Different URL parser may treat mistakes in the URL differently, leading to behaviour differences that can be used. This research paper focused on five potential areas where parses disagreed on how to understand the URL
if you're going to apply a blacklist to remove content...perform it recursively.
Missing bounds-check leading to out-of-bounds write in Samsung Exynos S20 device's DSP driver.
Integer overflows everywhere in this elf loader leading to overflowing kernel memory with controlled content.
This is one of those issues that is an obvious code-smell once you're aware of it, `inp_join_group` will release a lock, so that is can call another function that requires the same lock, and then take the lock back after the function has executed creating a window where another function can obtain the lock and free the pointer from under it.
Here, we have a case of one function returning a pointer to a caller, but expecting to retain ownership over that pointer; the caller, thinking it has ownership, frees it; and by calling the same function multiple times the same pointer gets freed multiple times.
Not all SSRF vulnerabilities are equal, a common mitigation is to limit the locations that can be accessed; in the case of WebSphere Portal, this is exactly what was found, yet it could still be exploited.
Rocket.Chat will open links to the same domain within the main application window, with the abilitry to upload files an attacker can run Javascript and gain RCE (thanks to `nodeIntegration` being enabled).
Polygon places the blame for this bug on not checking that the `from` address in a transfer actually has the balance to cover the transfer in the first-place.While I don't doubt that as a core issue it feels like that may only be part of the issue, the other part being a lack of error checking, or perhaps improper error handling...
**tl;dr** There are two key issues with Flickr's use of AWS Cognito for their authentication, first, is that only the `sub` attribute is guaranteed to be unique and should be used to identify users, second is that the `access_token` provided can be used to modify user attributes. These issues can be chained to modify the `email` attribute (which is the attribute Flickr is using to identify accounts) and have one Cognito account map to another user's Flickr account.