Clario: Reflected XSS on stage.mackeeper.com

Summary RXSS on https://stage.mackeeper.com/ , the vulnerable parameter is guid. Step to reproduce Visit the following link:...

Mail.ru: An implementation flaw in Mail.ru can be exploited for DKIM signature spoofing and email spoofing

Domain, site, application -- https://e.mail.ru Quick note: this report is different from my previous report Report 727233 , and is not policy configuration or enforcement issue as well. TL;DR --------- This report disclosure an implementation bug, which chains multiple features in the Mail.ru...

MobiSystems Ltd.: Firebase Firestore insecure database

Summary: The app is exposing a firebase database url that has no read/write protections. Steps To Reproduce: 1. Decompile the Android app 2. Do a string search for firebasedatabase 3. Use the project name i.e. msdict-dev in combination with the Firestore REST API to modify the database. Supportin...

Clario: CRLF Injection - http://stage-static-cdn.mackeeper.com/

Summary CRLF Injection - http://stage-static-cdn.mackeeper.com/ Steps To Reproduce In the rawRequest we have added '%0D%0Avirus:%20value' In Burp Repeater copy and paste the below rawRequest Notice the response with header added ------rawRequest---------- GET /%0D%0Avirus:%20value HTTP/1.1...

U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] CVE-2018-2879 (padding oracle attack in the Oracle Access Manager) at https://█████████

Description We were able to identify CVE-2018-2879 in Oracle Access Manager, used on the https://██████ Link to the CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-2879 This vulnerability is rated critical, and may allow unauthenticated attacker with network access via HTTP to compromise Oracle...

Mail.ru: [pandao.ru] possibility to attach arbitrary phone number to account registered via social network

It was possible to attach an arbitrary unregistered phone number to account registered via different id e.g. social network id. This behavior can prevent user from registering with his phone number and facilitate phishing attack if victim attempts to login by phone number...

VK.com: Мини-уязвимость в обработке ссылок

Проблема с парсингом ссылок. В 2013 существовал баг, который позволял при нажатии на лайк к записи перенаправить пользователя по ссылке. Необходимо было закодировать любую ссылку в HTML-мнемонику типа & ; и после публикации разметка у поста сразу ломалась. Тогда эту, со стороны безобидную, дырку...

Mail.ru: unauthorized access to add admin endpoint

Access to static page within media-poll.mail.ru admin interface was not restricted. Access to static page does not grant attacker the ability to perform any actions or access any sensitive information...

Mail.ru: Account Takeover at worki.ru

One time code reuse between registration and authentication in combination with insufficient bruterofce protection allowed account access via verification code bruteforce for worki.ru. Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

Uber: Change the rating of any trip, therefore change the average driver rating

The endpoint used for rating the driver did not validate correctly if the trip corresponded to one made per user logged in, therefore knowing the tripUUID, driverUUID and userId made it possible to change the rating of any trip. Attack scenario: a bad driver with poor ratings and programming skil...

Imgur: De-anonymization Attack: Cross Site Information Leakage

Dear Imgur Security Team, We are researchers at the IMDEA Software Institute in Madrid, Spain. We have been working on analyzing Cross-Site Browser Leaks xsleaks and building a tool for finding instances of it on target web sites. Recently we tested imgur.com and discovered a flaw that can affect...

U.S. Dept Of Defense: [HTAF4-213] [Pre-submission] HTTPOnly session cookie exposure on the /csstest endpoint

The HTAF4-213 vulnerability involved the exposure of an HTTPOnly session cookie on the /csstest endpoint. The sensitive cookie information was reflected in the page's content, which should not have been accessible in the DOM...

Nextcloud: Bypass configured 2FA provider with another provider that can be set up at login

In Nextcloud 17 there is the possibility to set up 2FA providers at login. A missing check allows the following steps 1 Enforce 2FA for all users 2 As a user, configure a 2FA provider via settings or at login 3 Log out 4 Log in again password only 5 When prompted with the earlier set up provider,...

Mail.ru: [iot-hackathon.geekbrains.ru] Tilda Subdomain Takeover

iot-hackathon.geekbrains.ru subdomain was delegated to tilda.cc service, which is vulnerable to takeover...

Nextcloud: Docker image with FPM is vulnerable to CVE-2019-11043

The CVE-2019-11043 vulnerability can be exploited in the latest nextcloud:fpm image. This is due to the specific nginx configuration recommended for nextcloud: https://github.com/nextcloud/dockerbase-version---fpm...

curl: curl successfully matches IP address literal in URL against IP address literal in certificate Common Name

Summary: A user may invoke the curl command line utility with an IP address literal in the URL, such as https://192.168.124.2/... If the HTTPS server presents a certificate whose Common Name matches this IP address literal as a string that is, Common Name is the ASCII string 192.168.124.2, then...

Mail.ru: [dobro.city-mobil.ru] Недостаточная аутентификация (доступ к панели администратора)

Authentication bypass for admin interface access on dobro.city-mobil.ru the report was submitted before the launch of dedicated bug bounty scope for Citymobil...

QIWI: какой-то исходный код в корне сайта

Можно было просматривать часть исходных файлов хоста. Нашел этот файл, в нем PHP код. adminer.php.swp F607459 https://shop.tochka.com/%2eadminer%2ephp%2eswp...

separation.training.nij.gov Open Redirect vulnerability

...

X (Formerly Twitter): http request smuggling in pscp.tv and periscope.tv

Description: the Description of HTTP request smuggling attacks : here seems that many subdomains in pscp.tv and periscope.tv vulenrable 1-Detect HTTP request smuggling attack 504 response with delay 30 s, 60s "DoS" POC & Steps To Reproduce: in this video F606648 Resource:...