Qulture.Rocks: Unrestricted File Upload in Chat Window

Summary: The application allows the attacker to upload dangerous file types that can be automatically processed within the product's environment. Steps To Reproduce: 1. Hit the browser with below URL. https://qa.qulture.rocks/en/users/signin 2. Open The Cat window. 3. Upload any exe file . 4. Cli...

BlockDev Sp. Z o.o: load scripts DOS vulnerability

load scripts DOS vulnerability...

Qulture.Rocks: Server Name disclosure

Hi, I found a Server Name disclosure Cowboy in the your web server's HTTP response! This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the Server! Request with Burp: GET / HTTP/1.1 Host: qa.qulture.rocks...

Node.js third-party modules: [logkitty] RCE via insecure command formatting

I would like to report a RCE issue in the logkitty module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: logkitty version: 0.7.0 npm page: https://www.npmjs.com/package/logkitty Module Description Display pretty Android and iOS logs without Android...

Mail.ru: o2.mail.ru XSS

Reflected XSS in o2.mail.ru via GET parameter state...

DigitalOcean: Unauthorized access to https://shipit.analogpond.com/

Summary: Unauthorized access to https://shipit.analogpond.com/digitalocean/marketplace/production/ with ability to rollback deploys just like digitalocean developers. Steps To Reproduce: I was doing recon when I came accross marketplace-fra1.digitalocean.com with CNAME...

Mail.ru: relap.io CSRF bypass on adding domain to use relap widgets

The lack of CSRF protection in API endpoint in relap.io allowed to force user to add domain to the widget...

Mail.ru: Stored XSS In mlbootcamp.ru

XSS in mlbootcamp.ru via forum post...

Mail.ru: xss in ub.icq.net

XSS in ub.icq.net via HTML file upload. icq.net is a sandbox API domain without cookies or HTTP authentication...

Mail.ru: mailgun subdomain takeover on "email.mail.geekbrains.ru"

Unused email.mail.geekbrains.ru domain was delegated to Mailgun and was not claimed, allowing to use it Mailgun service...

HackerOne: Read-only team members can read all properties of webhooks

Description: A team member can view all properties of webhooks despite not needing them. Steps To Reproduce 1. Have an admin of a program setup webhooks 2. As a team member read-onlylog in 3. Run the following graphql query: query teamhandle: "security" name webhooks nodes id secret url 4. See th...

Mail.ru: MCS Graphite SSRF: internal network access

Blind SSRF in mcs.mail.ru via unpatched Graphite...

Glassdoor: web.xml configuration file disclosure

Information disclosed via https://www.glassdoor.com/web.xml which has been resolved. Thanks, @stregh for your report and find. Looking forward to more reports from you. CVE-2021-34429 CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N...

HackerOne: A team member of the program with Report rights can ban the Admin

Summary: Our team has conducted a number of studies tests in the field of permission Report. We noticed that a team member of the program with such permission can ban a member with Admin rights Steps To Reproduce: 1 Admin submit new report in program 2 A team member with Report rights can use the...

cochainbound.com Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8562 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting cochainbound.com website and its users. Following...

Valve: Unauthorized updates to extended_info properties in /store/ajaxpackagesave

Due to incorrectly-implemented access control, partners were able to set the "extendedinfo" value on their own packages. This in turn enabled other security-impacting issues such as the ability to create externally-grantable and other special package types...

HackerOne H1P BBP1: Testing

asdajnsdjasndkjas...

Mail.ru: [staging.tarantool.org] Github Pages Subdomain-take-over

Unused staging.tarantool.org subdomain was delegated to github pages and was not claimed...

curl: curl still vulnerable to SMB access smuggling via FILE URL on Windows

Summary: The released fix for CVE-2019-15601, SMB access smuggling via FILE URL on Windows, leaves curl still vulnerable to SMB access smuggling via FILE URLs. - FILE URLs formatted as file:////smbserver/smbshare/file are not filtered. - FILE URLs which point to the global DOS name space, ??, and...

Visma Public: Access control on https://eaccounting.stage.vismaonline.com/

The researcher was able to find an access control issue in the application by checking if the permissions are correctly replicated in the active sessions for the user...