Menu
▾
▴
jedit-devel
You can subscribe to this list here.
| 1999 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
(32) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2000 |
Jan
(452) |
Feb
(435) |
Mar
(117) |
Apr
(265) |
May
(161) |
Jun
(276) |
Jul
(409) |
Aug
(522) |
Sep
(139) |
Oct
(306) |
Nov
(406) |
Dec
(217) |
| 2001 |
Jan
(237) |
Feb
(194) |
Mar
(266) |
Apr
(298) |
May
(266) |
Jun
(195) |
Jul
(427) |
Aug
(660) |
Sep
(808) |
Oct
(465) |
Nov
(260) |
Dec
(226) |
| 2002 |
Jan
(255) |
Feb
(322) |
Mar
(440) |
Apr
(327) |
May
(271) |
Jun
(263) |
Jul
(122) |
Aug
(346) |
Sep
(172) |
Oct
(282) |
Nov
(184) |
Dec
(166) |
| 2003 |
Jan
(325) |
Feb
(431) |
Mar
(431) |
Apr
(238) |
May
(320) |
Jun
(331) |
Jul
(289) |
Aug
(277) |
Sep
(223) |
Oct
(273) |
Nov
(218) |
Dec
(223) |
| 2004 |
Jan
(203) |
Feb
(321) |
Mar
(316) |
Apr
(18) |
May
(44) |
Jun
(149) |
Jul
(83) |
Aug
(216) |
Sep
(188) |
Oct
(136) |
Nov
(73) |
Dec
(117) |
| 2005 |
Jan
(101) |
Feb
(208) |
Mar
(153) |
Apr
(81) |
May
(85) |
Jun
(87) |
Jul
(100) |
Aug
(145) |
Sep
(57) |
Oct
(123) |
Nov
(73) |
Dec
(105) |
| 2006 |
Jan
(211) |
Feb
(134) |
Mar
(299) |
Apr
(223) |
May
(292) |
Jun
(426) |
Jul
(477) |
Aug
(415) |
Sep
(501) |
Oct
(460) |
Nov
(427) |
Dec
(302) |
| 2007 |
Jan
(467) |
Feb
(423) |
Mar
(356) |
Apr
(241) |
May
(357) |
Jun
(342) |
Jul
(373) |
Aug
(421) |
Sep
(491) |
Oct
(266) |
Nov
(236) |
Dec
(310) |
| 2008 |
Jan
(228) |
Feb
(344) |
Mar
(466) |
Apr
(410) |
May
(437) |
Jun
(303) |
Jul
(255) |
Aug
(451) |
Sep
(520) |
Oct
(379) |
Nov
(430) |
Dec
(261) |
| 2009 |
Jan
(352) |
Feb
(394) |
Mar
(279) |
Apr
(534) |
May
(245) |
Jun
(392) |
Jul
(510) |
Aug
(392) |
Sep
(237) |
Oct
(332) |
Nov
(302) |
Dec
(590) |
| 2010 |
Jan
(723) |
Feb
(650) |
Mar
(530) |
Apr
(307) |
May
(300) |
Jun
(450) |
Jul
(196) |
Aug
(233) |
Sep
(270) |
Oct
(288) |
Nov
(284) |
Dec
(331) |
| 2011 |
Jan
(336) |
Feb
(277) |
Mar
(133) |
Apr
(102) |
May
(50) |
Jun
(234) |
Jul
(174) |
Aug
(274) |
Sep
(355) |
Oct
(273) |
Nov
(895) |
Dec
(749) |
| 2012 |
Jan
(744) |
Feb
(498) |
Mar
(767) |
Apr
(412) |
May
(513) |
Jun
(596) |
Jul
(372) |
Aug
(515) |
Sep
(373) |
Oct
(246) |
Nov
(210) |
Dec
(232) |
| 2013 |
Jan
(162) |
Feb
(226) |
Mar
(209) |
Apr
(162) |
May
(84) |
Jun
(153) |
Jul
(91) |
Aug
(142) |
Sep
(151) |
Oct
(220) |
Nov
(176) |
Dec
(131) |
| 2014 |
Jan
(61) |
Feb
(83) |
Mar
(93) |
Apr
(274) |
May
(83) |
Jun
(46) |
Jul
(149) |
Aug
(61) |
Sep
(49) |
Oct
(93) |
Nov
(100) |
Dec
(164) |
| 2015 |
Jan
(93) |
Feb
(130) |
Mar
(44) |
Apr
(31) |
May
(85) |
Jun
(11) |
Jul
(47) |
Aug
(131) |
Sep
(117) |
Oct
(115) |
Nov
(73) |
Dec
(84) |
| 2016 |
Jan
(106) |
Feb
(88) |
Mar
(116) |
Apr
(160) |
May
(121) |
Jun
(74) |
Jul
(126) |
Aug
(141) |
Sep
(101) |
Oct
(38) |
Nov
(32) |
Dec
(6) |
| 2017 |
Jan
(33) |
Feb
(60) |
Mar
(112) |
Apr
(33) |
May
(24) |
Jun
(115) |
Jul
(24) |
Aug
|
Sep
(6) |
Oct
(147) |
Nov
(166) |
Dec
(118) |
| 2018 |
Jan
(53) |
Feb
(51) |
Mar
(4) |
Apr
(14) |
May
(28) |
Jun
(14) |
Jul
(18) |
Aug
(53) |
Sep
(27) |
Oct
(9) |
Nov
(2) |
Dec
(2) |
| 2019 |
Jan
(8) |
Feb
(7) |
Mar
(21) |
Apr
(17) |
May
(43) |
Jun
(45) |
Jul
(13) |
Aug
(32) |
Sep
(18) |
Oct
(41) |
Nov
(19) |
Dec
(60) |
| 2020 |
Jan
(9) |
Feb
(12) |
Mar
(26) |
Apr
(43) |
May
(67) |
Jun
(42) |
Jul
(4) |
Aug
(3) |
Sep
(73) |
Oct
(8) |
Nov
(19) |
Dec
(14) |
| 2021 |
Jan
(19) |
Feb
(9) |
Mar
(20) |
Apr
(25) |
May
(17) |
Jun
(9) |
Jul
(1) |
Aug
(21) |
Sep
(17) |
Oct
(12) |
Nov
(4) |
Dec
|
| 2022 |
Jan
(2) |
Feb
(1) |
Mar
(9) |
Apr
(5) |
May
(25) |
Jun
(9) |
Jul
(10) |
Aug
(3) |
Sep
(27) |
Oct
(6) |
Nov
(9) |
Dec
|
| 2023 |
Jan
|
Feb
|
Mar
(11) |
Apr
|
May
(13) |
Jun
(11) |
Jul
(11) |
Aug
(14) |
Sep
(17) |
Oct
(50) |
Nov
(5) |
Dec
(2) |
| 2024 |
Jan
(6) |
Feb
(20) |
Mar
(8) |
Apr
(15) |
May
(35) |
Jun
|
Jul
(7) |
Aug
(21) |
Sep
(13) |
Oct
(33) |
Nov
(7) |
Dec
(12) |
| 2025 |
Jan
(3) |
Feb
(26) |
Mar
(14) |
Apr
(9) |
May
(1) |
Jun
(9) |
Jul
(1) |
Aug
(5) |
Sep
(6) |
Oct
(1) |
Nov
|
Dec
|
| S | M | T | W | T | F | S |
|---|---|---|---|---|---|---|
|
|
1
|
2
|
3
|
4
|
5
|
6
|
|
7
|
8
|
9
|
10
|
11
(1) |
12
|
13
|
|
14
|
15
(3) |
16
(1) |
17
(1) |
18
|
19
|
20
|
|
21
|
22
|
23
|
24
|
25
|
26
|
27
|
|
28
|
29
|
30
|
|
|
|
|
|
From: Eric Le L. <ker...@us...> - 2025-09-17 12:28:09
|
- **status**: open-invalid --> closed-invalid - **Comment**: according to your report HTTP is 200 with modified or unmodified account id, but json is status: "ok" with unmodified and "error" with modified account id. So it doesn't look like the changed account id was accepted. Again, it has nothing to do with jEdit. I'm closing the ticket now. --- **[bugs:#4147] Found Vulnerability:- IDOR (Insecure Direct Object Reference)** **Status:** closed-invalid **Group:** UNUSED **Labels:** IDOR (Insecure Direct Object Reference) **Created:** Thu Sep 11, 2025 08:58 PM UTC by kunal waidande **Last Updated:** Tue Sep 16, 2025 01:57 PM UTC **Owner:** nobody **Attachments:** - [jedit.org report.pdf](https://sourceforge.net/p/jedit/bugs/4147/attachment/jedit.org%20report.pdf) (920.8 kB; application/pdf) The following API endpoint allows an attacker to change account-id in the query string and receive a valid response tied to that account. Vulnerable endpoint: GET /a/api/fastlane.json?account_id=15680&site_id=103240 How to perform: 1- Go to website (https://www.jedit.org) 2- In home page on right side you will see sourceForge Project option. 3- Open burpsuit and on the intercept and in browser click on sourceForge Project option. 4- Forward the first and second request and then you will see bunch of requests in that request. 5- You that requests you will see (https://fastlane.rubiconproject.com). 6- Send it to repeater and change the account id. 7- You will see that response is 200 OK . Please find attached PDF report in that, I have created all the manually tested proof report. --- Sent from sourceforge.net because jed...@li... is subscribed to https://sourceforge.net/p/jedit/bugs/ To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/jedit/admin/bugs/options. Or, if this is a mailing list, you can unsubscribe from the mailing list. |
|
From: kunal w. <kun...@us...> - 2025-09-16 13:57:25
|
*Before re-testing it first Login your account then only you will see response 200 ok:- In 6th point after modifying the account id from request you will see that response is ok in repeater, it must not happen. If somone modify the account id it must show error code. I have also send the PDF report with POC. --- **[bugs:#4147] Found Vulnerability:- IDOR (Insecure Direct Object Reference)** **Status:** open-invalid **Group:** UNUSED **Labels:** IDOR (Insecure Direct Object Reference) **Created:** Thu Sep 11, 2025 08:58 PM UTC by kunal waidande **Last Updated:** Mon Sep 15, 2025 06:54 PM UTC **Owner:** nobody **Attachments:** - [jedit.org report.pdf](https://sourceforge.net/p/jedit/bugs/4147/attachment/jedit.org%20report.pdf) (920.8 kB; application/pdf) The following API endpoint allows an attacker to change account-id in the query string and receive a valid response tied to that account. Vulnerable endpoint: GET /a/api/fastlane.json?account_id=15680&site_id=103240 How to perform: 1- Go to website (https://www.jedit.org) 2- In home page on right side you will see sourceForge Project option. 3- Open burpsuit and on the intercept and in browser click on sourceForge Project option. 4- Forward the first and second request and then you will see bunch of requests in that request. 5- You that requests you will see (https://fastlane.rubiconproject.com). 6- Send it to repeater and change the account id. 7- You will see that response is 200 OK . Please find attached PDF report in that, I have created all the manually tested proof report. --- Sent from sourceforge.net because jed...@li... is subscribed to https://sourceforge.net/p/jedit/bugs/ To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/jedit/admin/bugs/options. Or, if this is a mailing list, you can unsubscribe from the mailing list. |
|
From: Eric Le L. <ker...@us...> - 2025-09-15 18:54:55
|
I see you already created https://sourceforge.net/p/forge/site-support/27035/ --- **[bugs:#4147] Found Vulnerability:- IDOR (Insecure Direct Object Reference)** **Status:** open-invalid **Group:** UNUSED **Labels:** IDOR (Insecure Direct Object Reference) **Created:** Thu Sep 11, 2025 08:58 PM UTC by kunal waidande **Last Updated:** Mon Sep 15, 2025 06:53 PM UTC **Owner:** nobody **Attachments:** - [jedit.org report.pdf](https://sourceforge.net/p/jedit/bugs/4147/attachment/jedit.org%20report.pdf) (920.8 kB; application/pdf) The following API endpoint allows an attacker to change account-id in the query string and receive a valid response tied to that account. Vulnerable endpoint: GET /a/api/fastlane.json?account_id=15680&site_id=103240 How to perform: 1- Go to website (https://www.jedit.org) 2- In home page on right side you will see sourceForge Project option. 3- Open burpsuit and on the intercept and in browser click on sourceForge Project option. 4- Forward the first and second request and then you will see bunch of requests in that request. 5- You that requests you will see (https://fastlane.rubiconproject.com). 6- Send it to repeater and change the account id. 7- You will see that response is 200 OK . Please find attached PDF report in that, I have created all the manually tested proof report. --- Sent from sourceforge.net because jed...@li... is subscribed to https://sourceforge.net/p/jedit/bugs/ To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/jedit/admin/bugs/options. Or, if this is a mailing list, you can unsubscribe from the mailing list. |
|
From: Eric Le L. <ker...@us...> - 2025-09-15 18:53:48
|
- **Group**: severe bug --> UNUSED - **Comment**: please clarify exactly how in step 6. it is a vulnerability since the response is an error. Anyway, please send the report to sourceforge.net, because on jedit.org it is just an image and a plain link to https://www.sourceforge.net/projects/jedit/. --- **[bugs:#4147] Found Vulnerability:- IDOR (Insecure Direct Object Reference)** **Status:** open-invalid **Group:** UNUSED **Labels:** IDOR (Insecure Direct Object Reference) **Created:** Thu Sep 11, 2025 08:58 PM UTC by kunal waidande **Last Updated:** Mon Sep 15, 2025 06:53 PM UTC **Owner:** nobody **Attachments:** - [jedit.org report.pdf](https://sourceforge.net/p/jedit/bugs/4147/attachment/jedit.org%20report.pdf) (920.8 kB; application/pdf) The following API endpoint allows an attacker to change account-id in the query string and receive a valid response tied to that account. Vulnerable endpoint: GET /a/api/fastlane.json?account_id=15680&site_id=103240 How to perform: 1- Go to website (https://www.jedit.org) 2- In home page on right side you will see sourceForge Project option. 3- Open burpsuit and on the intercept and in browser click on sourceForge Project option. 4- Forward the first and second request and then you will see bunch of requests in that request. 5- You that requests you will see (https://fastlane.rubiconproject.com). 6- Send it to repeater and change the account id. 7- You will see that response is 200 OK . Please find attached PDF report in that, I have created all the manually tested proof report. --- Sent from sourceforge.net because jed...@li... is subscribed to https://sourceforge.net/p/jedit/bugs/ To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/jedit/admin/bugs/options. Or, if this is a mailing list, you can unsubscribe from the mailing list. |
|
From: Eric Le L. <ker...@us...> - 2025-09-15 18:53:32
|
- **status**: open --> open-invalid - **Comment**: please clarify exactly how in step 6. it is a vulnerability since the response is an error. Anyway, please send the report to sourceforge.net, because on jedit.org it is just an image and a plain link to https://www.sourceforge.net/projects/jedit/. --- **[bugs:#4147] Found Vulnerability:- IDOR (Insecure Direct Object Reference)** **Status:** open-invalid **Group:** severe bug **Labels:** IDOR (Insecure Direct Object Reference) **Created:** Thu Sep 11, 2025 08:58 PM UTC by kunal waidande **Last Updated:** Thu Sep 11, 2025 08:58 PM UTC **Owner:** nobody **Attachments:** - [jedit.org report.pdf](https://sourceforge.net/p/jedit/bugs/4147/attachment/jedit.org%20report.pdf) (920.8 kB; application/pdf) The following API endpoint allows an attacker to change account-id in the query string and receive a valid response tied to that account. Vulnerable endpoint: GET /a/api/fastlane.json?account_id=15680&site_id=103240 How to perform: 1- Go to website (https://www.jedit.org) 2- In home page on right side you will see sourceForge Project option. 3- Open burpsuit and on the intercept and in browser click on sourceForge Project option. 4- Forward the first and second request and then you will see bunch of requests in that request. 5- You that requests you will see (https://fastlane.rubiconproject.com). 6- Send it to repeater and change the account id. 7- You will see that response is 200 OK . Please find attached PDF report in that, I have created all the manually tested proof report. --- Sent from sourceforge.net because jed...@li... is subscribed to https://sourceforge.net/p/jedit/bugs/ To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/jedit/admin/bugs/options. Or, if this is a mailing list, you can unsubscribe from the mailing list. |
|
From: kunal w. <kun...@us...> - 2025-09-11 20:58:52
|
--- **[bugs:#4147] Found Vulnerability:- IDOR (Insecure Direct Object Reference)** **Status:** open **Group:** severe bug **Labels:** IDOR (Insecure Direct Object Reference) **Created:** Thu Sep 11, 2025 08:58 PM UTC by kunal waidande **Last Updated:** Thu Sep 11, 2025 08:58 PM UTC **Owner:** nobody **Attachments:** - [jedit.org report.pdf](https://sourceforge.net/p/jedit/bugs/4147/attachment/jedit.org%20report.pdf) (920.8 kB; application/pdf) The following API endpoint allows an attacker to change account-id in the query string and receive a valid response tied to that account. Vulnerable endpoint: GET /a/api/fastlane.json?account_id=15680&site_id=103240 How to perform: 1- Go to website (https://www.jedit.org) 2- In home page on right side you will see sourceForge Project option. 3- Open burpsuit and on the intercept and in browser click on sourceForge Project option. 4- Forward the first and second request and then you will see bunch of requests in that request. 5- You that requests you will see (https://fastlane.rubiconproject.com). 6- Send it to repeater and change the account id. 7- You will see that response is 200 OK . Please find attached PDF report in that, I have created all the manually tested proof report. --- Sent from sourceforge.net because jed...@li... is subscribed to https://sourceforge.net/p/jedit/bugs/ To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/jedit/admin/bugs/options. Or, if this is a mailing list, you can unsubscribe from the mailing list. |