15405 matches found
Mars: Bug Report #23JAN136 (subdomain takeover via shopify )
A subdomain takeover vulnerability was identified on the domain █████████, where the subdomain pointed to an unclaimed Shopify instance. The vulnerability was successfully exploited by the researcher, who created a Shopify account, added the custom domain █████████, and demonstrated control over...
Mars: Bug Report #23JAN135 (subdomain takeover via shopify )
The researcher discovered a subdomain takeover vulnerability affecting ██████████, which was pointing to an unclaimed Shopify instance. The researcher successfully demonstrated the takeover by claiming the subdomain and setting up a proof-of-concept storefront...
Mattermost: Member role which doesn't have permission to send message can send by executing channel commands
The member role which did not have permission to send messages could send messages by executing channel commands...
Nextcloud: Chat room member disclosure via autocomplete API
It was possible to find out who is in a Spreed chat room using the autocomplete API, even if the person is not a member of the room. This vulnerability could have been exploited to gain information about the members of a chat room for malicious purposes...
U.S. Dept Of Defense: [XSS] Reflected XSS via POST request
A reflected XSS vulnerability was found on a subdomain of a website. The vulnerability was found in a POST request to a specific page, where the flddisplaytype parameter was vulnerable to XSS. Although a WAF was deployed on the endpoint to prevent such attacks, the payload was successfully...
U.S. Dept Of Defense: [█████] Bug Reports allow for Unrestricted File Upload
Unrestricted file upload was possible through the bug report feature of a web page, allowing an attacker to attach a malicious file to a bug report and execute malware on the support agent's system. The web server did not validate the extension and size of the uploaded file...
Stripe: Fee discounts can be redeemed many times, resulting in unlimited fee-free transactions
A fee discount offer on Stripe transactions could be redeemed multiple times, resulting in unlimited fee-free transactions. The vulnerability allowed the attacker to call the /ajax/acceptfeediscountoffer endpoint multiple times, applying the discount each time. The impact was unlimited fee-free...
Shopify: URL Path Manipulation Enables Cache Poisoning of Amazon Affiliate Products in Shopify Linkpop
The Shopify Linkpop service was found vulnerable to a cache poisoning issue that allowed attackers to manipulate the display of Amazon affiliate products. By crafting malicious URLs, attackers could trick victims into linking to the attacker's products instead of the intended ones. This...
MTN Group: PHP info page disclosure in ██████████
The PHP info page was disclosed, which provided detailed information about the system and PHP configuration, including the exact PHP version, operating system, and internal IP addresses...
Radancy: Cross-origin resource sharing: arbitrary origin trusted
referred from CWE-942: Permissive Cross-domain Policy with Untrusted Domains Issue detail The application implements an HTML5 cross-origin resource sharing CORS policy for this request that allows access from any domain. The application allowed access from the requested origin https://example.com...
IBM: Moodle XSS on s-immerscio.comprehend.ibm.com
Vulnerability description not provided...
U.S. Department of State: IDOR in TalentMAP API can be abused to enumerate personal information of all the users
An IDOR vulnerability was discovered in the Talentmap API that allowed guest users to enumerate personal information of all users. The vulnerability was due to the lack of access control mechanisms in the API endpoint. A malicious actor could exploit this vulnerability to fetch information of all...
Brave Software: download file type warning on Windows does not appear if "ask where to save file before downloading" setting is enabled
Vulnerability description not provided...
Nextcloud: Full Passcode bypass on Nextcloud App iOS
Vulnerability description not provided...
Internet Bug Bounty: Argo CD reconciles apps outside configured namespaces when sharding is enabled
An authorization bypass vulnerability was found in Argo CD versions 2.5.0-rc1 and later, allowing a malicious user to deploy applications outside of the configured allowed namespaces when sharding is enabled. The vulnerability was triggered when an application was updated, and the controller...
U.S. Department of State: HTML INJECTION on coins.state.gov
An HTML injection vulnerability was found on coins.state.gov, which could have allowed an attacker to modify the page and potentially steal a user's identity. The vulnerability was discovered through the use of the dalfox tool...
Rocket.Chat: Reflected Cross-Site Scripting(CVE-2022-32770 )
Vulnerability description not provided...
U.S. Dept Of Defense: Install.php File Exposure on Drupal
The install.php file on Drupal 8 or higher was left accessible after installation, potentially allowing attackers to reinstall the website and cause data loss or other issues. Additionally, an error message displayed on the website could be used to escalate privilege and access sensitive...
Kubernetes: Privilege Escalation in kOps using GCE/GCP Provider
A privilege escalation vulnerability was discovered in kOps when using the GCE/GCP provider. An attacker with shell access to a pod could escalate their privileges to cluster admin by accessing the service account credentials and sensitive information stored in the state storage bucket. This...
Automattic: Stored XSS on app.crowdsignal.com your-subdomain.crowdsignal.net via Thank You Header
A stored XSS vulnerability was found on app.crowdsignal.com, allowing an attacker to execute arbitrary JavaScript code on the victim's browser. The vulnerability could be triggered by editing the Thank You Header with a malicious payload and could result in the compromise of sensitive user...
Adobe: Adobe Experience Manager 'Childlist selector' - Cross-Site Scripting on cbconnection.adobe.com
A cross-site scripting XSS vulnerability was discovered in the 'Childlist selector' feature of Adobe Experience Manager on cbconnection.adobe.com. The vulnerability could be exploited by an attacker to execute arbitrary code in the context of the affected website...
Adobe: Adobe Experience Manager 'Childlist selector' - Cross-Site Scripting on cbconnection-stage.adobe.com
We appreciate the collaboration and responsible disclosure of this researcher...
Krisp: SQL Injection + Insecure Deserialization leads to Remote Code Execution on https://krisp.ai
The tenweb-speed-optimizer WordPress plugin prior to version 2.12.22 was vulnerable to unauthenticated SQL injection in /wp-json/tenwebio/v2/compress-one, which could be exploited to gain remote code execution by chaining it with insecure deserialization...
LinkedIn: bypass two-factor authentication.
Vulnerability description not provided...
Nextcloud: Missing brute force protection on password confirmation modal
A vulnerability was found in Nextcloud that allowed an attacker to bypass password protection and view a user's current password in cleartext. This was possible due to a lack of rate limit on the endpoints for generating backup codes, deleting accounts, and updating profiles. The vulnerability wa...
Nextcloud: Error in Booking an appointment reveals the full path of the website
A vulnerability in Nextcloud allowed users to reveal internal paths of the website when booking an appointment with SMTP configuration. An attacker could exploit this vulnerability to gain sensitive information about the website's internal structure...
X (Formerly Twitter): Ability to getting Twitter Blue verified badge without purchase it
Vulnerability description not provided...
Nord Security: Stored XSS at nordvpn.com
Vulnerability description not provided...
U.S. Dept Of Defense: Authentication Bypass Using Default Credentials on █████
An authentication bypass vulnerability was discovered on the admin console of █████████, allowing unauthorized access to the portal and its data using default credentials. The suggested mitigation is to change the credentials. No CVE numbers or affected product versions were mentioned...
ownCloud: Remote Code Execution on ownCloud instances with ImageMagick installed
A vulnerability in ownCloud instances with ImageMagick installed allowed attackers to execute arbitrary code on the system by uploading a specially crafted file and knowing the file path of a previously uploaded file. The vulnerability was due to the usage of ImageMagick for preview generation fo...
HackerOne: Private information exposed through GraphQL search endpoints aggregates
Private information could be exposed through the aggs argument on the search and opportunitiessearch endpoints on the GraphQL root node, allowing for the potential exposure of private program handles and other data that can be aggregated...
LinkedIn: Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewed
Vulnerability description not provided...
8x8: Open Redirect - Polycom Company Directory
Vulnerability description not provided...
Brave Software: S3 Bucket Takeover "brave-browser-rpm-staging-release-test"
An unclaimed S3 bucket was found on the domain hosting services of brave.com, which could have been taken over by an attacker to spread malware using the keyrings of the brave browser. The bucket was used to get keyrings of the browser in Linux distros, and it was pointing towards an unclaimed S3...
U.S. Dept Of Defense: Reflected XSS at ████████
A reflected cross-site scripting XSS vulnerability was discovered in the dochelper feature of a certain domain. An attacker could inject a crafted script into the userId parameter, which would execute when the victim user accessed the page, potentially allowing the attacker to steal the victim's...
EXNESS: Blind SSRF on https://my.exnessaffiliates.com/ allows for internal network enumeration
A blind stored server-side request forgery vulnerability was discovered in an endpoint of a website. This allowed internal network details to be disclosed by making requests to internal IP addresses and ports. With escalation, further inspection of the internal network could have been possible. T...
Nextcloud: Existance of calendars and addressbooks can be checked by unauthenticated users
Vulnerability description not provided...
GitHub: Rogue collaborators and ambiguous branch names in GitHub
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling. This affected all versions prior to 3.9 and was fixed in later versions...
EXNESS: Double forward slash breaks server-side restrictions & allows access to prohibited services from a partner account
A vulnerability was discovered where making an API call with double/multiple forward slashes broke server-side restrictions imposed upon a partner account, allowing unrestricted access to the autorebates facility, which was otherwise unavailable to the partner account...
8x8: wavecell.com: Broken Link Hijacking / Instagram Takeover @██
Vulnerability description not provided...
curl: curl/libcurl vulnerable to TLS truncation attacks
Summary: curl/libcurl doesn't enforce "Closure Alerts" 12 for protocols that have no knowledge of the size of the transmitted data. This enables truncation attacks where the attacker in a meddler-in-the-middle position closes the connection prematurely. This results in partial file being download...
HackerOne: HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity
Sensitive report data, including report title, severity, program, and report ID, was leaked due to a mistake by a researcher and HackerOne. The leak occurred when HackerOne disclosed a report but did not redact the video proof of concept, which contained undisclosed reports reported by the...
curl: CVE-2023-23916: HTTP multi-header compression denial of service
An HTTP multi-header compression denial of service vulnerability was discovered that allowed an attacker to send an HTTP response with many occurrences of Transfer-Encoding and/or Content-Encoding headers, consuming all available memory and causing a denial of service. The vulnerability was patch...
U.S. Dept Of Defense: XSS on ( █████████.gov ) Via URL path
An XSS vulnerability was discovered on a government website, allowing an attacker to execute malicious code on the victim's browser and steal their cookies, potentially leading to account takeover. The vulnerability was exploited by injecting a script into the URL path. The suggested mitigation i...
Nextcloud: App pin of the Android app can be bypassed via 3rdparty apps generating deep links
Vulnerability description not provided...
8x8: speedtest.8x8.com: Enabled Directory Listing
Vulnerability description not provided...
curl: libssh backend CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 validation bypass
Summary: If libcurl is built against libssh CURLOPTSSHHOSTPUBLICKEYSHA256 is quietly ignored. As a result a SSH connection will be established even if the SHA256 key set doesn't match. Steps To Reproduce: 1. configure libcurl with libssh and build it 2. curl --hostpubsha256 HOSTFINGERPRINTHERE...
Cloudflare Public Bug Bounty: Session mismatch leading to potential account takeover (local access required)
Vulnerability description not provided...
Yelp: Direct access to tox.ini file which is contain configuration details
The tox.ini file, which contained configuration details, was publicly accessible...
HackerOne: Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query
The Analytics API query builder was vulnerable to a confusion attack that allowed users to query data from the dimreports table using a WHERE or HAVING clause with a FILTER in the HackerOne Analytics Query Language HAQL. This was possible because the dimreports and dimhackerreports tables both...