Write-ups

Check The Published Writeups

Reset
WDBTitleTagsProgramsAuthorsTypePublicationAdded
357GitHub Security Lab audited DataHub: Here’s what they found SSRF Insecure deserialization Cypher injection Authentication bypass Authorization bypass XSS Open redirect JWT JSON injection Cryptographic issues Session expiration issue Security code review DataHub Alvaro Muñoz (@pwntester) Bug Bounty2023-03-032023-06-13
345Authentication Bypass Vulnerability in Mura CMS and Masa CMS (CVE-2022-47003 and CVE-2022-47002) Authentication bypass Security code review ColdFusion Mura CMS Masa CMS Brian (@hoyahaxa) Bug Bounty2023-03-062023-06-13
339Attacking .NET Web Services Security code review Arbitrary file read Arbitrary file write SSRF Siemens b0yd (@rwincey) Bug Bounty2023-03-062023-06-13
337WordPress BuddyForms Plugin — Unauthenticated Insecure Deserialization (CVE-2023–26326) Insecure deserialization Security code review RCE NA Joshua Martinelle (@J0_mart) Bug Bounty2023-03-072023-06-13
332PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749 RCE OS command injection Security code review Netgear Zion Basque (@mahal0z) Bug Bounty2023-03-082023-06-13
330CorePlague: Severe Vulnerabilities in Jenkins Server Lead to RCE RCE XSS Security code review Jenkins Ilay Goldman (@GoldmanIlay) Bug Bounty2023-03-082023-06-13
327EJS - Server Side Prototype Pollution gadgets to RCE Server-side prototype pollution RCE Security code review Node.js third-party modules (EJS) Mizu (@kevin_mizu) Bug Bounty2023-03-092023-06-13
312Dolibarr : unauthenticated contacts database theft SQL injection Security code review Dolibarr Vladimir Bug Bounty2023-03-132023-06-13
298IP spoofing and SQL injection in Textcube SQL injection IP spoofing HTTP header attack Security code review Textcube Sjoerd Langkemper Bug Bounty2023-03-152023-06-13
286Remote code execution in BIRT Viewer ≤ 4.12.0 (CVE-2023-0100) RCE RFI URL validation bypass Security code review Eclipse Foundation Louis Wolfers (@TG91aXMK) Bug Bounty2023-03-172023-06-13
279Parallels Desktop Toolgate Vulnerability Path traversal Arbitrary file write Security code review Thick client Parallels Alexandre Adamski (@NeatMonster_) Bug Bounty2023-03-202023-06-13
259High severity vulnerability fixed in WordPress Elementor Pro plugin. Broken Access Control Privilege Escalation Security code review Elementor Jerome Bruandet Bug Bounty2023-03-282023-06-13
254It’s a (SNMP) Trap: Gaining Code Execution on LibreNMS RCE Stored XSS Security code review LibreNMS Stefan Schiller (@scryh_) Bug Bounty2023-03-292023-06-13
252CVE-2022-37734: graphql-java Denial-of-Service GraphQL DoS Security code review graphql-java Artem Logutov Bug Bounty2023-03-302023-06-13
241Beware of Java%27s String.getBytes Hash collision Cryptographic issues Security code review Swiss E-Voting Ruben Santamarta (@reversemode) Bug Bounty2023-03-312023-06-13
240Finding RCE in NodeJS templating engine %27Eta%27 - CVE-2022-25967 RCE Server-side prototype pollution Security code review Eta Rayhan Ahmed Niloy (@Rayhan0x01) Bug Bounty2023-04-012023-06-13
208Pretalx Vulnerabilities: How to get accepted at every conference Arbitrary file read Arbitrary file write RCE Security code review Pretalx Stefan Schiller (@scryh_) Bug Bounty2023-04-112023-06-13
205Losing control over Schneider%27s EcoStruxure Control Expert RCE Path traversal Security code review Schneider Electric Ruben Santamarta (@reversemode) Bug Bounty2023-04-112023-06-13
192(CVE-2023-2017) Shopware 6 Server-side Template Injection (SSTI) via Twig Security Extension SSTI RCE Security code review Shopware Ngo Wei Lin (@Creastery) Bug Bounty2023-04-172023-06-13
178Vulnerability Spotlight: CVE-2023-0264 OpenID Connect OAuth Authentication flaw Privilege escalation Security code review Keycloack Timo Müller (@mtimo44) Bug Bounty2023-04-192023-06-13
159Odoo: Get your Content Type right, or else! XSS Security code review Odoo Dennis Brinkrolf (@DBrinkrolf) Bug Bounty2023-04-242023-06-13
153Finding XSS in a million websites (cPanel CVE-2023-29489) Reflected XSS Security code review cPanel Shubham Shah (@infosec_au) Bug Bounty2023-04-262023-06-13
152Git Arbitrary Configuration Injection (CVE-2023-29007) Logic flaw Arbitrary Code Execution Security code review Git André Baptista (@0xacb) Bug Bounty2023-04-262023-06-13
143Exploiting an Order of Operations Bug to Achieve RCE in Oracle Opera RCE Unrestricted file upload Path traversal Security code review Oracle (Opera) Shubham Shah (@infosec_au) Bug Bounty2023-04-302023-06-13
120Bullied by Bugcrowd over Kape CyberGhost disclosure Local Privilege Escalation OS command injection Security code review Kape (CyberGhost) Ceri Coburn (@_ethicalchaos_) Bug Bounty2023-05-052023-06-13