Snapchat: Exposed Kubernetes API - RCE/Exposed Creds

@txt3rob found one of Snaps internal Kubernetes instances exposing an API endpoint without authorization to the public. With access to this API he was able to run arbitrary code/jobs as a cluster-admin and gained access to credentials with internal access to a significant number of instances...

varnafarmerscoop.com XSS vulnerability

Open Bug Bounty ID: OBB-707088 Description| Value ---|--- Affected Website:| varnafarmerscoop.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

muslimpro.com XSS vulnerability

Open Bug Bounty ID: OBB-706608 Description| Value ---|--- Affected Website:| muslimpro.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

margueritaelementary.org XSS vulnerability

Open Bug Bounty ID: OBB-705612 Description| Value ---|--- Affected Website:| margueritaelementary.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

HackerOne: Inline banner on Report page discloses whether organization runs a private program

Summary: Hi team , @jobert Description: Your engineers have created inscription - You are participating in a private program for ████████. Please do not publicly discuss the program until the program goes public. When a hacker creates a report in an external program with a private page, we will s...

VK.com: Уязвимый класс WebView

Activity issue. Opening of webview that may lead to phishing attacks...

Mail.ru: ОДМИН ТЭСТ

Test script on jw-cn-test-1.ext.terrhq.ru could be used to disclosure local database account. Database itself was not accessible...

viridea.it XSS vulnerability

Open Bug Bounty ID: OBB-704612 Description| Value ---|--- Affected Website:| viridea.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

Mail.ru: source code leak

A fragment of source code was available for download on flash.terrhq.ru...

neverstop.com XSS vulnerability

Open Bug Bounty ID: OBB-704347 Description| Value ---|--- Affected Website:| neverstop.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

tablet-appli.com XSS vulnerability

Open Bug Bounty ID: OBB-703825 Description| Value ---|--- Affected Website:| tablet-appli.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

gladyspalmera.com XSS vulnerability

Open Bug Bounty ID: OBB-703669 Description| Value ---|--- Affected Website:| gladyspalmera.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidde...

Mail.ru: xss

XSS was reported for bb.cdn.gmru.net domain. This domain is considered sandbox with no security impact for XSS, but same XSS also existed in bb.mail.ru subdomain...

actu-mag.fr XSS vulnerability

Open Bug Bounty ID: OBB-703436 Description| Value ---|--- Affected Website:| actu-mag.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unti...

settediottica.it XSS vulnerability

Open Bug Bounty ID: OBB-703283 Description| Value ---|--- Affected Website:| settediottica.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Infogram: Is the 504 Gateway Time-out error ok?

Link: https://infogram.com/api/merge/auth/google/?redirectto=123&token=gulHMyL6-1H0Am4zXa4H7j0DWomPdnKPhZOk&redirectto=123 it gives 504 after a long time! Is it normal? It can be used for DOS! I use two redirectto= if I use just one redirectto= it gives the response fastly!...

sputniknews.lt XSS vulnerability

Open Bug Bounty ID: OBB-703192 Description| Value ---|--- Affected Website:| sputniknews.lt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Mail.ru: XXE крит

XXE injection in partner service with delegated my.com subdomain...

Ruby: Null character at fnmatch

I confirmed that it will behave unintentionally when null characters are entered in patterns with fnmatch, fnmatch? . log $ ruby -v ruby 2.5.3p105 2018-10-18 revision 65156 x8664-darwin16 $ irb irbmain:001:0 require 'pathname' = true should not be true irbmain:002:0 File.fnmatch"x\0yz", 'x' = tru...

bananafrita.com.br XSS vulnerability

Open Bug Bounty ID: OBB-701995 Description| Value ---|--- Affected Website:| bananafrita.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...