POJIA破甲
地图 / Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com

Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com

代码执行 / 不可信数据反序列化 / #2552879

厂商
Basecamp
严重程度
低危 · CVSS 5.5
赏金
—
弱点
不可信数据反序列化
研究员
@fr4via
披露日期
2024-07-09
资产
com.basecamp.hey
CVE
—

该报告还没有中文解读。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @fr4via · 版权归作者与 Basecamp 所有

同类报告

Deserialization of untrusted data at https://www.redtube.com/media/hls?s=dataPornhub · — · $10,000Attacker can add arbitrary data to the blockchain without paying gasRootstock Labs · 2019-09-18MobileIron Unauthenticated RCE on mdm.qiwi.com with WAF bypassQIWI · —Account takeover via insecure intent handlingBasecamp · 2024-05-30SQL Injection + Insecure Deserialization leads to Remote Code Execution on https://krisp.aiKrisp · 2023-02-22Unsafe deserialization leads to token leakage in PayPal & PayPal for Business [Android]PayPal · 2021-04-30