20626 matches found
X (Formerly Twitter): IDOR and statistics leakage in Orders
Description: Twitter on its service "MoPub" statistics dedicated to the results of "Order", after the test shows that the endpoint "https://app.mopub.com/web-client/api/orders/stats/query" is infected with a "IDOR " bug Which led to the leak of private statistics "Orders" by another users Steps T...
Monero: Excessive Resource Usage
Summary: Unbounded resource usage due to open one file descriptor per connection, Python script below is effectively a threadbomb on the destination and uses all available memory on the server, clients not sending anything are never terminated. Steps To Reproduce: Up our daemon % monerod Check if...
Dropbox: Algorithmic complexity vulnerability in ZXCVBN leads to remote denial of service attack
@davidrenardy discovered that the ZXCVBN algorithm is quadratic in time complexity, which implies that the user can submit an arbitrarily long password to the library, leading to a potential denial of service attack if performed at scale. Given how ZXCVBN is used at Dropbox, we accept the Denial ...
Revive Adserver: Deserialization of Untrusted Data in www/delivery/dxmlrpc.php
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize call on the first parameter in the "pluginExecute" RPC method. Impact Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP...
Mail.ru: [geekbrains.ru] CVE-2019-5418 Ruby on Rails File Content Disclosure
Unpatched CVE-2019-3396 in geekbrains.ru...
Starbucks: Reflected XSS on card.starbucks.com.sg/unsubRevert.php via the 'ct' Parameter
gnux discovered a reflected XSS in https://card.starbucks.com.sg/unsubRevert.php due to an unsanitized user-input via the ct parameter. @gnux— thank you for reporting this vulnerability and confirming the resolution...
Starbucks: Reflected XSS on card.starbucks.com.sg/unsub.php via the 'ct' Parameter
gnux discovered a reflected XSS in https://card.starbucks.com.sg/unsub.php due to an unsanitized user-input via the ct parameter. @gnux— thank you for reporting this vulnerability and confirming the resolution...
Automattic: Wordpress VIP leaks email of the test a/c
i was testing learn.fb.com and i came to known that its wp-json is open and when i saw all the routes of the websites than i got to known that one end-point is leaking their internal email address the endpoint is as follow https://learn.fb.com/wp-json/th/v1/usergeneration The issue has been fixed...
Uber: Pre-auth Remote Code Execution on multiple Uber SSL VPN servers
format string vulnerability on /sslmgr with no authentication required Details: http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html...
Open-Xchange: Another Stored XSS in mail app using Drive app
Vulnerability Details: When replying to a HTML E-Mail with specific payload, that payload could be executed as script code. The user would have to have HTML composing enabled to exploit this vulnerability. This vulnerability could happen as browsers incorrectly "fix" HTML content as demonstrated ...
HackerOne: Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint
Summary: At this moment, the two new upcoming CTF levels for https://ctf.hacker101.com/ctf have not been revealed. However, an IDOR at the https://ctf.hacker101.com/group/user/ID1?user=USERID endpoint reveals them see attached screenshot Description: Steps To Reproduce 1. Create a group. 2. At th...
Starbucks: Store Development Resource Center was vulnerable to a Remote Code Execution - Unauthenticated Remote Command Injection (CVE-2019-0604)
l00ph0le discovered an endpoint on the Store Development Resource Center site at https://sdrc.starbucks.com/layouts/15/picker.aspx was vulnerable to a deserialization RCE in Microsoft Sharepoint per CVE-2019-0604. @l00ph0le — thank you for reporting this vulnerability, your patience while we...
Lob: No Access Control
There is "No Access Control" vulnerability identified in "lob-assets.com" on Invoice section. Steps To Reproduce: Go to...
Coda: Lack or Origin check leads to Cross-Site Websocket Hijacking (CSWSH)
Summary @fisher discovered a CSRF-related vulnerability in Coda docs by which an attacked could craft a convincing page that would make modifications to a specific document without the victim knowing. This is due to the inherent nature of Websockets not being secure by default. Although a...
pixiv: CSRF at https://chatstory.pixiv.net/imported
Summary: A CSRF in https://chatstory.pixiv.net/imported can trick users to import a novel of the attacker as the users' chatstory. Steps To Reproduce: 1. Attacker creates a novel 2. Go to the novel https://www.pixiv.net/novel/show.php?id=10997105 Import the novel as chatstory by clicking the...
Mail.ru: Web Cache Poisoning
Reverse proxy cache poisoning via host header content could lead to stored XSS in uxui.geekbrains.ru...
Node.js third-party modules: Server Side JavaScript Code Injection
I would like to report a Service Side JavaScript Code Injection in fastify. It allows an attacker that can control a single property name in the serialization schema to achieve Remote Command Execution in the context of the web server. Module module name: fastify version: 2.2.0 npm page:...
VK.com: Information Disclosure (phpinfo())
Out-of-scope...
Starbucks: Reflected XSS in https://www.starbucks.com/account/create/redeem/MCP131XSR via xtl_amount, xtl_coupon_code, xtl_amount_type parameters
HI, Summary: Reflected XSS Description: the parameters are complementary to each other Platforms Affected: my browser firefox 52.7.3 Steps To Reproduce: 1. go to https://www.starbucks.com/account/create/redeem/MCP131XSR?xtlcouponcode=1&xtlcouponcode=81431&xtlamount=0.0&xtlamounttype=DOLLARVALUE 1...