🏦 MTN Group Report
⚡ Title: Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/
🔍 Reporter: offensiveops (ꦄꦤ꧀ꦢꦿꦶ)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Medium
└ 🎯 CWE: Information Disclosure
└ 🔢 CVE: CVE-2021-3129

⏰ Timeline:
└ 🔓 Disclosed: 2025-02-23 09:03:31 UTC
└ 📝 Created: 2024-10-08 05:25:35 UTC

📄 Summary:

The Laravel framework contained a vulnerability known as CVE\-2021\-3129, which allowed remote code execution due to unsafe usage of PHP in the Ignition debug module. This vulnerability was relatively easy to exploit and did not require user authentication, resulting in a high CVSS score of 9.8. The vulnerability was triggered by sending a crafted POST request to the `/\_ignition/execute\-solution` endpoint, which allowed an attacker to execute arbitrary code on the target system.

🏦 MTN Group Report
🔥 Title: Unauthorized access to PII leads to Administrator account Takeover
🔍 Reporter: h0w (H͟a͟c͟k͟e͟r͟ ͟0͟D͟a͟y͟ ͟W͟o͟m͟a͟n͟)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Critical
└ 🎯 CWE: Privilege Escalation
└ 🔢 CVE: None

⏰ Timeline:
└ 🔓 Disclosed: 2025-02-22 15:48:49 UTC
└ 📝 Created: 2024-04-06 22:17:41 UTC

📄 Summary:

The vulnerability arises from insufficient restrictions placed on the list of post authors, which could be exploited by remote attackers to obtain sensitive information through wp/v2/users/15 requests. The sensitive information, including email addresses, could be obtained and used in further attacks such as password guessing. A CORS misconfiguration was also identified, which may have enabled third\-party sites to carry out privileged actions and retrieve sensitive information.

🏦 MTN Group Report
⚠️ Title: CVE-2023-41763 Business Elevation of Privilege vulnerability on .[mtn.com](http://mtn.com/)
🔍 Reporter: h0w (H͟a͟c͟k͟e͟r͟ ͟0͟D͟a͟y͟ ͟W͟o͟m͟a͟n͟)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: High
└ 🎯 CWE: Command Injection - Generic
└ 🔢 CVE: CVE-2023-41763, CVE-2023-36780, CVE-2023-36786, CVE-2023-36789

⏰ Timeline:
└ 🔓 Disclosed: 2025-02-22 15:49:20 UTC
└ 📝 Created: 2024-01-09 15:51:41 UTC

📄 Summary:

The Microsoft Skype for Business installation on the remote host was missing security updates. The flaw was actively exploited. Attackers could access some sensitive information but not alter or restrict access to it. The impact related primarily to confidentiality. Multiple vulnerabilities were affected, including an elevation of privilege vulnerability and remote code execution vulnerabilities.

Hacktivity from noentry

```

CVE\-2024\-35200 in nginx
```

https://hackerone.com/reports/2526041
Disclosed at: 2024-07-01 08:40:31 UTC+0
Created at: 2024-05-30 09:19:50 UTC+0

HackerOne

Internet Bug Bounty disclosed on HackerOne: CVE-2024-35200 in nginx

K000139612: NGINX HTTP/3 QUIC vulnerability CVE-2024-35200 Security Advisory Description When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can...