20626 matches found
Mail.ru: [supportlocal.delivery-club.ru] Subdomain Takeover
It was possible to claim unused delivery-club.ru subdomain delegated to external cloud service...
VK.com: Reflected XSS в /video
XSS в поиске по видеозаписям. xss в параметрах date, len, order при поиске видеозаписи с указанием параметров...
Basecamp: Bypass Tracking Blocker Protection Using Slashes Without Protocol On The Image Source.
Summary: - Some Way Has Been Discovered To Bypass Image Rewriting On HeyMail Using Slashes Without Protocol /\www.evil.com That Allows Bypassing Tracking Blocker And Collect Users Information Via Emails. Description: - While Searching I Found That The Image Rewriting Function On Heymail Could Be...
VK.com: Path Traversal в iOS приложении
Передача файлов из внутреннего каталога iOS приложения. С помощью хакерской атаки можно было угнать файлы из внутреннего каталога IOS приложения...
Mail.ru: Stored XSS на странице "Почты" [city-mobil.ru/taxiserv]
Stored XSS on city-mobil.ru/taxiserv mail page via firstname and lastname of driver...
Mail.ru: Stored XSS на странице "Изменить клиента", вкладка "История" [city-mobil.ru/taxiserv]
Stored XSS on city-mobil.ru/taxiserv driver page via firstname and lastname of driver...
Mail.ru: Stored XSS на странице "Изменить клиента" [city-mobil.ru/taxiserv]
Stored XSS on city-mobil.ru/taxiserv client page via firstname and lastname of driver...
Mail.ru: Stored XSS в профиле водителя [city-mobil.ru/taxiserv]
Stored XSS on city-mobil.ru/taxiserv driver cabinet via firstname and lastname of driver...
JSFScan.sh - Automation For Javascript Recon In Bug Bounty
Blog can be found at https://medium.com/@patelkathan22/beginners-guide-on-how-you-can-use-javascript-in-bugbounty-492f6eb1f9ea?sk=21500dc4288281c7e6ed2315943269e7 Script made for all your javascript recon automation in bugbounty. Just pass subdomain list to it and options according to your...
PlayStation: SMAP bypass
SMAP is a security feature on x86 CPUs, that forbids ring0 from reading/writing to ring3 pages, making it harder to exploit entire classes of vulnerabilities. There is a vulnerability in FreeBSD 12 that allows SMAP to be bypassed by userland. There is a very high probability that it affects the P...
Ruby on Rails: HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection.
When a site is configured to use the .tkte.ch leading dot short form for domain name, ex: ruby config.hosts You are being redirected. Where the controller is simply: ruby class RedirectController ApplicationController def main redirectto action: 'main' end end The host header poisoning was report...
Omise: ████.
input validation...
Mail.ru: unclaimed subdomain special.rkeeper.ru to takeover from tilda.cc
Domain, site, application -- http://special.rkeeper.ru/ Testing environment -- OS version, browser information, settings and prerequisites to reproduce vulnerability, testing tools used, etc Steps to reproduce: 1. create account on tilda.cc 1. create a aproject then a domain will be assigned to...
Automattic: [intensedebate.com] SQL Injection Time Based On /js/commentAction/
intensedebate.com SQLi Time Based On /js/commentAction/ Summary: Hello, I have found a SQLI Injection Time Based on /js/commentAction/. When a user want to submit/reply to a comment, a JSON payload was send by a GET request. GET...
Glassdoor: Reflected XSS at https://www.glassdoor.com/ via the 'numSuggestions' parameter
Hi there, I have found the xss vulnerability at: https://www.glassdoor.com/ via parameter: numSuggestions Summary: Affected Parameter: numSuggestions Browsers tested: Firefox, Chrome, Edge latest version Steps To Reproduce: Go to:...
Automattic: [intensedebate.com] XSS Reflected POST-Based on update/tumblr2/{$id}
Summary: Hello, I have found an XSS Reflected POST-Based on https://www.intensedebate.com/update/tumblr2/$id. The parameter $POST'txtCode' is reflected and is not sanitized. To trigger the XSS an attacker need to create a site and invite the victim in their own site and give then full permissions...
ImpressCMS: Other misconfiguration on Slack Server
Other misconfiguration on Slack Server...
Prototype Pollution in mozilla/node-convict
Description convict is vulnerable to Prototype Pollution. This package allowing for modification of prototype behavior, which may result in Information Disclosure/DoS/RCE. Proof of Concept 1. Create the following PoC file: js // poc.js var convict = require"convict"; var obj = ; var config =...
Bumble: Race Condition on "Get free Badoo Premium" which allows to get more days of free premium for Free.
Summary: On Badoo when a user wants to delete his account it prompts for a Free 3 days premium or the user can proceed to delete his account. But when user choose to get free 3 day premium he can click Get free Badoo Premium and can enjoy free premium for three days, Here i found a race condition...