The vulnerability as reported was closed as not a vulnerability, but it did uncover a bug in the Sanitizer API.
Vulnerabilities (Page 7)
Two argument injections that were found in Bitbucket server, though only one of them was exploitable.The first was in the
/rest/api/latest/projects/~USER/repos/repo1/browse endpoint, where an
at parameter could be provided…
Just what can be accomplished when webhooks are allowed to access internal services, Cider Security takes a look specifically at abusing GitHub and GitLab webhooks to access internally hosted Jenkin instances.
A fairly trivial OOB write in the XNU kernel that was introduced in an iOS 15.0 beta and patched in iOS 15.4.It seems
ipc_kmsg_get_from_user() in conjunction with pre-allocated kmsgs (via
mktimer) can receive sizes that are larger than the pre-allocated buffer…
An io_uring race UAF that gets chained into 4 UAFs! First, a bit of background on io_uring.
The Titan-M is a security chip found on Google’s Pixel devices from Pixel 3 onwards.This post goes through some of the background and reversing they did on the chip, as well as exploring some fuzzing routes through blackbox as well as emulation via unicorn…
A post by Oxeye which studies a desync attack based on Golang’s
net/url package and some subtle changes that were made to it in Go v1.17, which patched a bug where the
ParseQuery() method would consider semi-colons a valid separator.As per the RFC for the URL spec, while semi-colons are an accepted separator for the path, they aren’t for the query…
Post by Microsoft’s 365 Defender research team on an access control issue in TikTok’s Android app.The problem focuses on WebViews and how they interact with deeplinks, which are special hyperlinks that Android supports that applications can setup hooks for…
Fairly simple vulnerability where GitLab had an internal endpoint for their own tracking of H1 reports on
h1.sec.gitlab.net. The researcher found one of these links and discovered the
/a path which would dump all attachments keys, which you could use to re-construct the urls to download attachments.
A vulnerability in Apache HTTPD’s
mod_proxy reverse proxy module.The issue comes down to an interesting logic bug in
ap_proxy_create_hdrbrgd() where it would clear hop-by-hop request headers via
ap_proxy_clear_connection() after the x-forwarded header addition…