Slack: SSRF via Office file thumbnails

On August 12, 2019, a group of researchers reported an exploit path for a vulnerability in LibreOffice. Slack uses LibreOffice to process certain file types for preview. A specially crafted file uploaded to Slack could permit local file access and expose an internal Slack AWS credential for the...

Mail.ru: Avatar upload allows arbitrary file overwriting

Directory traversal via filename extension for avatar upload allowed to overwrite arbitrary files in S3-compatible bucket for static files in pandao.ru. Pandao.ru belongs to extended scope...

Mail.ru: [agent.33slona.ru] Recovery code bruteforce

It was possible to bruteforce mobile recovery code...

VK.com: Stored XSS вирус в al_video.php?act=a_choose_video_box

XSS в видео...

Mail.ru: Disable 2FA via CSRF (Leads to 2FA Bypass)

CSRF vulnerability in pandao.ru allowed to disable 2FA. pandao.ru belongs to extended scope...

Mail.ru: Settings page in https://support.my.com is vulnerable to clickjacking

Researcher found that settings page on support.my.com was vulnerable to clickjacking...

Mail.ru: [sso.33slona.ru] Application Messages Error stacktrace PHP.

Sensitive configuration information was disclosed via verbose stack trace in web application...

Mail.ru: Publicly Accessible Harshi Corp Consul

Consul interface was available from outside on one of my.com subdomains...

X (Formerly Twitter): protected Tweet settings overwritten by other settings

protected tweet settings will be disabled without the account owner's knowledge step for reproduction 1.Log in to an account with unprotected tweets on the Android app. 2. Log in to the same account on mobile.twitter.com and turn on protected tweets. 3. Confirm that the account's tweets are...

Kartpay: Being able to change account contents even after password change

Improper Handling of Sessions leads to this vulnerability where users can try to login with 2 different sessions in 2 different browsers. changing any data doesn't reflect all the logged-in sessions...

Phabricator: IDOR bug to See hidden slowvote of any user even when you dont have access right

USER ACCOUNT ============= 1. user A who create slowvote 2. User B Dont have permissioon to see above slowvote 3. User C has permission to see above slowvote STEP TO REPRODUCE ================== 1. From user A account goto http://phabricator.localhost.com/vote/create/ and create a slowvote . Chan...

LifeOmic: Improper signup & sign-in validation

Original Report from @zsbappa Summary: From the signup option I can able to signup differently using google and facebook account where i am using same email address. Description: I have account in facebook and gmailGoogle both. Both account i opened using same email account.When i goes to signup...

Kartpay: Error Page Content Spoofing or Text Injection [https://vpn.kartpay.com/]

VPN URL is accessible to the Public which is a misconfiguration of VPN Setup. So the Setup has been fixed and only internal network can access the VPN systems,...

Mail.ru: [auto.mail.ru] IDOR на редактирование поста любого юзера.

IDOR allowed to edit arbitrary posts in auto.mail.ru auto.mail.ru belongs to Extended scope IDOR на редактирование произвольного поста на сайте auto.mail.ru...

WordPress: Stored XSS Vulnerability

Hi there, I found a stored xss @ https://core.trac.wordpress.org/ Steps: 1. Go to https://core.trac.wordpress.org/ and login. open new private window and login with another account 2. Go to https://core.trac.wordpress.org/newticket and set a summary and description. 3. Select a Workflow Keyword a...

Semrush: SSRF In Get Video Contents

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: A SSRF In Get...

Radancy: Wrong link on corne.maximum.nl

Domain and URL: corne.maximum.nl Hello, I noticed that your subdomain corne.maximum.nl links to the website "maximum.com" instead of "maximum.nl" "maximum.com" is in control of a Chinese organization as you said in your description. I think you've made a little mistake, but there is no impact :...

Mail.ru: CSRF Vulnerability at https://aw.my.com/

CSRF vulnerability allowed to change userbar settings in https://aw.my.com/ https://aw.my.com/ belongs to Ext.B scope...

Kartpay: Bypass _token in forms [Merchant.Kartpay.com ]

Summary: I found a issue in froms related to the Merchant.Kartpay.com domain and it allow to bypassing token. Browsers Verified In: Firefox 68 Steps To Reproduce: 1. Go To Login or any form https://merchant.kartpay.com/merchantlogin 2. Fill form and Intercept in burpsuite next click on LOGIN 3...

HackerOne: Total bounties paid amount is disclosed because of redesign of the Program Profiles

Description: On July 2 Hackerone redesigned the Program Profiles.After the new program page design, I noticed that it is disclosing total bounties paid amount. For some program total bounties paid amount was hidden ████. It used to show like $4000 if the bounty was $3990.But after the redesign, i...