20626 matches found
Basecamp: CSRF on launchpad.37signals.com OAuth2 authorization endpoint
Hi, I found a CSRF in the OAuth2 authorization endpoint on launchpad.37signals.com. That allows a malicious 3rd party application to gain full API access to victim's account in 37signals products that uses OAuth2 authorization. I found that when making a post request to authorization endpoint it...
streakwave.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1141678 Security Researcher Teamhash Helped patch 330 vulnerabilities Received 3 Coordinated Disclosure badges Received 2 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting streakwave.com website and...
subscriptions.ezinearticles.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1141659 Security Researcher ELProfesor Helped patch 2791 vulnerabilities Received 8 Coordinated Disclosure badges Received 106 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting...
Mail.ru: XSS in [community.my.games]
Crossite scripting in community.my.games via post comments All we say is Thank You for an Account Takeover Flaw!...
Mail.ru: XSS at go.mail.ru
DOM-based self XSS in go.mail.ru social search functionality...
BTFS: xss on bittorrent.com
hi team i realized xss bug on headers.php. https://www.bittorrent.com/scripts/site/headers.php?=1586521900793&callback= https://www.bittorrent.com/scripts/social/gettweet.php?=1586521900791&callback= its works on IE browsers. Impact fix them...
BTFS: XSS on remote.bittorrent.com
Hi security team, ı found xss on your subdomain. this is includes callback function. url : https://remote.bittorrent.com/talon/logout?message= Impact fix them...
BlockDev Sp. Z o.o: Blind SSRF at https://chat.makerdao.com/account/profile
Blind SSRF at https://chat.makerdao.com/account/profile...
8x8: Outdated Coturn is vulnerable to known vulnerabilities (High)
Jitsi had several CoTurn servers that needed improvements to their access configurations and updated...
Rocket.Chat: account takeover on 3.0.1 version
I find user reset password hash info and other security info on "/api/v1/users.info" note : I login on rocketchat with ldap account my role : user note: in request "https://target/api/v1/users.info?username=xhttps://target/api/v1/users.info?username=%5Bx%5D" you should change usrname to userId 1-...
Node.js third-party modules: Prototype pollution attack (lodash)
I would like to report a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype. Module module name: lodash version: 4.17.15 npm page: https://www.npmjs.com/package/lodash Module Description A modern JavaScript utility library delivering...
U.S. Dept Of Defense: CSRF Account Deletion on ███ Website
Summary: A CSRF vulnerability against the ███████ allows attackers to delete user accounts. Impact Users who visit a malicious website could find their ████████ account deleted. Step-by-step Reproduction Instructions 1. Create and login to a new account on the ██████ 2. Open the provided HTML fil...
DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Security Configurability - The user's can set an existing password as a new password.
An application is allowing user to set new password same as that of the old password. Passwords are entirely user's responsibility but As the old password may be exposed to other users, depending on the security password policy application, it should not be possible to set a new password value...
DRIVE.NET, Inc.: [www.drive2.ru] There is no rate limit for comments endpoints.
The "add comment" endpoint was improperly rate-limited so the potential attacker could post a large number of comments, overloading the server and the notification system. Summary The add comment endpoint was improperly rate-limited so the potential attacker could post a large number of comments,...
Clario: Information disclosure of Internal php files on [mackeeper.com/blog/api/send-event]
Summary Vulnerable URL: https://mackeeper.com/blog/api/send-event contains service information Steps To Reproduce Step-1: Go to https://mackeeper.com/blog/api/send-event you will get MethodNotAllowedHttpException and different PHP files error info Step-2: After that, I have a change method to POS...
LY Corporation: Blind SSRF in social-plugins.line.me
LINE Social Plugins https://social-plugins.line.me/ is a service that provides LINE users with content sharing on the web. This Blind SSRF attack was caused by bypassing the DNS verification of the parameter value received. It could have made requests to internal servers or scanned internal netwo...
Mail.ru: Stored xss on https://go.mail.ru/
Reflected XSS via GET parameter in go.mail.ru...
Open-Xchange: Buffer over-reads in i_stream_zlib_read
This can be reproduced by a sample program using libcompression int mainint argc, char argv const unsigned char datadec; sizet sizedec; const uint8t data = argv1; sizet size = strlendata; struct istream testinput = testistreamcreatedatadata, size; const struct compressionhandler handler =...