20626 matches found
Kubernetes: There is any issue No valid SPF Records
There is a email spoofing vulnerability.Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing is a tactic used in phishing and spam campaigns because people are more likely to open an...
Mail.ru: [panel.city-mobil.ru/admin/] Blind XSS via partner name (similar to #746505)
It was possible to cause XSS condition in admin panel of Citymobil by setting malformed partner name in https://fleet.city-mobil.ru/front/ The issue is really similar to 746505. The original issue was exploited via editing an existed user - we could add blind XSS payload during user editing. The...
Mail.ru: Cross-organization data access in city-mobil.ru
A legitimate partner's superuser account could have access to information of driver belonging to different partner, including passport and driving license data. Combined Improrer Access + IDOR It was possible to get access to passport, drive license any taxi driver. As well as changed settings...
LY Corporation: SSRF restricted to HTTP/HTML on LINE Social Plugins (https://social-plugins.line.me/)
LINE Social Plugins https://social-plugins.line.me/ is a service that provides LINE users with content sharing on the web. This SSRF attack was caused by bypassing the DNS verification of the parameter value received to check the page information of shared content. Attacks were only possible with...
Shopify: A staff without export customers permissions can still export customers CSV file
Steps To Reproduce: 1. Login as staff without export customers permissions but with customers permissions. 2. Go to customers pages, you can still export customers CSV file. F805311 F805312 F805313 Impact A staff without export customers permissions can still export customers CSV file...
Mail.ru: [capsula.mail.ru] overriding order info
IDOR vulnerability in order editing functionality of capsula.mail.ru allowed to override the incomplete unsubmitted order saved for later...
GitLab: Insufficient Type Check on GraphQL leading to Maintainer delete repository
Summary As you have know, Maintainer cannot delete/archive repository. But via GraphQL, they can do as there exists an sufficient check on GraphQL API app/graphql/mutations/snippets/destroy.rb ruby def resolveid: snippet = authorizedfind!id: id response = ::Snippets::DestroyService.newcurrentuser...
Starbucks: Thailand - IDOR on www.starbuckscardth.in.th: A logged in user could view any Thailand Starbucks card balance if they knew that Starbucks card number
nnez discovered that after a successful card balance transfer between two of their own registered Thailand Starbucks cards, they could update the 2nd card number URL parameter to another known Thailand Starbucks card number and view that 2nd card balance. @nnez — thank you for reporting this...
Node.js third-party modules: [flsaba] Stored XSS in the file and directory name when directories listing
I would like to report a Stored XSS in module "flsaba". It allows to inject malicious scripts in the file and directory name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module module name: https://www.npmjs.com/package/flsaba version: 1.1.0 npm...
Stripo Inc: [www.stripo.email] There is no rate limit for /it/contact-us/ endpoints
The speed limit for the https://stripo.email/it/contact-us endpoint has not been implemented...
Mail.ru: XSS on https://deti.mail.ru/
deti.mail.ru allowed to insert javascript: links into post content leading to self XSS possibility on message editing...
Starbucks: China - Open redirect at trackinghub.starbucks.com.cn
m82a1 discovered an open redirect at https://trackinghub.starbucks.com.cn/trackinstallation due to improper validation of the redirecturl parameter. @m82a1 — thank you for reporting this vulnerability...
Nextcloud: No set limit to try to login in "https://auth.nextcloud.com/auth/realms/master/protocol/openid-connect/auth" page.
Hi. I checked the "https://nextcloud.com" page, and try to go to wp-admin page. Then, I found the login page "https://auth.nextcloud.com/auth/realms/master/protocol/openid-connect/auth" In this page, I tried to login more than 10 times!manually I think that I can try to brute force to this login...
Mail.ru: Cross-Site Request Forgery (CSRF) in my.games API
CSRF vulnerability allowed to add/delete/edit store.my.games comments...
Stripo Inc: [www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header.
Summary In https://stripo.email/template-order I think you have implemented rate limiting via 429 status code for too many requests, but in reality it is not. An attacker could bypass the 429 speed limit by adding an X-Forwarded-For header. Steps To Reproduce 1. Go to the...
Shopify: Self XSS in Timeline
Copy the url javascript: XSS payload to any Timeline, then click url will trigger XSS. F796167 F796161 I previously reported a storefront url XSS at 841361, then admin copy the url to Timeline is possibly. Impact Self XSS...
U.S. Dept Of Defense: PulseSSL VPN Site with Compromised Creds @ ████
Dear US DoD, Back in 2019, I had reported that a pulseSSL VPN server owned by US DoD can be compromised by a publicly available exploit. The report is████████. As a result, the userid and passwd db was also compromised. I found that at least 1 userid and password combination from that compromised...
Semrush: Broken validation of user Id for JWT Token
Traffic Analytics Tool TA uses JWT tokens to store user subscription information without any kind of personal information. JWT tokens are created by passing a user ID. There was an error with validation of user Id for JWT token...
Mail.ru: [city-mobil.ru] SSRF & limited LFR on /taxiserv/photoeditor/save endpoint via base64 POST parameter
Vulnerability in photo editing functionality of https://city-mobil.ru/taxiserv/ allowed SSRF requests to internal services and local file read ability limited to image files. ¯\ツ/¯ I don't understand how I have missed it during fix validation of 748123 report. It's partly blind SSRF & LFR, which...