20626 matches found
office.pmsolutions.com.hk Cross Site Scripting vulnerability OBB-2252767
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
TikTok: reflected xss on the path m.tiktok.com
A cross site scripting vulnerability was found in Ambassador Manage endpoint. We thank @semsem123 for reporting this to our team...
Rocket.Chat: Unintended information disclosure in the Hubot Log files
Dear Rocket.Chat Team While inspecting our logs I noticed, that the OAuth Tokens are leaked in plaintext in the logs. I wanted to draw your attention to this, as this is a security vulnerability. See the attached Screenshot for a redacted log excerpt. In my opinion, the best approach here would b...
Cross-site Scripting (XSS) - Stored in patrowl/patrowlmanager
Description PatrOwl is vulnerable to stored XSS. Proof of Concept Impact This vulnerability permit to an authenticate user to execute JavaScript on other users Web Browser...
8x8: xss(r) vcc-na11.8x8.com
The "oem" parameter in the vcc-na11.8x8.com endpoint was vulnerable to Reflected Cross Site Scripting XSS attacks. This allowed attackers to execute malicious code and potentially steal non-secure cookies...
TikTok: IDOR the ability to view support tickets of any user on seller platform
Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially viewed support tickets on seller platform. We thank @lewaperbb for reporting this to our team...
Nextcloud: SQL injextion via vulnerable doctrine/dbal version
Summary: SQL injection via limit parameter on user facing APIs Steps To Reproduce: Run security scanner: 1. REPORT /remote.php/dav/comments/files/1985 1. XML input oc:filter-comments.oc:limittext was set to 1'" 1. You have an error in your SQL syntax Supporting Material/References: For more detai...
wenglorz.de Cross Site Scripting vulnerability OBB-2227135
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
Description Attacker is able to logout a user if a logged in user visits attacker website. Impact This vulnerability is capable of forging user to unintentional logout. Test Tested on Edge, firefox, chrome and safari. Fix You should use POST instead of GET/ANY. To expand: One way GET/ANY could be...
nvestestates.com Improper Access Control vulnerability OBB-2220470
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Lark Technologies: Able to steal private files by manipulating response using Auto Reply function of Lark
A IDOR Insecure Direct Object Reference vulnerability was found within the "AutoReply" functions of Lark. This vulnerability could have allowed malicious users to fetch the files of other users if they knew the specific file ID which was an alphanumeric value. We thank @imrannisar for reporting...
Adobe: Disclosure of github access token in config file via nignx off-by-slash
Summary: ██████████ is vulnerable to Nginx off-by-slash vulnerability that exposes Git configuration. Steps To Reproduce: 1. Visit https://█████████████ to download git config containing username and token. 2. Use it to pull entire source code via git clone ████████ Leaked: core...
Path Traversal in rhizome-conifer/conifer
Description misconfigurations of nginx lead to a path traversal vulnerability. Proof of Concept An attacker can access files like this: https://conifer.rhizome.org/static/app../admin.py https://conifer.rhizome.org/static/app../config/wr.yaml Impact An attacker can access files on the web server t...
in adodb/adodb
Description An attacker can inject values into the PostgreSQL connection string by bypassing adodbaddslashes . The function can be bypassed in phppgadmin for example by surrounding the username in quotes and submitting with other parameters injected in between. Proof of Concept I'm going to use...
Kubernetes: Ingress-nginx path allows retrieval of ingress-nginx serviceaccount token
Report Submission Form Summary: A user with the permissions to create an ingress resource can obtain the ingress-nginx service account token which can list secrets is all namespaces cluster wide. Kubernetes Version: 1.20 should work on 1.21 as well Component Version: nginx ingress controller v1.0...
Mail.ru: Deliviry Club Courier app (v. 3.9.25.0); Disclosure phone number of client.
Здравствуйте. Я нашёл баг в приложениидля курьеров, позволяющий получить реальный номер телефона клиента. Обычно, когда курьеру необходимо позвонить клиенту для уточнения какого-либо вопроса, курьер нажимает "Позвонить клиенту", и после этого совершается звонок не на номер клиента, а через Delive...
virginiaview.cnre.vt.edu Improper Access Control vulnerability OBB-2209836
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
QIWI: account takeover through password reset in url https://reklama.tochka.com/
Steps to reproduce 1- Create an account 2- visit this url https://reklama.tochka.com/mainpage1/recover/ 2- Enter your email and intercept the response to the request that recovers your password you will notice that it looks like this HTTP/1.1 200 OK Server: nginx Date: Sun, 24 Oct 2021 21:32:20 G...
Monero: RPC call crashes node
Summary: Passing a large list of amounts to the getoutputdistribution call crashes a remote node, after maybe 90 seconds of keeping it busy. Releases Affected: Probably all Steps To Reproduce: values=echo $seq 0 500 900000|sed -e 's/ /,/g' ; curl http://127.0.0.1:38081/jsonrpc -d...