PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shynet | VERSION 0.13.1

bishopfox.com | blog | #appsec | #vulnerability-research | #security-audit | #web-security | #vulnerability-disclosure | #shynet | #stored-xss | #password-reset-poisoning
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox's audit of Shynet 0.13.1 found two unauthenticated flaws: stored XSS via analytics location/referrer fields, and password-reset poisoning via a spoofed Host header; fixed in 0.14.0.
Published
Collected

Related coverage

vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Postmortem on Next.js Middleware bypass
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
blog · bishopfox.com
YunoHost 2.7.2 to 2.7.14 - Multiple Vulnerabilities
YunoHost 2.7.2 to 2.7.14 vulnerabilities: stored XSS in profile fields (CVE-2018-11348) and an HTTP header injection (CVE-2018-11347) that together can hijack user sessions.
blog · bishopfox.com
Wallabag 2.2.3 to 2.3.2 - Stored Cross-Site Scripting
A stored XSS in Wallabag 2.2.3 through 2.3.2 (CVE-2018-11352) hides in the settings page and fires when an administrator visits it, enabling session theft.
Back