20626 matches found
Trint Ltd: IDOR to update folder name of other user
Summary There is an IDOR to update folder name of other user Steps To Reproduce: - user A login to the application and see the folder name F494331 - user B login to the application and call the API with the projectId of user A POST / HTTP/1.1 Host: graphql2.trint.com User-Agent: Mozilla/5.0 Windo...
Node.js third-party modules: [http_server] Stored XSS in the filename when directories listing
I would like to report Stored XSS in module "httpserver". It allows to inject malicious scripts in the file name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module - module name: httpserver - version: 1.0.12 - npm page:...
U.S. Dept Of Defense: MSSQL injection via param Customwho in https://█████/News/Transcripts/Search/Sort/ and WAF bypass
Summary: MSSQL injection via param Customwho in https://███████/News/Transcripts/Search/Sort/ Description: MSSQL injection via param Customwho in https://██████████/News/Transcripts/Search/Sort/ There is WAF, but we can make bypass and via global variable @@LANGID we can know that the base is use...
Valve: ISteamAssets gives partners control over unrelated community market transactions
ISteamAssets APIs would check that the key parameter used was a partner key with access to the appid specified, but then would ignore the passed in appid and would operate on app 753 regardless. This allowed anyone with a partner key to make changes to Steam economy items, like trading cards, and...
X (Formerly Twitter): Reports Modal in app.mopub.com Disclose by any user
Summary: I sent this report and closed it "Informative" and asked me to send a new report if more information was available for exploitation 544278 Description: Twitter allows "mopub" users to create reports, and each report gives a unique ID to reach it, The report information is displayed by...
Pornhub: SSRF and local file disclosure by video upload on http://www.youporn.com/
The researcher was successful in exploiting a vulnerability in 3rd encoding party library resulting in the execution of SSRF attacks and Local File Disclosure...
Starbucks: Subdomain takeover of mydailydev.starbucks.com
A subdomain of starbucks.com had a CNAME record pointing to an Azure Traffic Manager profile that @0xpatrik was able to claim...
Node.js third-party modules: [min-http-server] Stored XSS in the filename when directories listing
I would like to report Stored XSS in module "min-http-server". It allows to inject malicious scripts in the file name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module module name: min-http-server version: 1.0.6 npm page:...
Node.js third-party modules: [http-file-server] List any files and sub folders in the folder by using path traversal.
I would like to report Path Traversal in http-file-server. It allows to list any files and sub folders in another folder of web root. Module module name: http-file-server version: 0.2.6 npm page: https://www.npmjs.com/package/http-file-server Vulnerability Vulnerability Description http-file-serv...
Node.js third-party modules: [min-http-server] List any file in the folder by using path traversal.
I would like to report Path Traversal in min-http-server. It allows to list any file in another folder of web root. Module module name: min-http-server version: 1.0.6 npm page: https://www.npmjs.com/package/min-http-server Module Description 'min-http-server' is a zero-configuration, lightweight...
Automattic: No rate limit on app.crowdsignal.com (Finish quiz)
Hello team https://hackerone.com/reports/488923 -- vulnerability resolved maybe you can compare the report to start this, but this vulnerability has been closed.this is a separate no-rate limit error.this is not a duplicate bug. No rate limit on app.crowdsignal.com Finis quiz POC step:...
Nextcloud: W3 Total Cache plugin multiple vulnerabilities
W3 Total Cache plugin version = 0.9.4.1 on the https://nextcloud.com has multiple vulnerabilities. See the screenshot.png Impact Remote Command Execution, Unauthenticated Security Token Bypass, Unauthenticated Arbitrary File Read etc...
Nextcloud: External Storage - WebDAV - New user has access to storage from deleted user (same user-ID)
Delete existing user account "user3" Create new user account "user3" Also reported on https://github.com/nextcloud/server/issues/15258 Impact Newly created user with same user-id of a deleted user has access to the configured external webdav storage from the deleted user...
GitLab: Clientside resource Exhausting by exploiting gitlab math rendering
Summary based on the documentation gitlab markdown is supporting math expresion rendering using KaTex and able to run subset syntax from LaTex this could be achieved by using 2 ways in the markdown for inline and for multiline. F476662 Steps to reproduce Step-by-step guide to reproduce the issue,...
Khan Academy: Users can make accounts with a fake email address.
A valid email address is not required to create a Khan Academy account. We do not consider this a security vulnerability...
ok.ru: [okl.lt] Раскрытие администраторских функций в .js + Возможность использования этих функций.
@iframe reported insufficient authorization at okl.lt which allowed regular users to perform actions intended to be accessible to administrators only. This vulnerability was aggravated by the fact that administrators-only API could be reversed-engineered from the HTML code...
Mail.ru: Stored xss on message reply
XSS on message reply via double click functionality in web.icq.com...
curl: Github wikis are editable by anyone #Githubwikistakeover
Hey Curl, Github wiki on the following project, https://github.com/curl/curl/wiki can be edited by any logged in user in the system. This poses security and reputation risk for the company. As your policy i doesnot edited any of the wiki :- Regards, @MSRC29 Impact As wikis listed above can be...
Ubiquiti Inc.: Privilege Escalation From user to SYSTEM via unauthenticated command execution
The vulnerability, or feature depending how you look at it, is the ability to execute commands using the evostream API interface that is exposed on localhost:7440. Since the evostream service is running as SYSTEM a user can use the launchprocess command,...