20626 matches found
MTN Group: Cross-site Scripting (XSS) - Reflected on https://api.mtn.sd/carbon/admin/login.jsp via `msgId` parameter - CVE-2020-17453
A reflected cross-site scripting XSS vulnerability was discovered in the msgId parameter of the login page at https://api.mtn.sd/carbon/admin/login.jsp. This vulnerability allowed an attacker to execute arbitrary JavaScript code in the context of the vulnerable page...
Nextcloud: Ratelimiting can be bypassed using IPv6 subnets
Nextcloud hardcodes IPv6 subnets to /128. End users get at least a /64 subnet more than the whole IPv4 address space!, most providers assign even larger subnets like /48. The subnet is used to block bruteforce attempts 3 and rate limiting 4. An attacker can easily generate random addresses from t...
Clario: Social media link hijack of team member [Linkedin] at https://mackeeper.com/team/
Steps To Reproduce: - Go to at https://mackeeper.com/team/ - You can see your team members photos - I have Hijacked social media link for member name as Mammon PPC Account who seems to be Manager - You can click on his photo and you will be redirected to My account on Linkedin here at...
Cross-site Scripting (XSS) - Stored in octobercms/library
✍️ Description OctoberCMS uses october/rain library to handle file uploads. Previously it was possible to upload malicious files with HTML content to the CMS via its Media upload feature. This security issue marked as CVE-2020-15249 was fixed in 1.0.469. But it is still possible to upload XML...
Moneybird: No rate Limit
Mailing to our support team using the support center in the application was improperly rate limited. There is now a better rate limiter in place...
HackerOne: Bypassing the External Link Warning
Summary: As the HackerOne team is aware, the URL https://hackerone.com/users/saml/[email protected] can redirect users to external pages. Because of this, there is a protection in the links created by Markdown to show the user a warning when clicking in any link started with...
HackerOne: The possibility of disrupting the normal operation of frontend using markdown
Summary: Hi team, Our team noticed that using some string construction in markdown may cause it to fail and output error 502. Thus, disrupting the UI process. This may affect the work in places where there is a GraphQL attribute output. For example: User object in GraphQL : introhtml attribute...
Uber: IDOR leads to See analytics of Loyalty Program in any restaurant.
Improper authorization allowed for disclosure any restaurant's analytics of the Loyalty Program on 3 endpoints...
Prototype Pollution in silentmatt/expr-eval
✍️ Description With speficific input attckers can define properties on prototype, which will lead to prototype pollution. Need node version=12.0.0, which introduce Object.fromEntries 🕵️♂️ Proof of Concept // PoC.js const Parser = require'expr-eval'; const o = ; console.log"o.a=", o.a; // o.a=...
Mail.ru: Blind SQL in id_locality GET param on [city-mobil.ru/taxiserv]
SQL injection in city-mobil.ru/taxiserv due to unsafe usage of GET parameter...
Sifchain: ETHEREUM_PRIVATE_KEY leaked via Open Github Repository
Summary: GitHub is a truly awesome service but it is unwise to put any sensitive data in code that is hosted on GitHub and similar services as I was able to find internal data as responsible disclosure I wanted to share it like this the only channel to do so, and it's related to your sensitive...
GitHub Security Lab: Java: CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
This bug was reported directly to GitHub Security Lab...
HackerOne: Hackerone is not properly deleting user id
Summary: Long ago, i had an account on hackerone that is now deleted. I used the alias email provided by h1 to sigbup on a site for bug testing. To my surprise, i receive an email to my account routed from an alias email that should not exist. Description: Steps To Reproduce 1. SignUp on H1 2. Us...
Mail.ru: Blind SQL injection on [city-mobil.ru/taxiserv/] in filter{"id_locality"}
SQL injection in city-mobil.ru/taxiserv due to unsafe usage of GET parameter...
8x8: Exposed PHP dependencies at ██.8x8.com
A limited amount of hosts were exposing the PHP vendor directory, which exposed names of internal packages & dependencies. The issue has been rectified...
LY Corporation: SSRF occurrence in website preview used by LINE Official Account Manager (https://manager.line.biz)
LINE Official Account Manager https://manager.line.biz uses PagePoker to provide website previews. Here it was not properly validated against the Opengraph image tag target, which could point to an internal network resource...
Kubernetes: SHA512 incorrect on most/many releases
Report Submission Form Summary: SHA512 is incorrect for most versions of kubernetes.tar.gz releases https://github.com/kubernetes/kubernetes/releases/. Kubernetes Version: all Component Version: all Steps To Reproduce: add details for how we can reproduce the issue, including relevant cluster set...
VK.com: Member still able close another user poll on communities topic
Insufficient validation in closing the poll of the community topic...
HackerOne: Used email confirmation link reveals the email address which is tied to it
Summary: If an attacker finds an used email confirmation link the token is in URL s/he will be able to see the email address which is tied to the confirmation link ID. The attack itself is pretty unlikely but the application should show the generic error message like The confirmation ID is invali...