15405 matches found
GitHub Security Lab: [Python]: Timing attack
Vulnerability description not provided...
Mars: CRLF Inection at `██████████`
A CRLF injection vulnerability was discovered in the website ██████████. The vulnerability was caused by the application's failure to properly sanitize or encode user-supplied data containing carriage return and line feed CRLF sequences...
MetaMask: MetaMask Browser (on Android) does not enforce Content-Security-Policy header
The MetaMask Mobile browser was discovered to ignore Content-Security-Policy headers set by websites, allowing potential execution of scripts that should have been blocked. The issue was caused by an error in how the application handled web requests while trying to ensure the MetaMask JavaScript...
Cloudflare Public Bug Bounty: Plaintext leakage of DNS requests in Windows 1.1.1.1 WARP client
A vulnerability in the Windows 1.1.1.1 WARP client allowed for plaintext leakage of DNS requests. When connected to WARP over an IPv6-capable network, the client assigned Unique Local Addresses instead of loopback IPv6 addresses. This could potentially expose DNS queries to unknown devices on the...
Acronis: Stored XSS in plan name field (Acronis Cyber Protect)
A stored XSS vulnerability was identified in the plan name field of Acronis Cyber Protect. This vulnerability allowed an attacker to execute arbitrary JavaScript code in the context of the affected user, potentially leading to unauthorized access or phishing attacks...
Snapchat: internal dev tokens disclosure
Sensitive internal development information was inadvertently disclosed in the commits history of the open-source project Keydb, which was made public by Snapchat. This included a Personal Access Token PAT used for GitHub authentication, which could have been exploited by malicious actors...
GitHub: Smuggling content in PR with refs/replace in GitHub
An incorrect comparison vulnerability was found in GitHub Enterprise Server, allowing commit smuggling through the display of an incorrect diff in the GitHub pull request UI. This vulnerability required write access to the repository and affected versions 3.7.0 and above. It was fixed in versions...
Shopify: Reflected XSS on help.shopify.com
A reflected cross-site scripting vulnerability was present in the returnTo parameter on help.shopify.com that allowed javascript code execution if specific steps were followed...
Ruby: heap-buffer-overflow in gc_writebarrier_incremental
Vulnerability description not provided...
U.S. Dept Of Defense: AEM misconfiguration leads to Information disclosure
Sensitive information was disclosed due to a misconfiguration in AEM, allowing access to internal usernames and webroot directories by appending /.1.json to certain URLs. This could lead to unauthorized access, social engineering attacks, and reputation damage...
U.S. Dept Of Defense: Default Credentials on Kinetic Core System Console - https://█████/kinetic/app/
Weak default credentials of "admin/admin" were discovered on the Kinetic Core System Console application, potentially allowing attackers to identify underlying technologies and access sensitive information such as server logs and user data. The vulnerability was present in version 2.1.0-SNAPSHOT...
U.S. Dept Of Defense: LDAP Server NULL Bind Connection Information Disclosure
The LDAP server allowed anonymous access, which could lead to information disclosure. Attackers could exploit this vulnerability to gain access to sensitive information. The recommended mitigation is to configure the service to disallow NULL BINDs...
GitLab: HTML injection possible with soft email confirmations when Administrator manually confirms attacker email address
The vulnerability allowed an attacker to include an HTML payload in their email address. If an administrator manually confirmed the attacker's unconfirmed email address, the HTML payload was rendered within the context of the self-hosted GitLab instance...
Sony: SQL Injection at https://████ via ███ parameter
Vulnerability description not provided...
IBM: IBM Maximo Asset Management could allow a remote attacker to bypass authentication due to improper access controls
Improper access controls in IBM Maximo Asset Management could allow a remote attacker to bypass authentication. This issue was reported to IBM, analyzed, and remediated...
Reddit: RichText parser vulnerability in scheduled posts allows XSS
Hyperlinks were not being filtered on the server-side in Reddit's scheduled post feature, allowing an attacker to modify a request with a normal hyperlink that embeds a malicious link using a javascript scheme. This could result in an XSS attack if an admin clicked on the malicious link while...
Bitwarden: Bypass for forced re-authentication upon biometrics change
A vulnerability allowed an attacker with physical access to a phone to bypass biometric authentication in the Bitwarden app, granting access to view and delete passwords...
curl: CVE-2023-28320: siglongjmp race condition
A race condition vulnerability existed in libcurl's siglongjmp call when using the USEALARMTIMEOUT codepath for DNS resolution. If two threads performed DNS resolving, a wrong register context could be used on the signal handler siglongjmp call if DNS timeout occurred, resulting in a segmentation...
Internet Bug Bounty: ReDoS( Ruby, Time)
A ReDoS vulnerability was discovered in the Time gem 0.1.0 and 0.2.1 and Time library of Ruby 2.7.7, which mishandles invalid strings with specific characters, causing an increase in execution time for parsing strings to Time objects. The vulnerability was assigned the CVE identifier...
GitHub Security Lab: [Ruby]: Server Side Template Injection
Vulnerability description not provided...
Weblate: Testing flow includes a DeepSource secret
The testing workflow for the WeblateOrg/wlc repository included a DeepSource secret, which could have allowed a malicious actor to access parts of the repository and report artifacts to DeepSource. The recommended usage would have been to create a GitHub action environment secret and call it at...
Node.js: DiffieHellman doesn't generate keys after setting a key
DiffieHellman in Node.js did not generate new keys after setting a key, due to an issue in OpenSSL. This vulnerability could have allowed for key reuse and potential compromise of confidentiality and integrity in applications relying on DiffieHellman for security...
WordPress: Previously created sessions continue being valid after 2FA activation
A vulnerability was discovered in the 2FA function of WordPress, where previously created sessions continued to remain valid after 2FA activation. This allowed unauthorized access to the account without requiring the 2FA code...
Nextcloud: Notes attachments render HTML in preview mode
Vulnerability description not provided...
Nextcloud: Improper restriction of excessive authentication attempts on WebDAV endpoint
Vulnerability description not provided...
GitLab: Account takeover due to insufficient URL validation on RelayState parameter
An insufficient URL validation on the RelayState parameter in GitLab allowed attackers to steal Bitbucket access tokens and other third-party access tokens, such as Google, Salesforce, and Twitter. The vulnerability was due to an open redirect while logging in to GitLab via SAML, which saved the...
Nutanix: Limited Disclosure: Employee credentials checked in to github (fixed)
Vulnerability description not provided...
Mars: Stored XSS via ' profile ' at ███
The vulnerability involved stored XSS on the profile page of the affected application. An attacker could register an account, verify it, and then change the animal name field to a malicious JavaScript payload. When the victim viewed the attacker's profile, the payload was executed...
Rockstar Games: Access to the business emails of Rockstar Support agents through the support platform
The researcher identified a flaw in the Zendesk configuration on the Rockstar Games support platform that allowed users to access the business emails of support agents. The issue was resolved earlier this year when the support site was overhauled...
Nextcloud: Brute force protection allows to send more requests than intended
Vulnerability description not provided...
HackerOne: Any one can view collaborater email address via path /reports/<id>/participants
The vulnerability allowed anyone to view the email address of collaborators invited to vulnerability reports through the program's API. Access to collaborator email addresses was not properly restricted...
Internet Bug Bounty: Authenticated but unauthorized users may enumerate Application names via the API
An information disclosure vulnerability existed in all versions of Argo CD starting with v0.5.0, allowing authenticated but unauthorized users to enumerate application names via API error messages. This could be used as a starting point for further attacks, such as social engineering. The...
Nextcloud: Twitter Account hijack @nextcloudfrance
The Twitter account of Nextcloud France was vulnerable to Broken Link Hijacking BLH attack, which occurs when attackers exploit expired external links on credible websites or web applications. The attackers took over the expired link and claimed the username for testing purposes, redirecting user...
Flickr: High resource consumption by insufficient sanitization of forum threads pagination
The forum threads pagination functionality was insufficiently sanitized, leading to high resource consumption. When a page number was provided in the URL that exceeded the number of available pages, an infinite loop was triggered, generating excessive markup on each iteration. The issue was...
GitLab: Arbitrary escape sequence injection in docker-machine from worker nodes
Vulnerability description not provided...
TikTok: Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/
Vulnerability description not provided...
GitHub Security Lab: [ruby]: ZipSlip/TarSlip vulnerability detection
Vulnerability description not provided...
Nextcloud: End-to-end encrypted file-drops can be made inaccessible
An end-to-end encrypted file-drop vulnerability allowed attackers to modify the metadata file and make the uploaded file inaccessible. The vulnerability could break the availability of the file. The issue was resolved by not providing the metadata file to the user and appending the new entry in t...
Nextcloud: No rate limit while adding Additional emails feature
Vulnerability description not provided...
curl: CVE-2023-28319: UAF in SSH sha256 fingerprint check
Vulnerability description not provided...
Mozilla: Race condition leads to add more than 5 email at Data breaches monitor system at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net
A race condition vulnerability was identified in the Mozilla Monitor application. The application was designed to limit users to adding a maximum of 5 email addresses for monitoring potential data breaches. However, due to the race condition, it was possible to bypass this restriction and add mor...
Mozilla: HTML Injection at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net/user/unsubscribe
An HTML injection vulnerability was discovered on the "Unsubscribe" page of the website. This vulnerability allowed an attacker to inject malicious code, potentially leading to various attacks against users of the application...
Internet Bug Bounty: CVE-2023-27537: HSTS double-free
A double-free vulnerability was discovered in libcurl's support for sharing HSTS data between separate handles, which could result in a use-after-free or double-free when two threads share the same HSTS data without proper mutexes or thread locks...
Nextcloud: Blind SSRF as normal user from mailapp
Vulnerability description not provided...
Internet Bug Bounty: CVE-2023-27538: SSH connection too eager reuse still
A vulnerability was found in libcurl that allowed the reuse of a previously created SSH connection even when an SSH related option had been changed that should have prohibited reuse. This was due to two SSH settings being left out from the configuration match checks, making them match too easily...
Internet Bug Bounty: CVE-2023-27536: GSS delegation too eager connection re-use
A vulnerability was found in libcurl versions 7.22.0 to 7.88.1 that allowed for the reuse of a previously created connection even when the GSS delegation option had been changed, potentially changing the user's permissions in a second transfer. This could affect krb5/kerberos/negotiate/GSSAPI...
Internet Bug Bounty: CVE-2023-27535: FTP too eager connection reuse
A vulnerability was found in libcurl versions 7.13.0 to 7.88.1 that allowed the reuse of previously created FTP connections even when one or more options had been changed, leading to the second transfer being done with wrong credentials. This was due to several FTP settings being left out from th...
Internet Bug Bounty: CVE-2023-27534: SFTP path ~ resolving discrepancy
A vulnerability was discovered in curl's SFTP implementation that allowed the tilde character to be used as a prefix in the first element of a path, resulting in the wrong path being accessed. This could be exploited to circumvent filtering or other security measures. The vulnerability was presen...
Internet Bug Bounty: CVE-2023-27533: TELNET option IAC injection
A vulnerability CVE-2023-27533 was found in curl versions 7.7 to 7.88.1 that allowed users to pass on user name and "telnet options" for server negotiation without proper input scrubbing, potentially allowing for the injection of unintended TELNET commands to the telnet connection. The severity o...
U.S. Dept Of Defense: Sensitive Data Exposure via wp-config.php file
Sensitive data exposure occurred via the wp-config.php file, which contained confidential information such as MySQL and AWS credentials and various keys. The vulnerability was found on a specific endpoint, and it could potentially provide unauthorized access to sensitive information to users who ...