<html>Hi there,<br />
I have found and reported another vulnerability a critical one, kindly take a look.<br />
Waiting for your response<br />
Always Best Regards<br />
White HaT
<div class="noTransl">----- Reply to message -----<br />
<b>Subject: </b>Re: Any Update on Reported Vulnerability<br />
<b>Date: </b>Sat, 27 Mar 2021, 21:51<br />
<b>From: </b> Ben Cooksley <a href="mailto:bcooksley@kde.org"><bcooksley@kde.org></a><br />
<b>To: </b> <a href="mailto:arslan.whitehat@inbox.eu"><arslan.whitehat@inbox.eu></a></div>
<blockquote>
<div>
<div>On Sun, Mar 28, 2021 at 6:53 AM M.Arslan Kabeer <<a href="arslan.whitehat@inbox.eu" rel="noopener noreferrer" target="_blank">arslan.whitehat@inbox.eu</a>> wrote:</div>
<div class="gmail_quote_84df94008a1a8823e076e8222eb4e032 ">
<blockquote class="gmail_quote_84df94008a1a8823e076e8222eb4e032 " style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid rgb(204,204,204); padding-left: 1ex; ">Oh yeah sorry :), can report further vulnerabilities ?</blockquote>
<div> </div>
<div>Hi there,</div>
<div> </div>
<div>Yes, further issues you have identified can be reported.</div>
<div> </div>
<div>Please note however that most automated tools usually identify items that are generally not an issue, including:</div>
<div>- The existence of publicly accessible Jenkins instances</div>
<div>- The accessibility of underlying Git repositories (as all the software we run is open source and hosted publicly somewhere)</div>
<div>- The accessibility of build system artifacts such as composer.json and Gemfile.lock (which are contained in the above mentioned repositories)</div>
<div>- The accessibility of environment files (.env) which are also public in the case of <a href="https://apps.kde.org/.env" rel="noopener noreferrer" target="_blank">https://apps.kde.org/.env</a> (also contained in one of those same repositories)</div>
<div> </div>
<div>Regards,</div>
<div>Ben Cooksley</div>
<div>KDE Sysadmin</div>
<div> </div>
<blockquote class="gmail_quote_84df94008a1a8823e076e8222eb4e032 " style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid rgb(204,204,204); padding-left: 1ex; ">
<div>----- Reply to message -----<br />
<b>Subject: </b>Re: Any Update on Reported Vulnerability<br />
<b>Date: </b>Fri, 26 Mar 2021, 21:05<br />
<b>From: </b> Carl Schwan <a href="carl@carlschwan.eu" rel="noopener noreferrer" target="_blank"><carl@carlschwan.eu></a><br />
<b>To: </b> kde-www <a href="kde-www@kde.org" rel="noopener noreferrer" target="_blank"><kde-www@kde.org></a></div>
<blockquote>Le vendredi, mars 26, 2021 7:58 PM, Nicolás Alvarez <<a href="nicolas.alvarez@gmail.com" rel="noopener noreferrer" target="_blank">nicolas.alvarez@gmail.com</a>> a écrit :<br />
<br />
> El vie, 26 de mar. de 2021 a la(s) 06:00, <a href="arslan.whitehat@inbox.eu" rel="noopener noreferrer" target="_blank">arslan.whitehat@inbox.eu</a> escribió:<br />
><br />
> > Hi there,<br />
> > Team any update on the vulnerability report,I have reported a DMARC vulnerability on 2021-03-18, and its been a while kindly update me about the vulnerability progress.<br />
> > I am also attaching the POC images again.<br />
> > I am hoping to receive a reward for the responsible disclosure of the vulnerability<br />
><br />
> We already replied about DMARC (this isn't a vulnerability and we<br />
> don't have a bounty program), and you already acknowledged the reply<br />
> in 2021-03-19.<br />
<br />
It's probably difficult to keep track of who replied with what, when probably<br />
sending these messages to anyone with missing DMARC config in a semi-automated<br />
way. :)<br />
<br />
Carl<br />
><br />
> --------------------------------------------------------------------------------------------------------------------------------------------------------<br />
><br />
> Nicolás<br />
<br />
</blockquote>
</blockquote>
</div>
</div>
</blockquote>
</html>