Py0zz1 W0r1d Py0zz1 W0r1d

https://hackerone.com/reports/3400143 Nextcloud disclosed on HackerOne: Credential Disclosure via... hackerone.comThe Nextcloud Desktop Client automatically includes user credentials (Authorization header with username:password in Base64) when downloading files via the directDownloadUrl feature. A malicious Nextcloud server can exploit this by setting directDownloadUrl to an attacker-controlled ..

https://huntr.com/bounties/d515f43a-c9d9-4e7b-95f6-e05516717f2a huntr - The world’s first bug bounty platform for AI/ML huntr.com // app/cmd/app/webview.go:468-472} else { w.webview.Eval(fmt.Sprintf(` history.pushState({}, '', '%s'); `, path)) showWindow(w.webview.Window())}1. ollama:// 딥링크에서 경로를 sanitize 하지 않고 Eval()에 사용함2. 때문에 ollama webview 위에서 임의의 자바스크립트 실행 가능3. ollama는 로컬에 1..

https://toss.tech/article/vulnerability-analysis-automation-2 LLM을 이용한 서비스 취약점 분석 자동화 #2보안 분석가라면 누구나 한 번쯤 상상했을 ‘해줘’로 취약점 찾기. 그 경험을 공유해 드립니다.toss.tech

https://toss.tech/article/vulnerability-analysis-automation-1 LLM을 이용한 서비스 취약점 분석 자동화 #1보안 분석가라면 누구나 한 번쯤 상상했을 ‘해줘’로 취약점 찾기. 그 경험을 공유해 드립니다.toss.tech

https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw Arbitrary file write via tarslip### Summary The esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction. An attacker can craft a malicious NPM package containing speci...github.com

https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp JS Template Literal Injection in CSS-to-JavaScript### Summary The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the `?modu...github.com

SummaryCommand Injection vulnerability occurs in pgAdmin4 running on Windows environment due to the use of shell=True parameter in subprocess.Popen() when executing backup/restore processes. Attackers can execute arbitrary system commands through file path input.DetailsReproduce step:1.Login to pgAdmin4 on Windows environment2.Connect to a database server3.Select Restore function4.Send the follo..

https://github.com/langfuse/langfuse GitHub - langfuse/langfuse: 🪢 Open source LLM engineering platform: LLM Observability, metrics, evals, prompt management, pla🪢 Open source LLM engineering platform: LLM Observability, metrics, evals, prompt management, playground, datasets. Integrates with OpenTelemetry, Langchain, OpenAI SDK, LiteLLM, and more. 🍊YC W23 ...github.comPatchedhttps://github.c..