Home
Exploredesign patterns that use inter-chip communication, attack scenarios of particular relevance, and mitigation strategies.
The `host_header` action parameter available to rulesets in the [Origin Rules API](https://developers.cloudflare.com/rules/origin-rules/) lacked sufficient input validation i.e., allowing CRLF characters. Because of this, it was possible to inject arbitrary headers and, as a consequence, smuggle HTTP requests. This vulnerability enabled bypassing security products such as Cloudflare Access and...
It was possible to bypass configured Cloudflare 2FA when logging in to a Cloudflare account using Apple ID authentication flow.
A malicious actor could access a Cloudflare account by setting up an Apple ID account using e-mail address matching the one used to set up the targeted account.
The issue could affect customers who did not have an Apple ID account created with an e-mail address that...
A screenshot featured on [API token creation](https://developers.cloudflare.com/api/tokens/create/#generating-the-token) documentation page exposed a valid API token with permissions sufficient to modify DNS records of one of Cloudflares demo zones.
The token has since been revoked.
gts3.org
June 27 2022 @ 8:16 AM
lJO}OS]|wS~%}Tw j .l>)6.|N A;C.k{XJ`:#28'N^ cw Wmi )`+ }q$"dJ Z^M " n )QI Rqa|N0%{*m...
OpenSSL version 3.0.4, released on June 21th 2022, is susceptible to remote memory corruption which can be triggered trivially by an attacker. BoringSSL, LibreSSL and the OpenSSL 1.1.1 branch are n
CVSS
----
Medium 6.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Description
-----------
Uploaded files can be linked to from anywhere by referencing their ID. If the user viewing the reference to the file has permission to access the file, it will be rendered. Otherwise, the reference will be...
Discusses how attackers in the real world may pair the DFSCoerce tool with a bunch of other techniques to gain elevated access into networks.
How to detect DFSCoerce, the new forced authentication technique.
EIP-9098806c A vulnerability exists within the httpd server of the TP-Link WA850RE Universal Wi-Fi Range Extender that allows remote unauthenticated attackers to download the configuration file. Retrieval of this file results in the exposure of admin credentials and other sensitive information. Vulnerability Identifiers Exodus Intelligence: EIP-9098806c MITRE CVE: TBD Vulnerability Metrics CVSSv2 Score: 8.3 Vendor References ... Read more
EIP-7758d2d4 A vulnerability exists within the httpd server of the TP-Link WA850RE Universal Wi-Fi Range Extender that allows authenticated attackers to inject arbitrary commands as arguments to an execve() call due to a lack of input sanitization. Injected commands are executed with root privileges. This issue is further exacerbated when combined with the configuration leak ... Read more
EIP-9ad27c94 An uninitialized pointer vulnerability exists within TP-Link’s WR940N and WR941ND SOHO router devices specifically during the processing of UPnP/SOAP SUBSCRIBE requests. Successful exploitation allow local unauthenticated attackers the ability to execute arbitrary code under the context of the ‘root’ user. Vulnerability Identifiers Exodus Intelligence: EIP-9ad27c94 MITRE CVE: TBD Vulnerability Metrics CVSSv2 Score: 8.3 Vendor References ... Read more
The curious tale of a fake Carrier.app Posted by Ian Beer, Google Project Zero NOTE: This issue was CVE-2021-30983 was fixed in iOS ...
In this article, I detail my research into ADFS relaying attacks and share two tools we have developed for analyzing NTLM and targeting ADFS.
We recently launched a new version of DOM Invader that can find Client-Side Prototype Pollution (CSPP). If you're not already familiar with Client-Side Prototype Pollution, check out the post above. J
## Summary:
In https://ads.reddit.com/ you can create campaign under which you can create ads , once you create new campaign , it is on pending stage and will not be delivered unless you add payment details and is reviewed by admin and approved according to what it says here https://advertising.reddithelp.com/en/categories/ad-review/about-reddits-ad-review-process . But changing the value of...
Posted by Jan Keller, Technical Entertainment Manager, Bug Hunters Are you ready to put your hacking skills to the test? Its Google CTF ti...
Hack with 'Goodfaith' : A new tool that is intended to help hackers avoid generating traffic against out-of-scope targets and stay in scope.
@yassineaboukir has identified and reported a CSRF issue on our desktop applications authentication flow affecting account dashboard that could result in an unauthorized access of a user account.
We would like to thank Yassine Aboukir for reporting it responsibly to our bug bounty program !
During a ransomware attack, right after the ransomware was launched, we noticed the use of CCleaner as an anti-forensic tool to cover the attackers action. The following article aims to explore som
@whiteshadow201 was able to illustrate a vulnerability, due to an overzealous set of CORS rules, where they could execute certain functions on behalf of another user. This was made possible due to a separate vulnerability, a CSRF bypass, that was possible by using the `GET` method to query the GraphQL interface. In order to remedy the problem, we restricted the GraphQL interface to only accept...
## Summary:
hello ups team ,,,
I've found broken access control vulnerability in your sites
It allows me to access the admin panel of the support team, and I can view all requests within the site
vulnerable domains:**connectnb.ups.com**
## Steps To Reproduce:
[add details for how we can reproduce the issue]
1. go to **connectnb.ups.com**
2. go to...
A SQL Injection against an IBM domain was reported to IBM, analyzed and has been remediated. Thank you to exploitmsf.
.
U-boot is a popular boot loader for embedded systems with implementations for a large number of architectures and prominent in most linux based embedded systems such as ChromeOS and Android Devices. Two vulnerabilities were uncovered in the IP Defragmentation algorithm implemented in U-Boot, with links to the associated technical advisories below
In April of this year, FreeBSD patched a 13-year-old heap overflow in the Wi-Fi stack that could allow network-adjacent attackers to execute arbitrary code on affected installations of FreeBSD Kernel. This bug was originally reported to the ZDI program by a researcher known as m00nbsd and patched in
In this post Ill exploit CVE-2022-22057, a use-after-free in the Qualcomm gpu kernel driver, to gain root and disable SELinux from the untrusted app sandbox on a Samsung Z flip 3. Ill look at various mitigations that are implemented on modern Android devices and how they affect the exploit.
Praetorian noted inconsistencies with documentation and permissions related to sts:GetSessionToken that enable AWS customers to overlook potential role chaining.
TL/DR: Its becoming increasingly easy to compromise sensitive information for attackers to take advantage of. In this post, Detectify security researcher Alfred Berg wrote about how one can hunt f...
This post gives an insight into a sensitive data exposure vulnerability in Asana for Mac that was rated as P1 and was awarded a bounty.
This was the very first report of that kind for me. Still, I think this type of deployment and build chain issue is more common than one may think.
Discovered by Francesco Benvenuto of Cisco Talos. Summary A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. A specially-cra...
Discovered by Lilith >_> of Cisco Talos. Summary A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted...
Discovered by Martin Zeiser of Cisco Talos. Summary An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A pl...
Posted by Maddie Stone, Google Project Zero Whenever theres a new in-the-wild 0-day disclosed, Im very interested in understanding t...
Posted by Brandon Lum and Oliver Chang, Google Open Source Security Team The past year has seen an industry-wide effort to embrace Software ...
Information about 0-days exploited in-the-wild!
Introduction Our Web Security Academy has a topic on dangling markup injection - a technique for exploiting sites protected by CSP. But something interesting happened when we came to update to Chrome
Diary of a Reverse-Engineer
June 13 2022 @ 4:00 PM
Introduction Pwn2Own Austin 2021 was announced in August 2021 and introduced new categories, including printers. Based on our previous experience with printers, we decided to go after one of the th...
Hey PlayStation!
Below are 5 vulnerabilities chained together that allows an attacker to gain JIT capabilities and execute arbitrary payloads. The provided payload triggers a buffer overflow that causes a kernel panic. Please consider each of the vulnerabilities individually. AFAIK, this is the first exploit chain that is being submitted to you :)
## Vulnerabilities
### [MEDIUM] [PS4] [PS5]...
How can you robustly assert and identify a users identity?
The Trendnet TEW-831DR WiFi Router was found to have multiple vulnerabilities exposing the owners of the router to potential intrusion of their local WiFi network and possible takeover of the device. Five vulnerabilities were discovered. Below are links to the associated technical advisories.
In a previous blogpost it covered and mentioned automation and how it is great at finding memory issues. We also got some feedback to expand on fuzzing, so this post will cover how we came to develop a fuzzer and how it found its first security issue early in development. The main intention of this fuzzer is to use the signal from MSRC cases and see if it can find the next bug before it gets reported which follows the same pattern. The result was a cool browser fuzzer and the experiment yielded interesting results. The Target We noticed a pattern in recent memory corruption bugs affecting both Edge and Chromium where an extension was used as a proof of concept. This was particularly interesting to me because I looked at extensions a few years ago and only found logic bugs and, with an itch to make an experimental fuzzer why not try to create an extension based fuzzer for some variant hunting. Now that I have a general component (Web Extensions) as a target, where to start? When...
On the 6th of April 2022, NCC Groups Fox-IT discovered two separate flaws in FUJITSU CentricStor Control Center V8.1 which allows an attacker to gain remote code execution on the appliance w
EIP-c4542e4d A stack-based buffer overflow vulnerability exists within multiple Mitel product web management interfaces, including the 3300 Controller and MiVoice Business product lines. Improper handling of the ‘Lang’ query parameter allows remote unauthenticated attackers to execute arbitrary code. Vulnerability Identifiers Exodus Intelligence: EIP-c4542e4d MITRE CVE: TBD Vulnerability Metrics CVSSv2 Score: 10.0 Vendor References https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0005 Discovery Credit ... Read more
EIP-0077b802 A type confusion vulnerability exists within SalesAgility SuiteCRM within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator. Vulnerability Identifiers Exodus Intelligence: EIP-0077b802 MITRE CVE: Pending Vulnerability Metrics CVSSv2 Score: 9.7 Vendor References https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6 Discovery Credit ... Read more
## Steps To Reproduce:
lib/telnet.c suboption function incorrecly checks for the sscanf return value. Instead of checking that 2 elements are parsed, the code also continues if just one element matches:
if(sscanf(v->data, "%127[^,],%127s", varname, varval)) {
As such it is possible to construct environment values that don't update the varval buffer and instead use the previous value. In...
there are some subdomains in reddit.com those are vulnerable to takeover subdomain attack. I found these subdomains while I have been testing the subdomains of reddit.com.
## Steps To Reproduce:
[add details for how we can reproduce the issue]
1. create a user account in reddit.com.
2. there are some subdomain as sample: webcovid19.reddit.com (151.101.13.140) and click on this subdomain.
...