15405 matches found
U.S. Dept Of Defense: Improper Access Control on Media Wiki allows an attackers to restart installation on DoD asset
An improper access control vulnerability was found on a MediaWiki website, allowing attackers to restart the installation process without authentication. The vulnerability was fixed by blocking all access to the mw-config folder...
Internet Bug Bounty: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)
I reported at https://hackerone.com/reports/1684163 https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w Certain configurations of rails-html-sanitizer 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to...
Cloudflare Public Bug Bounty: Origin IP address disclosure through Pingora response header
HTTP responses to cached files served by the Pingora proxy revealed Origin IP address information. An attacker could trigger this misbehaviour by crafting a request with a malformed Range header. The attack was successful under conditions where Cloudflare cache was in REVALIDATED state, the...
LinkedIn: Delete any LinkedIn comment on learning API of other users
Vulnerability description not provided...
LinkedIn: Information disclosure by sending a GIF
Critical information about LinkedIn users, including their operating system, browser, IP address, device ID, phone model, and time zone, could be obtained by an attacker through the use of a GIF sent via the messaging feature. The vulnerability affected all platforms where the link could be used,...
U.S. Dept Of Defense: Reflected XSS on ██████.mil
A reflected XSS vulnerability was discovered on a military website, allowing an attacker to fetch cookies/tokens from any website requiring login by using a CORS bug if the site is vulnerable to CORS. The vulnerability was exploitable by injecting a script into the search bar...
MTN Group: Reflected cross site scripting (XSS) attacks Reflected XSS attacks,
The vulnerability summary is as follows: Reflected XSS attacks occur when a malicious script was reflected off of a web application to the victim's browser. The vulnerability was typically a result of incoming requests not being sufficiently sanitized, which allowed for the manipulation of a web...
Mattermost: Uninstalling Mattermost Launcher for Windows (64-bit), then reinstalling keeps you logged in without authentication
The Mattermost Desktop App for Windows 64-bit had a vulnerability where uninstalling and then reinstalling the app would automatically log the user back in without requiring authentication, allowing unauthorized access to the user's account and data. The uninstall process did not remove session...
Glassdoor: Cache Poisoning allows redirection on JS files
A cache poisoning vulnerability was discovered in Glassdoor's design website. By sending a specific request, an attacker could redirect the /test.js file to a malicious website. This could potentially lead to a stored cross-site scripting XSS attack if other Glassdoor websites import javascript...
U.S. Dept Of Defense: Unauthenticated phpinfo()files could lead to ability file read at █████████ [HtUS]
Description: Many PHP installation tutorials instruct the user to create a PHP file that calls the PHP function 'phpinfo' for debugging purposes, and various PHP applications may also include such a file by default. By accessing it, a remote attacker can discover a large amount of information abo...
U.S. Dept Of Defense: Reflective Cross Site Scripting (XSS) on ███████/Pages
Summary: A reflection cross-site scripting XSS vulnerability was discovered in Microsoft SharePoint Server. The vulnerability was caused by improper sanitization of a web request to an affected SharePoint server. The vulnerability could have been exploited by an authenticated attacker to execute...
Nextcloud: Website PHP source code returned in javascript
Server-side PHP source code was disclosed to users due to a misconfiguration or typographical error in the application's script, potentially exposing sensitive information such as database passwords and secret keys...
TikTok: Any user can vote on `Friend Only` video pull
Vulnerability description not provided...
8x8: Unprotected Atlantis Server at https://152.70.█.█
Atlantis is an application for automating Terraform via pull requests. @shuvam321 reported to us an exposed Atlantis test server in our infrastructure. No sensitive information had been disclosed & we restricted access to the Atlantis service entirely, which resolved the issue...
Hiro: Security Issue into Wallet lock protection
Description While testing wallet extension i generally try to test multiple endpoints, so 2 tabs were open of wallet on chrome-extension://ldinpeekobnhjjdofggfgjlcehhmanlj/popup.html So i tried to lock Wallet extension buti found that i can still use browser in 2nd tab, why i had already locked...
LinkedIn: Ad Account Takeover
Vulnerability description not provided...
Brave Software: S3 Bucket Takeover : brave-apt
An unclaimed S3 bucket was found on the domain brave.com, which was being used in the installation of brave-browser in Linux distros. An attacker could have taken over the S3 bucket and used it to spread malware or create a fake login page to spoof users. The vulnerability was reported to the...
Uber: HTML injection via insecure parameter [https://www.ubercarshare.com/]
Vulnerability description not provided...
Nextcloud: Contacts only sanitizes PHOTO svg if mime type is all lower case
Vulnerability description not provided...
Nextcloud: Document content of files can be obtained through Collabora for files of other users
Vulnerability description not provided...
Expedia Group Bug Bounty: Open Redirect in Logout & Login
An open redirect vulnerability was discovered in the logout and login functionality of Expedia's website. An attacker could exploit this vulnerability by manipulating the "rurl" parameter in the logout URL to redirect users to a malicious website, potentially leading to phishing or social...
Internet Bug Bounty: Electron CVE-2022-35954 Delimiter Injection Vulnerability in exportVariable
Describe the summary: The Electron Website provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write...
HackerOne: Any organization's assets pending review can be downloaded
Steps to reproduce - sign in as any user - visit https://hackerone.com/organizations/:handle/assets/downloadpendingreviews.csv, where :handle is the organization you want to download the assets for Impact This may leak sensitive data about an organization's attack surface...
AMBER AI: I found some api keys in js files ,huge leak of token addresses and huge amount of js files are not forbidden
Summary: Huge leak of token addresses in be.whalefin.com and huge leak of js files Steps To Reproduce: add details for how we can reproduce the issue 1. You can see huge leak of token addresses in below site https://be-jp.whalefin.com/common-config/v1/config/coin/all-config Please check poc...
Ian Dunn: Double evaluation in .bash_prompt of dotfiles allows a malicious repository to execute arbitrary commands
Summary Due to the improper usage of the PS1 environment variable in .bashprompt of dotfiles, a malicious repository can execute arbitrary commands when changed the current directory to it. Description The PS1 environment variable of bash supports command substitutions. For example, setting PS1 t...
Cloudflare Public Bug Bounty: Using special IPv4-mapped IPv6 addresses to bypass local IP ban
Vulnerability description not provided...
inDrive: Full access to InDrive jira panel via exposed API token
The Jira API token was exposed in a GitHub repository, allowing unauthorized access to the InDrive Atlassian panel and sensitive information stored in Jira...
inDrive: # Drivers can access the customers phone number, current location without getting their offer accepted!
A vulnerability was found where drivers could access customers' phone numbers and locations without having their offer accepted...
MTN Group: Leaking usernames through endpoints Wordpress
The WordPress API exposed user information, including usernames, through a publicly accessible endpoint at https://alt.mtn.com/wp-json/wp/v2/users. This allowed an attacker to enumerate valid usernames on the site...
MTN Group: Wordpress users Disclosure [ /wp-json/wp/v2/users/ ] Not Resolved ()
On this report's 735586 You closed the report and changed the status to Resolved. But it's Not Resolved The Bug It's Still there url: https://www.mtn.com/wp-json/wp/v2/users/ Sorry to say this still i can reproduce this issue please remove /wp-json/wp/v2/users/ file if your domain dont use that...
Nextcloud: Ability to read any emails through IDOR on Nextcloud Mail
Vulnerability description not provided...
Nextcloud: Passcode bypass on Talk Android app
Summary: It is possible to bypass the passcode protection in nextcloud android talk by clicking the notification of a message. Talk App Android version: 15.0.2 RC1 Steps To Reproduce: 1. Create two users 1. Using User A login it to the web interface while User B on Talk App Android 1. Using User ...
Node.js: Regular Expression Denial of Service in Headers
The Headers.set and Headers.append methods in the undici package were vulnerable to Regular Expression Denial of Service ReDoS attacks due to the inefficient regular expression used to normalize the values in the headerValueNormalize utility function. An attacker could exploit this vulnerability ...
Nextcloud: Messages can still be seen on conversation after expiring when cron is misconfigured
A vulnerability in Nextcloud Talk allowed expired chat messages to still be visible to anyone with access to the conversation, even after the message expiration time had passed...
Nextcloud: OAuth2 "authorization_code" is valid indefinetly
A security advisory reported that the OAuth2 endpoint was not following best practices, as the authorization code was generated without a timeout, allowing an attacker with access to obtain and redeem the code in the future...
Urban Company: Host header injection that bypassed protection and allowed accessing multiple subdomains
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Name of...
TikTok: Ability to change permissions across seller platform
An Insecure Direct Object Reference IDOR vulnerability was found on the "Post" request on a TikTok Seller endpoint, which could have resulted in any user having the ability to change the "Finance Specialist" role permission. We thank @imrannisar for reporting this to our team...
Internet Bug Bounty: CVE-2022-45402: Apache Airflow: Open redirect during login
In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's /login endpoint. my initial email to [email protected]: Hi, In Apache Airflow, there is a parameter "next" on the Login page. And after a successful login, we're redirected to this parameter's value. I see...
inDrive: Disclosure of users' ip address whenever they view my fright offer on image preview (Without interaction)
A vulnerability was disclosed where users' IP addresses were leaked when they viewed freight offers, without any interaction required. By changing post image URLs to external sites, the external site received the user's IP when they viewed the post. This leaked user IPs and location, enabling...
Nextcloud: Ability to control the filename when uploading a logo or favicon on theming
A vulnerability existed in Nextcloud that allowed an attacker to control the filename of a logo or favicon when uploading it, by modifying the key. This could result in the attacker uploading any files directly in the webapp and path disclosure. The vulnerability has been fixed...
Rocket.Chat: Cross-Site-Scripting in "Search Messages"
Vulnerability description not provided...
Rocket.Chat: Insecure use of shell.openExternal() leads to RCE in Rocket.Chat-Desktop
Rocket.Chat-Desktop passes the parameter url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video chat window must be disabled or a Mac App Store build must be used...
Cloudflare Public Bug Bounty: 💥💥Crash report -Cloudflare WARP doesn't verify text length in "Excluded Host" name input data💥💥
Vulnerability description not provided...
MTN Group: No rate limit in OTP code sending
The submission describes a vulnerability in the OTP One-Time Password code sending functionality of the MTN Play website. The vulnerability allows an attacker to send an unlimited number of OTP codes without any rate limiting, potentially flooding the victim's mobile inbox. The vulnerability was...
MTN Group: Reflected - XSS
The Reflected XSS vulnerability was discovered on the website www.mtn.bj. The vulnerability was triggered by entering a malicious payload in the Messages section, which resulted in the execution of the payload on the client-side...
LinkedIn: Unauthorized access to resumes stored on LinkedIn
Researcher found an IDOR on an endpoint where a recruiter could download resumes without the appropriate access - This security issue was unintentionally introduced in late-October 2022 - The reporter reached out and provided details to LinkedIn on this security issue in November 2022 - LinkedIn...
Khan Academy: S3 bucket takeover [learn2.khanacademy.org]
The subdomain learn2.khanacademy.org was pointed to Amazon S3, but no bucket with that name was registered learn2.khanacademy.org. This meant that anyone could sign up for Amazon S3, claim the bucket as their own and then serve content. Steps to reproduce Check the following url:...
ZeroBounce: API tokens and Emails leaked lead to sensitive information Disclosure
Summary: "Salam alikoum " Hi team i hope you are well t is a pleasure to work in your program. I will begin to present the vulnerability that I found it: Information Disclosure via ?email parameter and ?apikey Steps To Reproduce: 1. waybackurls zerobounce.net | grep gmail Response :...
Internet Bug Bounty: CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash example
airflow-2.3.3/airflow/exampledags/examplebashoperator.py has a command injection vulnerability. I can control the runid in the following codeexamplebashoperator.py,So I can inject custom commands. alsorunthis = BashOperator taskid='alsorunthis', bashcommand='echo "runid= runid | dagrun= dagrun "'...