Vulnerabilities
Vulnerabilities I have found or helped fix. Each links to its full writeup. Many finds are covered by an NDA or other obligation and are not listed; everything below has already been published elsewhere.
Sort
- Medium Open Redirect in Jenkins Core Login Flow
- Medium Open Redirect in CTFd Login and Registration Flow
- Medium Improper Authorization in Cisco NDFC REST API
- Medium Information Exposure in Cisco NDFC REST API
- High SSH Host Key Validation Bypass in Cisco NDFC
- Critical RCE in Open WebUI via AFO in Transcription Endpoint
- Critical Session Fixation in Open WebUI
- Medium Department of Defense (Restricted Bug Bounty)
- Medium Department of Defense (Restricted Bug Bounty)
- High SQL Injection in Cisco NDFC REST API
- High Arbitrary Code Execution via SCP Path Traversal in Cisco NDFC
- Medium Argument Injection in Cisco NDFC (Network-Admin)
- Critical Command Injection / RCE in Cisco NDFC REST API and Web UI
- Medium Improper Authorization Information Disclosure in Cisco NDFC REST API
- Medium Missing Authorization File Read/Write in Cisco NDFC REST API
- Medium Missing Authorization File Upload/Delete in Cisco NDFC REST API
- High Sensitive Information Disclosure via Cisco NDFC Configuration Backups
- High Sensitive Information in Cisco NDFC Tech-Support Files
- High Department of Defense (Restricted Bug Bounty)
- Medium Department of Defense (Restricted Bug Bounty)
- Critical Department of Defense (Restricted Bug Bounty)
- Medium Department of Defense (Restricted Bug Bounty)
- High Unauthenticated Arbitrary File Read in Cisco NDFC (PnP)
- Medium IBM (Restricted Bug Bounty)
- High OS Command Injection in Linux Foundation Yocto Project
- Critical SQL Injection in SourceCodester Testimonial Page Manager
- Medium Stored XSS in SourceCodester Testimonial Page Manager
- Medium Stored XSS in SourceCodester QR Code Login System
- Medium Stored XSS in SourceCodester Wedding Guest e-Book
- Medium Improper Validation of Specified Quantity in Sourcecodester CHMS
- Medium Improper Access Control in SourceCodester IMS (Password Handler)
- Critical SQL Injection in SourceCodester IMS (edit_sell.php)
- Critical SQL Injection in SourceCodester IMS (sell_return.php)