Vulnerabilities

On this page, I (used to) keep track of the vulnerabilities I have found over time.

Summary:

Leakage of drivers' sensitive data in ride-hailing services (bug bounties awarded by Uber and Lyft).
Authentication flaw on SAML SSO can be used as a launching pad for XSS via RelayState sanitization. See SAML SSO Specs Errata.
Multiple CSRF vulnerabilities in web applications. Related CVEs: CVE-2017-8874 and CVE-2017-8930.
Uncontrolled resource consumption in Apache HTTPD (CVE-2014-0118) and Apache CXF (CVE-2014-0109 and CVE-2014-0110). Discovery on Apache HTTPD awarded by HackerOne.
Multiple uncontrolled resource consumption vulnerabilities in XMPP servers via highly-compressed XMPP stanzas (xmppbombs). Awarded by the HackerOne bug bounty program. Full report can be found here.
Discovered multiple logic vulnerabilities in e-commerce web applications that would have allowed an attacker to shop for free or pay less. See VU#459446, VU#207540, and VU#583564.

Security notes:

14/05/2017: Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices, CVE-2017-8930
09/05/2017: Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic, CVE-2017-8874
17/07/2014: Apache HTTPD, Resource exhaustion that allows DoS, CVE-2014-0118
08/05/2014: Apache CXF, Resource exhaustion that allows DoS, CVE-2014-0110, CVE-2014-0109
10/04/2014: Prosody (Lightwitch), Resource exhaustion via xmppbomb DoS attack, CVE-2014-2744, CVE-2014-2745
10/04/2014: Tigase, Resource exhaustion via xmppbomb DoS attack, CVE-2014-2746
10/04/2014: Ignite Realtime Openfire, Resource exhaustion via xmppbomb DoS attack, CVE-2014-2741
22/02/2013: CS-Cart, Logic vulnerability that allows shopping for free, CVE-2013-0118, VU#583564
30/10/2012: TomatoCart, Logic vulnerability that allows paying less or shopping for free, CVE-2012-4934, VU#207540
18/09/2012: osCommerce, Logic vulnerability that allows shopping for free, CVE-2012-2991, VU#459446