235 - A GitLab Account Takeover and a Coldfusion RCE [Bug Bounty Podcast]

A short bounty episode featuring some logical bugs in Apache OFBiz, a GitLab Account Takeover, and an unauthenticated RCE in Adobe Coldfusion.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/235.html

[00:00:00] Introduction
[00:00:20] SonicWall Discovers Critical Apache OFBiz Zero-day
[00:11:40] [GitLab] Account Takeover via password reset without user interactions
[00:24:05] Unauthenticated RCE in Adobe Coldfusion [CVE-2023-26360]
[00:35:08] No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability
[00:36:45] How we made $120k bug bounty in …

account account takeover adobe adobe coldfusion apache apache ofbiz apache ofbiz zero-day bounty bug bug bounty bugs coldfusion critical gitlab introduction ofbiz password password reset podcast rce reset sonicwall takeover unauthenticated zero-day