h1-ctf: [h1-415 2020] Spent a week and failed at solving the last step.

Summary: I found something interesting with Headless chrome debugging in the last step, I am sure I am going to solve this after trying very hard for about a week, I don't know when this CTF is going to end, that's why I am submitting a summary of how to solve this so that I can write the full...

h1-ctf: [h1-415 2020] I found Joberts missing file!

The key is: h1ctfy3s1mc0sm1cn0w My writeup is available unpublished at: https://p4fg.github.io/h14152020/ I might edit some styling but the main contents is there. The twist of my writeup is that tried to give a detailed account of EVERYTHING to allow new hackers to follow along my discoveries an...

Valve: Hidden scheduled partner events are propagated to Steam clients in CMsgClientClanState

PartnerEvent details were propagated to Steam clients immediately upon creation, which could lead to improper exposure of hidden/scheduled event data...

feijoadasimulator.top Cross Site Scripting vulnerability

Security Researcher Zian Helped patch 2 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting feijoadasimulator.top website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug...

BlockDev Sp. Z o.o: xmlrpc.php FILE IS enable it will used for Bruteforce attack

xmlrpc.php FILE IS enable it will used for Bruteforce attack...

BlockDev Sp. Z o.o: DoS of https://blog.makerdao.com/ via CVE-2018-6389

DoS of https://blog.makerdao.com/ via CVE-2018-6389...

h1-ctf: [h1-415 2020] I got the flag

Hey guys, The flag is: h1ctfy3s1mc0sm1cn0w I'll submit a well written writeup later today or tomorrow. I now have a lot of work to catch up thanks to this devilish ctf hehehe. Thanks Ben and the rest of the team for this awesome challenge. Impact Getting the flag...

h1-ctf: [h1-415 2020] Solution for h1415's CTF challenge

Summary: I have just solved the challenge, write-up will follow shortly. Impact Flag: h1ctfy3s1mc0sm1cn0w...

curl: Division by zero if terminal width is 2

Summary: In fly there will be a division by zero if progress bar width is 2. That can happen if terminal width is 2. Steps To Reproduce: This script crash: stty rows 10 cols 2 ; curl --progress-bar somefile temp Impact I believe that if it's possible to set terminal width for a service, then that...

8x8: xmlrpc.php file enabled

Wordpress instance with xmlrpc module enabled...

Mail.ru: Account TakeOver at my.33slona.ru

Logon via SMS code validation was not sufficiently protected against bruteforce in my.33slona.ru Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

Mail.ru: [c-api.city-mobil.ru] Client authentication bypass leads to information disclosure

API endpoint at c-api.city-mobil.ru allowed access to subset of order and client related information without proper authorization Broken authentication in the client API allowed retrieving sensitive information about clients: finished trips w/o departure and destination points, payments type,...

DRIVE.NET, Inc.: Same site Scripting

Same site scripting I have found an error of some misconfigured DNS in a subdomain of yours which causes same site scripting. PoC 1 Open a terminal and type ping localhost.drive2.ru You would see that it resolves back to 127.0.0.1 A screenshot has been attached Impact This may cause security issu...

yellownepal.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1065107 Security Researcher geeknik Helped patch 8924 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting yellownepal.com website an...

Semrush: An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business loss

Hi there, When we Summary: When someone goes to https://www.semrush.com/marketplace/offers/ and orders for articles, an attacker can pay for less than intended due to negative quantities being allowed. Steps To Reproduce: - Go to https://www.semrush.com/marketplace/offers/ - Click on 500 Words$40...

Mail.ru: Insecure storage of private files

"Send to myself" activity of Mail.ru Mail application for Android could be locally manipulated via external content provider to access the files in application folder...

Mail.ru: XSS на сайте https://warofdragons.my.games/.

Reflected XSS via GET parameter in https://warofdragons.my.games...

Mail.ru: Ability to find out the name of the database table and its columns

Verbose errors were not disabled on api.iconjob.co An attacker can learn the name of a database table and its columns from an error message. This can help implement other SQL injection type attacks...

pixiv: XSS reflected on [https://www.pixiv.net]

Summary: I found a xss reflected on https://www.pixiv.com URL and in the search bottom from Chrome IOS 13.1 Steps To Reproduce: 1. In the URL https://www.pixiv.net/en/%5B'-alertdocument.cookie-'%5D Add Payload '-confirm3-' 1. In the URL https://www.pixiv.net/en/%5B'-alertdocument.cookie-'%5D Add...

Genasys Technologies: Missing redaction on a disclosed report

Hi team, I wasn't sure if this worth a report, but I thought that you should be aware and HackerOne's support referred me to submit a report. I ran into a diclosed report where the reporter asked to redact his email but we can still extract his email and more info about his google account from th...