the "dest" parameter was not properly sanitized, allowing an attacker to perform a JavaScript-based Open Redirect attack. This could lead to Cross-Site Scripting XSS injection and potential cookie theft. An attacker could exploit this...
Node.js: Process-based permissions can be bypassed with the "inspector" module.
Process-based permissions in Node.js can be bypassed using the built-in inspector module, allowing an attacker to access restricted resources...
Reddit: [accounts.reddit.com] Redirect parameter allows for XSS
The dest parameter in accounts.reddit.com was vulnerable to Cross-Site Scripting XSS attacks, allowing an attacker to execute malicious code and steal user cookies by tricking them into logging in. The vulnerability was exploitable both for logged-in and logged-out users...
Node.js: Renaming/aliasing relative symbolic links potentially redirects them to supposedly inaccessible locations
Vulnerability description not provided...
LinkedIn: CSRF that makes any user send invitations to the attacker by simply clicking on a link.
A CSRF vulnerability was found that allowed sending connection invitations without confirmation when a user clicked on a link...
Node.js: Permissions policies can be bypassed via Module._load.
Vulnerability description not provided...
Reddit: Blind SSRF to internal services in matrix preview_link API
A vulnerability was found in the previewlink functionality of Matrix software used in Reddit's new chat system. The endpoint allowed for partially blind SSRF, enabling attackers to send GET requests and exfiltrate data about internal services. This could potentially lead to service enumeration an...
inDrive: Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal and more mentioned in the report.
A vulnerability was found in the customer order flow that allowed a driver to forcefully accept an order on behalf of a passenger, bypassing the normal negotiation process. This allowed the driver to set the ride price without following the built-in fare calculation algorithm...
Mars: ' Full Account Takeover ' at █████
A severe vulnerability was identified in the login functionality of a website belonging to Mars. An unauthorized actor could manipulate the server's response from the ██████████ endpoint to gain unauthorized access to any user account on the platform, leading to a full account takeover...
HackerOne: Banned user still able to invited to reports as a collabrator and reset the password
A security vulnerability allowed a permanently banned user to still be invited as a collaborator to reports and reset their password, despite being restricted from accessing any account features or reports...
8x8: Credential leak on GitHub: https://github.com/█/█/ (Peoplesoft CRM)
Credentials for a database associated with Peoplesoft CRM were leaked on GitHub. The leak was reported and the repository containing the credentials was taken down. The credentials were associated with a database that is no longer in use...
MercadoLibre: Stored Cross-Site Scripting in mercadopago.com.ar
The summary is as follows: A stored cross-site scripting vulnerability was discovered in mercadopago.com.ar. The issue was acknowledged and addressed by MercadoLibre internally...
Ruby on Rails: Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability.
An incorrect handling of certain characters passed to the redirection functionality in Rails could lead to a single-click XSS vulnerability. This vulnerability allowed an attacker to control the href attribute in the HTML response and serve an XSS payload by preventing the redirect. The...
Internet Bug Bounty: Possible DoS Vulnerability in Multipart MIME parsing in rack
A possible DoS vulnerability was found in the Multipart MIME parsing code in Rack. The vulnerability allowed carefully crafted requests to abuse the multipart parsing and cause it to take longer than expected, leading to high CPU and memory usage. All versions of Rack were affected, and the issue...
Nextcloud: user_oidc app is missing bruteforce protection
The useroidc app in Nextcloud was missing bruteforce protection, allowing attackers to iterate over data until they find valid authentication credentials, potentially bypassing authentication...
curl: CVE-2023-28322: more POST-after-PUT confusion
A vulnerability existed in libcurl that allowed an attacker to inject unintended data or cause a segfault by confusing the POST and PUT methods. The previous fix for this vulnerability was insufficient as it only corrected the CURLOPTPOST option, which is not always used when sending data with th...
Node.js: OpenSSL engines can be used to bypass and/or disable the permission model
Arbitrary OpenSSL engines could be loaded in Node.js 20, even when the permission model was enabled, which could bypass and/or disable the permission model, allowing for arbitrary code execution...
IBM: Subdomain Takeover Affecting at vex.weather.com
Vulnerability description not provided...
Node.js: Filesystem experimental permissions policy does not handle path traversal cases.
A path traversal vulnerability in the experimental filesystem permissions policy allowed bypassing restrictions and writing to unintended files...
Mars: ████ ' can change any account email and cannot retrieve his account and access it ' at ███
The security vulnerability described a method to change the email address of any user account, preventing the original user from accessing their account. The vulnerability involved manipulating the user profile update functionality to modify the email address. Despite an error message when...
Cloudflare Public Bug Bounty: Cloudflare CASB Confused Deputy Problem
A vulnerability was found in Cloudflare CASB on Microsoft and GitHub integrations, allowing an attacker to create a new integration and access sensitive information if they were able to enumerate a valid tenant UUID or domain. The issue was resolved by disallowing the creation of multiple...
GitHub Security Lab: CPP: Add query for CWE-369: Divide By Zero.
Vulnerability description not provided...
curl: CVE-2023-28321: IDN wildcard match
An improper validation of a certificate with host mismatch vulnerability was found in curl/libcurl, which allowed an attacker to perform a man-in-the-middle attack. The vulnerability was caused by the use of wildcards for validation during TLS communication, even if the hostname is an IDN. This...
Mars: Information Exposure Through Directory Listing
The vulnerability allowed an attacker to view the directory contents of the web server, leading to information disclosure. The directory listing function was not properly configured, exposing sensitive information...
Lark Technologies: Improper Access Control allows OTP bypass
A vulnerability was discovered that allowed the one-time password requirement to be bypassed when directly accessing the admin log download endpoint. This could have enabled users within the organization to access admin logs without verifying their identity. The issue was resolved after being...
Rockstar Games: Insecure Direct Object Reference allows Crew Invite deletion
An Insecure Direct Object Reference vulnerability was discovered in a service endpoint related to Crews management. This vulnerability allowed unauthorized users to delete outstanding Crew invitations from any Crew to any Social Club user. The vulnerability was resolved by implementing additional...
Mars: ███████ ' can delete any animal from other account ' at ██████████
The ██████████ website was found to have an Insecure Direct Object Reference IDOR vulnerability that allowed authenticated users to delete animals belonging to other users' accounts. This vulnerability arose due to the system's failure to properly validate and restrict access to protected resourc...
Brave Software: Open redirect due to scanning QR code via brave browser
An open redirect vulnerability was discovered in Brave's QR code scanner, which allowed attackers to direct users to malicious sites without their consent or knowledge. This vulnerability put the security of Brave users at risk and allowed them to be exposed to phishing and malware attacks. The...
Node.js: Dependency Policy Bypass via process.binding
The use of the deprecated API process.binding allowed for the bypassing of the policy mechanism in Node.js, potentially enabling the execution of arbitrary code outside the defined limits in a policy.json file. This vulnerability affected all users utilizing the experimental policy feature in...
Nextcloud: Missing permission check when removing a photo from an album
There was a vulnerability in the Nextcloud application where the permission check was missing when removing a photo from an album...
LinkedIn: “See who’s interested in working for your company” - security issue
A security vulnerability was identified in the "See who's interested in working for your company" feature of LinkedIn Recruiter. The vulnerability allowed recruiters to view profiles of members interested in working for certain companies. A fix was deployed to production within one month...
Internet Bug Bounty: CVE-2023-28755: ReDoS vulnerability in URI
A ReDoS vulnerability was discovered in the URI component of the Ruby programming language. The vulnerability allowed attackers to cause an increase in execution time for parsing strings to URI objects, resulting in high resource consumption, reduced performance, and denial of service. The...
LinkedIn: HTTP Request Smuggling (CL.0) leads to mass redirect users to attacker server without user interaction
Vulnerability description not provided...
Mars: Response Manipulation lead to bypass verification code while making appointment at `█████████`
The vulnerability allowed bypassing the verification code when making an appointment at █████████. The response could be manipulated to change the verification check from false to true, enabling the appointment to be completed without the correct code...