20626 matches found
Nextcloud: xss on setup config page
Nextcloud version: 18.0.1 In setup config page，setting mysql Username with payloadalert1, and set others. F739076 then submit . F739077 this gif will show poc: F739069 Impact This is because the code does not filter dangerous characters. so dangerous characters need to be escaped...
Razer: Helpdesk takeover (subdomain takeover) in razerzone.com domain via unclaimed Zendesk instance
The tester discovered a Razer subdomain subject to a takeover. Although we do not normally accept these as part of this program, Razer thanks the tester for his report...
MTN Group: Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-10271]
Summary Hello. I was able to identify RCE vulnerability due to the outdated Oracle Weblogic instance on https://raebilling.mtn.co.za. Steps To Reproduce To reproduce, launch this request with BurpSuite This request to the https://raebilling.mtn.co.za/wls-wsat/CoordinatorPortType will trigger slee...
Visma Public: HTML-injection in PDF-export leads to LFI
The researcher was able to extract contents of files using the pdf-generator in "Yearly Financial Statements". This was done by adding an IFRAME-tag inside the companyname. Once rendered in Yearly Financial Statements, it included the file the IFRAME was pointing to. In this POC it was /etc/passw...
Shopify: Exposed Slinky Instance Admin Panel
Last night the following server went from a 404 to a 200: ███████ Upon navigating to this page, I found that there was a slinky admin panel available here with the ability to change and modify URL redirection. https://slinky-server.shopifycloud.com/ Impact Ability to modify potentially trusted UR...
arfainternational.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1108642 Security Researcher geeknik Helped patch 8710 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting arfainternational.com...
X (Formerly Twitter): Periscope iOS app CSRF in follow action due to deeplink
Summary This issue is mainly in the Periscope iOS app against CSRF follow action using deeplink. as the report 583987 the CSRF work on iOS app POC 1 QR code to follow periscope profile pscp://user/periscopeco/follow ███████ POC2 by kunal94 /follow"CSRF DEMO video █████████ Impact CSRF Follow...
U.S. Dept Of Defense: phpinfo() disclosure info
hi security team i found subdoamins avalibale file phpinfo PoC:- https://█████████/phpinfo.php Impact An attacker can obtain information such as: •Exact PHP version. •Exact OS and its version. •Details of the PHP configuration. •Internal IP addresses. •Server environment variables. •Loaded PHP...
U.S. Dept Of Defense: [█████████] Administrative access to Oracle WebLogic Server using default credentials
Hello. I discovered an Oracle WebLogic Server and because of weak credentials managed to login as administrator, which led to complete server takeover...
Rockstar Games: DOM XSS on https://www.rockstargames.com/GTAOnline/feedback
In this report, the researcher identified a DOM-based Cross-Site Scripting vulnerability in the /GTAOnline/feedback endpoint. As we worked together on resolving this matter, the researcher helped us identify other parts of the GTA Online sub-site that suffered from the same vulnerability due to...
Mail.ru: OTP bypass on user account deletion
Account deletion procedure was not sufficiently protected against bruteforce and allowed icq.com account delition valid session to victim account was required...
Mail.ru: [aw.mail.ru] XSS on /quiztank page
Reflected XSS in aw.mail.ru via URI...
tofipneus.be Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1102559 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
xanitmedicaltourism.com Cross Site Scripting vulnerability
Security Researcher geeknik Helped patch 8562 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting xanitmedicaltourism.com website and its users. Following...
Code Injection in commenthol/safer-eval
Overview safer-eval is a safer approach for eval in node and browser. Affected versions of this package are vulnerable to Arbitrary Code Execution via generating a RangeError: Maximum call stack size exceeded. Proof of Concept Credit: Jonathan Leitschuh js const theFunction = function const f =...
Acronis: Accessing repository and other files by directory listing
It was reported that directory listing is possible on https://storage-repo.acronis.com. https://storage-repo.acronis.com is a YUM repository with no sensitive data and it is supposed to be publicly accessible...
Radancy: x-request-id header reflected in server response without sanitization
Domain and URL: maximum.nl Summary: When issuing a GET request to maximum.nl, its possible to set the x-request-id header which is then reflected in the server response without any sanitization. Description: An attacker can use this vulnerability to escalate to more advanced attacks such as CRLF...
Mail.ru: PHP code injection at tz.mail.ru
A chain of bugs involving unsafe usage of PHP unserialize led to possibility of code execution in tz.mail.ru...