20626 matches found
Acronis: Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/
Summary Hello team. I found A security issue on devicelock.com where the attacker can access to any Ticket support and real all the information that The users sent to the support. and this without user interaction. In other words: an attacker can have full access to users Ticket using Ticket id...
Cross-site Scripting (XSS) - Generic in blackcatdevelopment/blackcatcms
✍️ Description 'Display name' Cross Site Scripting XSS 🕵️♂️ Proof of Concept 1. To exploit this vulnerability an attacker has a login in the admin panel and clicks on the admin profile button. Then use " onmouseover=alert1 " this XSS payload on Display name field and click on the Save button. 2...
Acronis: Stored Cross-site Scripting on devicelock.com/forum/
Summary Hello, @acronis Team I hope you all doing well. I just found A Stored Cross-site Scripting on devicelock.com/forum/ by changing the City value on https://www.devicelock.com/bitrix/admin/useredit.php? to HTML/javascript code and lead to Stored Cross-site Scripting. 1. go to...
Code Injection in prayag2/konsave
✍️ Description konsave is a CLI program that will let you save and apply your KDE Plasma customizations with just one command , which is vulnerable to YAML deserialization attack caused by unsafe loading leads to Arbitary Code Execution. 🕵️♂️ Proof of Concept Installation bash pip install konsave...
Evernote: CSRF leads to account deactivation of users
Step to reproduce vulnerability:- 1 Create 2 account one account is for attacker and one is for victim 2 With attacker account go to https://www.evernote.com/secure/CloseAccount.action 3 Open your burpsuite and when you will press Deactivate your Evernote account you will see another popup of...
Acronis: Information Disclosure via ZIP file on AWS Bucket [http://acronis.1.s3.amazonaws.com]
Summary Hello, @acronis Team I hope you all doing well. during My recon, I found OPEN S3 BUCKET http://acronis.1.s3.amazonaws.com and this BUCKET has an ZIP file . and this file contains sensitive information about the internal system of Acronis. This Zip file Is from 2018. And it looks like it w...
U.S. General Services Administration: IDOR at training.smartpay.gsa.gov/reports/quizzes-taken-by-user
Hey, I found an IDOR that allow anyone view other user result by changing USERID parameter. /reports/quizzes-taken-by-user.csv/USERID Step to Produce: Go to the Section quizzes-taken-by-user as Shown in the Screenshot attached. Step 2: Click on Download CSV. Step 3 Intercept the Request using the...
U.S. Dept Of Defense: CSRF to Cross-site Scripting (XSS)
hello dear support I have found csrf to XSS on https://██████ my payload "; url: POST ██████████ post data answer=A"; Impact Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session...
Uber: 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl )
The host at https://muberscolombia.com/ and http://sklep.ubereats.pl/ had a dangling record pointing to unclaimed Wix and Shoplo assets. The hacker registered the latter, and claimed ownership of the resource...
VK.com: XSS в сюжетах.
Недостаточная валидация в названии сюжета на мвк...
VK.com: Отправляем смс на любой номер от имени vk.com. (Сообщение в смс всегда одно и то же, его менять нельзя.)
Отправка SMS на любой номер для установки официальных приложений есть лимиты...
Command Injection in facebook/create-react-app
description react-dev-utils includes some utilities used by Create React App. The function getProcessForPort in react-dev-utils is vulnerable to command injection. PoC Create a .js file with the content below and run it, then the file pzhou@shu can be illegally created. var getProcessForPort =...
GitHub Security Lab: ihsinme: CPP add query for CWE-788 Access of memory location after the end of a buffer using strncat.
This bug was reported directly to GitHub Security Lab...
Starbucks: Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome
elber discovered a CSRF in webapp.starbucks.co.jp leaked an access token if an authenticated user opened a crafted HTML file in a browser other than Chrome which has Same Site Attribute for the cookie set by default. elber also demonstrated the ability to add a Starbucks card to the account with...
VK.com: Open Redirect и подмена ссылки в сниппете приложения VKMA
Открытое перенаправление в сниппетах ссылок мини-приложений...
Mail.ru: IDOR to delete test/poll/quiz on relap.io
IDOR vulnerability in relap.io allowed to delete arbitrary test, poll or quiz forms...
Path Traversal in mucommander/mucommander
:book: Description mucommander A lightweight, cross-platform file manager with a dual-pane interface. This package is vulnerable for zip-slip. https://github.com/mucommander/mucommander https://www.mucommander.com/ :recycle: Steps To Reproduce-: 0 download and run latest release from...
Ruby on Rails: redirect_to(["string"]) remote code execution
For example, redirecttoparams:userinput with a URL of ?userinput=something calls the method somethingurl and tries to redirect the return value of the method. If this call is on an unauthenticated route, it would allow an external user to test if a route name exists by determining if the app 500s...
Shopify: staffOrderNotificationSubscriptionDelete Could Be Used By Staff Member With Settings Permission
Hi, The staff order notification should be under the control of staff members with Order permission but I found that the staff member with just Settings permission can also delete the order notifications using the GID Steps to reproduce - Login as a staff member with Settings permission - Make th...