Yelp: DoS of https://blog.yelp.com/ and other WP instances via CVE-2018-6389

Description: There is possibility in /wp-admin/load-scripts.php script to generate large 3Mb amount of data via simple non-authenticated request to server. The vulnerability is registered as https://vulners.com/cve/CVE-2018-6389 Details: Detailed attack scenario is described for example here:...

es.autosonshow.tv Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1031127 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Polymail, Inc.: XSPA on API service endpoint

Batch endpoint on the api was vulnerable to XSPA due to incorrect validation of url parameter in the request body...

Mail.ru: [city-mobil.ru/taxiserv/] IDOR leads to driver account takeover

IDOR vulnerability allowed partner account with manager role to takeover driver's accounts belonging to different partner...

Mail.ru: relap.io IDOR

IDOR vulnerability in relap.io allowed to disclosure attributes of arbitrary site...

Mail.ru: SSRF & LFR on city-mobil.ru

SSRF/LFR vulnerability via photo upload functionality of partner's cabinet of city-mobil.ru...

Mail.ru: SSRF & LFR via on city-mobil.ru

SSRF/LFR vulnerability via photo editor functionality of partner's cabinet of city-mobil.ru...

BlockDev Sp. Z o.o: xmlrpc.php file is enable it will used for (Denial of Service) and bruteforce attack

xmlrpc.php file is enable it will used for Denial of Service and bruteforce attack...

Mail.ru: [https://city-mobil.ru/taxiserv] IDOR leads to information disclosure

IDOR vulnerability for orders report allowed partner's superuser account to access information related to different partners...

LY Corporation: SSRF on music.line.me through getXML.php

The reporter found an endpoint through which limited SSRF could be achieved. It was only possible to issue GET requests served over HTTPS. LFI was not possible. The maximum impact found for this issue was minor service disruption and/or limited information leakage...

Mail.ru: Account Takeover worki.ru

worki.ru had no sufficient protection against SMS code bruteforce...

Mail.ru: IDOR of users

IDOR vulnerability in worki.ru API allowed to request information on job seekers / employers without imposed limits...

U.S. Dept Of Defense: idor on upload profile functionality

Vulnerable URL: https://██████████/███████ID/Common/EditOne/Person/accountid steps to reproduce: 1.browse the image and click on the upload button 2.capture this request in burp suite 3. change the value 'personId' parameter to account2 accountid please see screenshot1 4.then goes to account2, th...

Mail.ru: allods.mail.ru sql injection

SQL injection in allods.mail.ru due to insecure use of externally controlled GET parameter...

Mail.ru: [https://seosan.io] Account owner disclosure

seosan.io could unintentionally disclosure account owner name by e-mail during access recovery procedure. seosan.io has reached it's end of life and is not longer available...

Stripo Inc: subdomain takeover at status0.stripo.email

Hi , The subdomain status0.stripo.email was pointed at uptimerobot.com whereas it was not being used , but having Cname record as stats.uptimerobot.com . Hence anyone can takeover it. I have parked it with atest account on uptimerobot.com F634639 F634636 thanks Impact Anyone can use this subdomai...

Clario: Account verification bypass on translate.kromtech.com

Account verification bypass on translate.kromtech.com Summary: An account could be registered on translate.kromtech.com but the functionality returns "Access denied or Your user wasn't activated yet. ". But it's implemented in a strange way, every time we make a request that requires user to be...

LY Corporation: DOM-based XSS on mobile.line.me

The reporter found a DOM-based XSS affecting mobile.line.me, which could have resulted in an attacker gaining access to information about a user's mobile plans, usage and user details registered as part of their mobile subscription plan...

Node.js: HTTP request smuggling using malformed Transfer-Encoding header

Please see the attached PDF for a writeup of this vulnerability. Impact Please see the attached PDF for a writeup of this vulnerability...

Rocket.Chat: Account takeover via XSS

Summary: By combining AutoLinker and Markdown an attacker is able to inject malicious scripts. Description: By combining AutoLinker and Markdown we can trick the parser into breaking out of the current HTML attribute. https://a?p= results in: html ." target="blank" rel="noopener noreferrer" "...