A Flickr CSRF, GitLab, & OMIGOD, Azure again? [Bounty Hunting]

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/a-flickr-csrf-gitlab-omigod-azure-again.html

Some high impact vulnerabilities this week, CSRF in account deletion, remote code execution as root, and an apache "0day" that discloses PHP source.

[00:00:23] [Flickr] CSRF in Account Deletion feature

[00:03:38] OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers

[00:23:38] How I found my first Adobe Experience Manager related bug.

[00:27:41] [GitLab] Stored XSS in main page of a project

[00:31:01] [Mattermost] Privilege Escalation leading to post in channel without having privilege

[00:34:15] Hacking CloudKit - How I accidentally deleted your Apple Shortcuts

[00:48:52] Apache 0day bug, which still nobody knows of, and which was fixed accidentally

The DAY[0] Podcast episodes are streamed live on Twitch (@dayzerosec) twice a week:

Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities

Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.

The Video archive can be found on our Youtube channel: https://www.youtube.com/c/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

Or follow us on Twitter (@dayzerosec) to know when new releases are coming.