Sifchain: Information Disclosure on https://rpc.sifchain.finance/

Description: Hi team, I see the subdomain https://rpc.sifchain.finance/ . And I visited this subdomain it contains many endpoints. Affected URLs: https://rpc.sifchain.finance/ Poc Available endpoints: Endpoints that require arguments: //rpc.sifchain.finance/abciinfo?...

GitHub Security Lab: [Java] CWE-078: Add JSch lib OS Command Injection sink

This bug was reported directly to GitHub Security Lab...

OS Command Injection in falconchristmas/fpp

✍️ Description In https://github.com/FalconChristmas/fpp/blob/123cdf2eb11062766da333a7a4d85bc0bf620e47/www/runEventScript.phpL32 a command is built using unsanitized user input : php \n"; echo "\n"; system$SUDO . " $fppDir/scripts/eventScript $scriptDirectory/$script $args"; // scripts and args ar...

in axiomatic-systems/bento4

✍️ Description NULL pointer dereference of Ap4Descriptor.h in function GetTag 🕵️‍♂️ Proof of Concept Verification steps： 1.Get the source code of Bento4 2.Compile the Bento4 bash $ cd Bento4 $ mkdir checkbuild && cd checkbuild $ cmake ../ -DCMAKECCOMPILER=clang -DCMAKECXXCOMPILER=clang++...

Nextcloud: Clients do not verify server public key

So this is related to https://hackerone.com/reports/1189162 but also to your RFC Bear with me because there is going to be some hand waving here and there. Since not everything is implemented yet from your RFC. Right now what happens is:...

Nextcloud: public webdav endpoint not bruteforce protected

Again related to https://hackerone.com/reports/1173684 I am having some trouble finding the code. However if you do curl -u "RANDOM1:RANDOM2" -X PROPFIND https://server/public.php/webdav And then check your ocbruteforceattempts table. You'll see there is no entry registered. Impact Low just like ...

Nextcloud: Add to your nextcloud endpoint is not properly protected

This is related to https://hackerone.com/reports/1173684 The endpoint you hit does have bruteforce protection https://github.com/nextcloud/server/blob/master/apps/federatedfilesharing/lib/Controller/MountPublicLinkController.phpL126 But this is only triggered by finding a share that is password...

Sifchain: Email Spoofing on sifchain.finance

Summary: There is an Email Spoofing vulnerability on your domain sifchain.finance which allows an attacker to send an email with your domain namesuch as [email protected] and so on. Steps To Reproduce: Go to http://emkei.cz Fill "From Email" field to [email protected] or any other...

Session Fixation in monicahq/monica

✍️ Description Recently there was more than 5 reports at huntr showing how to trigger XSS in monica ,the session fixation i am reporting here can be used with these bugs or can be used for post exploitation methods to maintain access on an account even after changing the password of the account...

Sifchain: No Valid SPF Records at sifchain.finance

Hello, There is any issue No valid SPF Records Desciprition : There is a email spoofing vulnerability.Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing is a tactic used in phishing...

Cross-site Scripting (XSS) - Stored in forkcms/forkcms

✍️ Description The forkcms is vulnerable to XSS through image name edition. 🕵️‍♂️ Proof of Concept 1. With an authenticated user, access http://localhost/private/en/medialibrary/mediaitemindex. 2. Click on New media. 3. Upload any image and then click on Back to overview. 4. With the image...

Sifchain: Username disclosure at Main Domain

Hello, PoC Link https://sifchain.finance//wp-json/wp/v2/users/ thanks. Impact Malicious counterpart could collect the usernames disclosed and the admin user and be focused throughout BF attack as the usernames are now known, making it less harder to penetrate the data.gov systems...

Sifchain: Vulnerable javascript dependency at Main domain

Hello, Issue detail, Burp observed 1 outdated JavaScript libraries with 4 known vulnerabilities. Burp detected bootstrap version 4.0.0, which has the following vulnerabilities: CVE-2019-8331: XSS in data-template, data-content and data-title properties of tooltip/popover CVE-2018-14041: XSS in...

Sifchain: A password in plain text in conf file

I found a password in plain text in \sifnode-develop\ui\e2e\config.js in the source code. password: "coolguy21" Impact I don't know actually how does this affects but passwords in plaintexts are always dangerous...

Sifchain: Email spoofing

Email spoofing is possible To verify: visit :https://www.kitterman.com/spf/validate.html? and type your domain name to check SPF record you can see the results as: NO valid SPF record found POC: 1.visit http://emkei.cz// 2.fill the from email as [email protected] 3.to email as victim email...

Path Traversal in thecodingmachine/mouf

✍️ Description Mouf is vulnerable to path traversal attacks on mouf/mouf/src/direct/getsourcefile.php because it doesnt sanitize user supplied parameters as shown below. Vulnerable variable: file Method: GET The $file variable is constructed using the user supplied data, and then a file is open...

Reddit: critical file found etc/passwd on www.reddit.com

1.go to this link https://www.reddit.com/etc%2fpasswd 2.youll find all the etc/passwd files this data should be protected. 3.these passwd can be used for many illegal purpose and can damage the comapny poc attched: HTTP/2 200 OK Content-Type: text/plain; charset=UTF-8 X-Ua-Compatible: IE=edge...

Sifchain: No valid SPF record found

Email spoofing is possible To verify: visit : https://www.kitterman.com/spf/validate.html and type your domain name to check SPF records you can see the results as: No valid SPF record found. POC: 1. visit: https://emkei.cz/ 2. fill the from email as [email protected] 3.To email as victim ema...

GitHub Security Lab: [Java] CWE-348: Use of less trusted source

This bug was reported directly to GitHub Security Lab...

Sifchain: mongodb credentials leaked in github

Steps To Reproduce: add details for how we can reproduce the issue 1. Go to values.yaml file file. 2.Check from line 23: blockExplorer: args: mongoUsername: "mongodb" mongoPassword: mongoDatabase: "blockexplorer" env: rootURL: "http://localhost:3000" chainnet: "" genesisURL: "" remote: rpcURL: ""...