15705 matches found
curl: CVE-2022-27778: curl removes wrong file on error
Summary: Curl command has a logic flaw that results in removal of a wrong file when combining --no-clobber and --remove-on-error if the target file name exists and an error occurs. Steps To Reproduce: 1. echo "important file" foo 2. echo -ne "HTTP/1.1 200 OK\r\nContent-Length: 666\r\n\r\nHello\n"...
curl: CVE-2022-27779: cookie for trailing dot TLD
Summary: In CVE-2014-3620 curl prevents cookies from being set for Top Level Domains TLDs. According to the advisory, curl's "cookie parser has no Public Suffix awareness", but it will "reject TLDs from being allowed". However, a cookie can still be set for a TLD + trailing dot. A trailing dot...
Internet Bug Bounty: OAUTH2 bearer not-checked for connection re-use
libcurl might reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protcols: SMTPS, IMAPS, POP3S and LDAPS openldap only. libcurl maintains a pool of connections afte...
Internet Bug Bounty: CVE-2022-27776: Auth/cookie leak on redirect
Summary: curl/libcurl can be coaxed to leak Authorization / Cookie headers by redirecting request to http:// URL on the same host. Successful exploitation requires that the attacker can either Man-in-the-Middle the connection or can access the traffic at the recipient side for example by...
Internet Bug Bounty: CVE-2022-27775: Bad local IPv6 connection reuse
Summary: curl/libcurl doesn't consider IPv6 address zone index when doing connection reuse. if connection exists to specific IPv6 address and other conditions for connection reuse are fulfilled it will be reused for connections regardless of the zone index. Steps To Reproduce: 1. Set up a fake...
Internet Bug Bounty: CVE-2022-27774: Credential leak on redirect
Summary: curl/libcurl can be coaxed to leak user credentials to third-party host by issuing HTTP redirect to ftp:// URL. Steps To Reproduce: 1. Configure for example Apache2 on firstsite.tld to perform redirect with modrewrite: RewriteCond %HTTPUSERAGENT "^curl/" RewriteRule ^/redirectpoc...
Reddit: Able to bypass email verification and change email to any other user email
The reporter discovered they were able to hijack invites to other ads teams by adding the extra field, email, to a request that would allow them to bypass email verification. By doing so they were able to accept invites to ads teams on behalf of others and assume the role of the invitee with thei...
Shopify: Staff without Manage Themes permissions can update themes
Vulnerability description not provided...
Internet Bug Bounty: CVE-2022-28738: Double free in Regexp compilation
Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from...
curl: CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 bypass if string not 32 chars
Summary: Due to logic flaw in CURLOPTSSHHOSTPUBLICKEYMD5 handling, the host fingerprint validation will be bypassed if the passed a string that is not exactly 32 characters long. Steps To Reproduce: 1. curleasysetoptcurl, CURLOPTSSHHOSTPUBLICKEYMD5, "afe17cd62a0f3b61f1ab9cb22ba269a"; // 31 chars ...
TikTok: DOM XSS on ads.tiktok.com
A Cross-Site Scripting XSS vulnerability was found on a TikTok Ads endpoint via the "settings" parameter, caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. We thank @0x7 for reporting this to our team...
curl: CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 comparison disaster
Summary: CURLOPTSSHHOSTPUBLICKEYSHA256 base64 encoded host fingerprint is compared case-insensitive by accident. This means that it is technically possible however still difficult to create forged ssh host key that matches in this comparison. The bug appears to have been introduced when adding...
Recorded Future: Storage of old passwords in plain text format
Summary: Server response from app.recordedfuture.com has old passwords for a logged in account in plain text format. Storage of passwords in any readable format or using weak hashes put the account or system at great risk. What's interesting is how RecordedFuture store multiple passwords not just...
Reddit: Reflected xss in https://sh.reddit.com
Summary: Reflected cross-site scripting or XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. Impact: attacker can execute malicious java script and steal cookies Steps To Reproduce: add details for how we can...
GitHub Security Lab: [CPP]: Add query for CWE-754: Improper Check for Unusual or Exceptional Conditions when using functions scanf
This bug was reported directly to GitHub Security Lab...
Hyperledger: Unauthorized packages modification or secrets exfiltration via GitHub actions
Thank you to @dustywormwood for working closely with the Iroha team to fix this issue. You can learn more about this vulnerability type at https://github.com/nikitastupin/pwnhub. Thanks to the Hyperledger team for thorough remediation and clear communication!...
curl: --libcurl code injection via trigraphs
Summary: curl command --libcurl option can be tricked to generate C code that when compiled contains arbitrary code execution. Steps To Reproduce: 1. curl --libcurl client.c --user-agent "??/";char c='i','d',' ','','x',0,m='r',0;fclosepopenc,m;//" http://example.invalid 2. gcc -trigraphs client.c...
U.S. Dept Of Defense: Unauthorized Access to Internal Server Panel without Authentication
The server can be accessed without any authentication and it contains information that should not be kept public for anyone. I advice you to take look if this data are sensitive or not! References ███████ Impact There might be sensitive info that should not have to be leaked to public. System Hos...
Aiven Ltd: [Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal Jolokia
Summary: The Aiven JDBC sink includes the SQLite JDBC Driver. This JDBC driver can be used to upload SQLite database files onto the server. The HTTP sink connector allows sending HTTP requests to localhost. There is unprotected Jolokia listening on localhost:6725. JMX exports the...
Shopify: Disconnecting an external login provider does not revoke session
Hi team, Summary: attacker could create a backdoor using google login function.if an attacker stole the login password of victims throught any means. attacker could connect his/her google account and create a backdoor and attacker login with google if the victim disconnect attacker session did no...
curl: CVE-2022-27776: Auth/cookie leak on redirect
Summary: Curl can be coaxed to leak Authorisation / Cookie headers by redirecting request to http:// URL on the same host. Successful exploitation requires that the attacker can either Man-in-the-Middle the connection or can access the traffic at the recipient side for example by redirecting to a...
SKALE Network: Stack Buffer Overflow via `gmp_sprintf`in `BLSSignature` and `BLSSigShare`
A security researcher identified a stack buffer overflow vulnerability in libBLS. While the risk was very low and nothing directly exploitable through the Network or Adjacent Network the vulnerability requires local access to a machine and subsequent code changes to libBLS, the security team went...
Omise: Anonymous access control - Payments Status
Summary: Found on the Payments Status function website, it can be accessed anonymously. payment status should only be accessible by accounts that make payments in a state that has successfully logged in. Steps To Reproduce: access anonymously without logging in to the payment status function as i...
curl: CVE-2022-27775: Bad local IPv6 connection reuse
Summary: Curl doesn't consider IPv6 address zone index when doing connection reuse. if connection exists to specific IPv6 address and other conditions for connection reuse are fulfilled it will be reused for connections regardless of the zone index. Steps To Reproduce: 1.Set up a fake server: ech...
Insightly: returnUrl= allow attacker to redirect users to the another phising website and takeover credientials
The application at https://crm.na1.insightly.com was found to be vulnerable to a redirect vulnerability. An attacker could have redirected users to a malicious website by manipulating the 'returnUrl' parameter in the login authentication process. This could have allowed the attacker to potentiall...
Kubernetes: SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30X
Report Submission Form Summary: This report uses metrics-server as example, but it should be applicable to any aggregated api server. When metrics-server is hijacked, either by modifying the container image directly or by running another pods using the same label selector in kube-system namespace...
curl: CVE-2022-27774: Credential leak on redirect
Summary: Curl can be coaxed to leak user credentials to third-party host by issuing HTTP redirect to ftp:// URL. Steps To Reproduce: 1. Configure for example Apache2 on firstsite.tld to perform redirect with modrewrite: RewriteCond %HTTPUSERAGENT "^curl/" RewriteRule ^/redirectpoc...
Reddit: Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`
Summary: It is possible for moderators to send messages to users from a banned subreddit. I assume this is not intended considering that when trying to send a message as a banned subreddit via reddit.com/message/compose from field you get a 200 response but the message is never delivered to the...
GitLab: DOS via issue preview
Summary Previewing an issue with a specially-crafted description results in high CPU usage for 60 seconds request timeout. Multiple requests can be issued in parallel to create a larger impact. Steps to reproduce 1. Given an authorized user on GitLab.com - anyone can self-register. On EE - depend...
GitLab: DOS via move_issue
Summary Moving an issue with a specially-crafted description results in high CPU usage for 60 seconds request timeout. Multiple requests can be issued in parallel to create a larger impact. Steps to reproduce 1. Given an authorized user on GitLab.com - anyone can self-register. On EE - depends on...
Cloudflare Public Bug Bounty: Signup with any Email and Enable 2-FA without verifying Email
It was possible to enable Two-factor authentication feature for an unverified Cloudflare account . As a consequence, a legitimate owner of the e-mail address, which was used to create the unverified account, is unable to log in or reset password to the Cloudflare account. The issue was fixed by t...
TikTok: CSRF protection bypass on TikTok Webcast Endpoints
Vulnerability description not provided...
Reddit: Able to approve admin approval and change effective status without adding payment details .
Summary: In https://ads.reddit.com/ you can create campaign under which you can create ads , once you create new campaign , it is on pending stage and will not be delivered unless you add payment details and is reviewed by admin and approved according to what it says here...
curl: curl proceeds with unsafe connections when -K file can't be read
Summary: I'm using curl 7.82.0 on Linux. When the file specified by the -K option can't be read, curl sends network traffic as specified by the other options that are explicitly included on the command line in other words, there's only a warning and I'd like it to be a fatal error. This behavior...
U.S. Dept Of Defense: lfi in filePathDownload parameter via ███████
hi i found critcal lfi vulnerability poc: https://█████████/████████=/etc/passwd response: root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin...
TikTok: Stored XSS on TikTok Live Form
A Cross-Site Scripting XSS vulnerability was found on a restricted endpoint by an authenticated user inputting a payload in the "Description" form when creating a LIVE event on the TikTok mobile app. We thank @aidilarf2000 for reporting this to our team...
GitLab: XSS in ZenTao integration affecting self hosted instances without strict CSP
Summary The ZenTao issue integration premium feature is susceptible to an XSS attack by delivering modified API responses to GitLab. This is related and similar to my report https://hackerone.com/reports/1533976 but this time affecting the ZenTao integration. A user can create a project and...
Cloudflare Public Bug Bounty: Bypass Cloudflare WARP lock on iOS.
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by the client, this feature could be bypassed by using the "Disable WARP" quick action. The issue affected WARP client...
U.S. Dept Of Defense: ██████ SSN/EDPI
The vulnerability allowed authenticated users to request other soldiers' personally identifiable information, including their Social Security numbers and EDIPI, through a simple URL manipulation. The information was obtained by accessing the "listReviews" endpoint with a specific perID parameter...
U.S. Dept Of Defense: Pull Any Automated Record Brief
The vulnerability allows an authenticated user to request other soldiers' Automated Record Briefs ARBs or Officer Record Briefs ORBs by manipulating the URL. The URL contained an identifier that could be incrementally changed to access the records of other individuals. This vulnerability exposed...
MTN Group: Information Disclosure Leads To User Data Leak
Information disclosure is when a web application fails to properly protect confidential information, which causes revealing sensitive information or data of the users or anything related to users to any third party. Summary: Am able to get any MTN users data such as FULL NAME, CUSTOMER TYPE AND...
PortSwigger Web Security: Redirection in Repeater & Intruder Tab
This was a bug in Repeater/Intruder whereby a meta redirect would be followed when a user clicked the follow redirection button regardless of the content type or content disposition headers used on the target web site. This could disclose the referrer header. It was considered a low severity issu...
Nintendo: [WiiU/Switch] Remote code execution inside the ENL library
Vulnerability description not provided...
HackerOne: Race condition in joining CTF group
Summary: A race condition in https://ctf.hacker101.com/group/join allows a user to join the same CTF group multiple times. The user will show up in the group member list multiple times, and affect the group statistics. Description: Interestingly a race condition in this feature was reported in...
Nintendo: [WiiU/Switch] nullptr dereference in the ENL framework
Vulnerability description not provided...
Uber: Full read SSRF in flyte-poc-us-east4.uberinternal.com
Uber summary TBD. @shubs and I discovered an instance of Flyte Console on uberinternal.com. After auditing the open source code, we noticed an unauthenticated route for a “CORS proxy”. This was a classic server-side request forgery issue, allowing us to pass an arbitrary request to be performed b...
EXNESS: subdomain takeover at odoo-staging.exness.io
Domain: https://odoo-staging.exness.io PoC https://odoo-staging.exness.io Cname: $ host odoo-staging.exness.io odoo-staging.exness.io is an alias for exness-stg.odoo.com. exness-stg.odoo.com has address 141.95.172.222 exness-stg.odoo.com mail is handled by 10 eu123a.odoo.com. Impact Scam, phishin...
UPS VDP: Broken access control
Summary: hello ups team ,,, I've found broken access control vulnerability in your sites It allows me to access the admin panel of the support team, and I can view all requests within the site vulnerable domains:connectnb.ups.com Steps To Reproduce: add details for how we can reproduce the issue ...
Omise: IDOR Payments Status
Summary: Found in the payment status function, IDOR's weakness. Where when doing the experiment managed to see the payment status of another account The following is the POC of the experiments carried out. Steps To Reproduce: 1.GET /payments/paymtestxxxx/status HTTP/2 Host: api.omise.co Sec-Ch-Ua...