15405 matches found
U.S. Dept Of Defense: HAProxy stats panel exposed externally
An exposed web panel for HAProxy running on a system allowed external access to the statistics page at port 1024, potentially exposing sensitive information...
Node.js: node.js process aborts when processing x509 certs with invalid public key information
A vulnerability existed in Node.js versions 18.14.2 and 19.7.0 that allowed malicious actors to cause a denial-of-service DoS by providing x509 certificates with invalid public key information. This vulnerability could lead to the termination of the Node.js process, resulting in interruptions to...
Brave Software: UXss on brave browser via scan QR Code
A UXss vulnerability was found in Brave browser on Android 13, allowing an attacker to execute Xss on all open domains by scanning a QR code containing a malicious URL. The vulnerability could potentially allow attackers to steal victim's cookies and affect various websites...
Uber: Complete Admin account takeover due to PhpDebugBar turned on in Uber's production server
A security vulnerability was discovered in Uber's production server on February 22, 2023. The vulnerability allowed an attacker to gain complete admin account takeover due to PhpDebugBar being turned on...
U.S. Dept Of Defense: Reflected XSS in ██████████
A reflected XSS vulnerability was found on one of the subdomains of a website. The vulnerability was present in the "militarybranch" parameter of the "NextRequestAccount.action" page. An attacker could exploit this vulnerability to execute XSS attacks and steal user's cookies, launch phishing...
U.S. Dept Of Defense: Reflected XSS in ██████████
A reflected XSS vulnerability was found on one of the subdomains of a website. The vulnerability was present in the "militarybranch" parameter of the "NextRequestAccount.action" page. An attacker could exploit this vulnerability to execute XSS attacks and steal user's cookies, launch phishing...
U.S. Dept Of Defense: Reflected XSS in ████████████
A reflected XSS vulnerability was found on one of the subdomains of a website. The vulnerability was located in the "home" parameter of the "auth/logout.jsx" page, which allowed an attacker to execute arbitrary JavaScript code in the victim's browser. This could lead to the theft of user cookies,...
Mozilla: Email user account in indexacao waybackurl
The indexation of a large number of user emails on the Internet Archive in the Mozilla accounts service, accounts.firefox.com, was discovered. The presence of the leaked data was reported to Mozilla, but it did not meet the criteria for a security risk due to the lack of a current flaw in a Mozil...
Mozilla: HTML Injection / Reflected Cross-Site Scripting with CSP on https://accounts.firefox.com/settings
A vulnerability was found on accounts.firefox.com, where the flowId parameter was reflected into the server response without being escaped for HTML, causing a Cross-Site Scripting attack. The Content-Security-Policy on Firefox's website prevented arbitrary JavaScript code execution, but an attack...
Tor: Snowflake server: Leak of TLS packets from other clients
TLS packets from other clients were leaked to Snowflake clients due to a vulnerability in the Snowflake pluggable transport server. This issue allowed Snowflake clients to receive "ghost" packets at the KCP layer, containing TLS packets unrelated to the current session. The leaked packets include...
LY Corporation: Reflected XSS on https://travel.line.me
A reflected cross-site scripting vulnerability was identified in the search feature of the travel platform at https://travel.line.me. JavaScript code in the search parameters was reflected back to the user...
Nextcloud: Basic auth header on WebDAV requests is not bruteforce protected
A basic authentication bypass vulnerability was discovered on WebDAV requests, due to a lack of rate limit protection. Attackers could brute force the password and gain full account takeover. The vulnerability was reported and fixed...
Mozilla: Missing Function Level Access Control in Mozilla formula containsRegular Expression Denial of Service (CVE-2023-25166)
Vulnerability description not provided...
U.S. Dept Of Defense: Email exploitation with web hosting services.
A vulnerability allowed an attacker to send emails to anyone using an organization's email list and to its people by uploading a PHP file to the public HTML. The vulnerability could result in reputation loss, phishing attacks, and the theft of internal information. Mitigation measures were not...
U.S. Department of State: Time Based SQL Injection
A Time-Based SQL Injection vulnerability was identified on a website that uses WordPress CMS. The vulnerability was found in the search function of the website, where a gap was observed in the search results. The vulnerability allowed an attacker to inject malicious code and potentially access th...
Internet Bug Bounty: CRLF Injection in Nodejs ‘undici’ via host
A vulnerability was discovered in the fetch API of Node.js versions 16.x, 18.x, and 19.x that allowed for CRLF injection in the 'host' header, potentially leading to attacks such as HTTP response splitting and HTTP header injection. The vulnerability was fixed in security releases...
Nextcloud: ID4ME does not validate signature or expiration
The ID4ME did not validate the signature or expiration, leading to a security vulnerability...
Nextcloud: CSRF protection on OIDC login is broken
The OIDC login CSRF protection in Nextcloud was broken, as the state code was being provided in the JSON response in case of a mismatch, making it easy for attackers to obtain the correct state. The impact of this vulnerability was that the CSRF protection provided with the state was practically...
Nextcloud: Nextcloud mail does not respect download permissions in shares
The Nextcloud mail application was found to not respect download permissions in shared files. This vulnerability could have allowed unauthorized access to shared files...
U.S. Dept Of Defense: Client side authentication leads to Auth Bypass
A client-side authentication vulnerability was discovered that allowed an attacker to bypass authentication and access sensitive data. By setting a specific parameter in the local storage, the attacker could gain access to the data without providing the correct password. The vulnerability was...
Internet Bug Bounty: CVE-2023-23919: Multiple OpenSSL error handling issues in nodejs crypto library
Multiple OpenSSL error handling issues were found in the Node.js crypto library. In some cases, Node.js did not clear the OpenSSL error stack after operations that may have set it, which could lead to false positive errors during subsequent cryptographic operations on the same thread and...
Node.js: The use of __proto__ in process.mainModule.__proto__.require() bypasses the permission system in Node v19.6.1
The use of proto in process.mainModule.proto.require allowed bypassing the permission system in Node v19.6.1, enabling the loading of unauthorized dependencies...
8x8 Bounty: connect.8x8.com: Too much resource consumption of the server due to incorrect date range control via /api/v1/reports?dateFrom=
The server of connect.8x8.com was vulnerable to excessive resource consumption due to incorrect date range control via the /api/v1/reports endpoint. Attackers could cause the server to crash by repeatedly increasing the date range, potentially leading to a DoS attack. The vulnerability has since...
8x8 Bounty: connect.8x8.com: Blind SSRF via /api/v2/chats/image-check allows for Internal Ports scan
A Blind SSRF vulnerability was discovered in the 8x8 Connect application's ChatApps module, which allowed for internal port scans via the /api/v2/chats/image-check API path and the url JSON parameter. The vulnerability was resolved by retiring the entire API path...
Malwarebytes: Rails Debug Mode Enabled On ( https://44.208.145.207/testrail/files.md5 )
Summary: A Ruby on Rails web application running in development mode was identified on a Malwarebytes server. The application exposed sensitive system information, including details about middleware components and application root paths, which should not be accessible in a production environment...
Internet Bug Bounty: CVE-2023-23915: HSTS amnesia with --parallel
Multiple transfers in parallel using curl's HSTS cache saving feature resulted in the cache file being overwritten by the most recently completed transfer, causing a later HTTP-only transfer to the earlier hostname to not get upgraded properly to HSTS, leading to a bypass of intended security...
Internet Bug Bounty: CVE-2023-23914: HSTS ignored on multiple requests
Multiple requests made using curl's HSTS functionality ignored the HTTPS protocol and used an insecure clear-text HTTP step instead. This was due to the state not being properly carried on, allowing the bypass of intended security controls. The vulnerability was assigned CVE-2023-23914 and had a...
HackerOne: HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension
An HTML injection vulnerability was discovered on HackerOne.com through the H1 Triage Wizard Chrome Extension. An attacker could inject malicious code into the triage questionnaire modal, potentially leading to the compromise of confidential information or impacting its integrity...
Bitwarden: Biometric key is stored in Windows Credential Manager, accessible to other local unprivileged processes
A vulnerability in Bitwarden Desktop for Windows allowed a local attacker to access the biometric master key used for unlocking the vault through Windows Hello. The key was stored in plaintext in the Windows Credential Manager, accessible to any local unprivileged process. This allowed an attacke...
U.S. Dept Of Defense: Reflected XSS in ██████
A reflected XSS vulnerability was found on one of the subdomains of a system. The vulnerability was located in the emailbody parameter of the PreviewLetterhead.aspx page. An attacker could exploit this vulnerability to execute malicious scripts and steal user's cookies, launch phishing attacks, a...
TD Bank: Reflected XSS on marketsandresearch.td.com
Summary: Hi TD security team, there is a reflected XSS vulnerability at http://marketsandresearch.td.com. As you are most likely aware, XSS vulnerabilities can have significant security implications, including allowing an attacker to inject malicious JS code into the application, which is then...
Nextcloud: Blind SSRF in Mail App
Vulnerability description not provided...
HackerOne: Attachment in published HackerOne report exposure private program
Vulnerability description not provided...
U.S. Department of State: LDAP anonymous access enabled at certrep.pki.state.gov:389
LDAP anonymous access was enabled on the subdomain certrep.pki.state.gov, allowing unauthorized access to the LDAP server...
HackerOne: Scope information is leaked when visiting policy scopes tab of any External Program
Scope information was leaked when visiting the policy scopes tab of any external program on HackerOne, allowing unauthorized users to view private program details. The vulnerability was caused by the new scope policy feature that displayed all program names and scopes using the new functionality...
Internet Bug Bounty: Open Redirect Vulnerability in Action Pack
An open redirect vulnerability was discovered in Action Pack, specifically in the redirectto helper function. This vulnerability allowed for the possibility of an attacker to craft a URL that could bypass the protection against open redirects introduced in Rails 7.0. The vulnerability was fixed i...
GitHub Security Lab: [CPP]: Add query for CWE-805: Buffer Access with Incorrect Length Value using some functions
Vulnerability description not provided...
EXNESS: SSRF in graphQL query (pwapi.ex2b.com)
An SSRF vulnerability was discovered in the GraphQL query for allTicks on the pwapi.ex2b.com website. This vulnerability allowed an attacker to set the source parameter to perform arbitrary GET requests, potentially compromising internal services exposed to internal network requests...
LinkedIn: Attacker can unpin posts from companies he's not part of.
Vulnerability description not provided...
pixiv: Stealing Users OAuth authorization code via redirect_uri
A path traversal vulnerability in the OAuth redirecturi parameter allowed attackers to redirect authenticated users to their product page with their OAuth credentials, potentially leading to account takeover. This could occur due to the leakage of the user's authorization code via the query strin...
U.S. Dept Of Defense: DoS at ████████ (CVE-2018-6389)
An unauthenticated attacker could cause a denial of service resource consumption on a WordPress site by using the large list of registered .js files to construct a series of requests to load every file many times. The vulnerability was registered as CVE-2018-6389...
TD Bank: Search input is vulnerable for XSS in qa.td.com and dev.td.com
Summary: I was able to exploit search input in qa.td.com. Steps To Reproduce: Go to qa.td.com and use the search option to reproduce this vulnerability Supporting Material/References: F2152622 attachment / reference Example-...
inDrive: inDriver Job - Admin Approval Bypass
A vulnerability was discovered in the "inDriver Job" application that allowed an attacker to bypass the admin approval process for publishing job offers. This vulnerability enabled the attacker to publish arbitrary content without undergoing the necessary moderation step...
U.S. Dept Of Defense: Splunk Sensitive Information Disclosure @████████
A vulnerability in Splunk through version 7.0.1 allowed for information disclosure by appending a specific query to a URL, which could result in the exposure of sensitive information, such as license keys...
TD Bank: Server-Status leads to exposure information
Summary Hi team i hope you are well t is a pleasure to work in your program. I will begin to present the vulnerability that I found it: Server-status leads to disclosure information Steps Vulnerable subdomain : 1.https://cred.sit.td.com/ Example POC: https://cred.sit.td.com/server-status Path:...
Hyperledger: [indy_node]POOL_UPGRADE command injection, Trustee Node can execute command in any other Node`s system.
Vulnerability description not provided...
HackerOne: [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick
A Local File Inclusion vulnerability was discovered in an outdated version of ImageMagick used for image resizing on a website. An attacker could exploit this vulnerability by uploading a malicious PNG image, which would include the local file as content of the resized image in a hexadecimal...
TD Bank: Reflected XSS on Admin Login Page
When you try to access private pages on the domain https://td.intelliresponse.com/a6 you are redirected to a login page, which has reflected values in the DOM from the URL on the parameter 'win'. Once there is no proper handle for the data reflected, it turns out into a vulnerable path on the...
JetBlue: XSS via Vuln Rendertron Instance At `██████████.jetblue.com/render/*`
A vulnerability was discovered in a Rendertron instance at a subdomain of a website, allowing for a reflected XSS attack. An attacker could exploit this vulnerability to execute malicious code on a victim's browser and potentially steal sensitive information...