GitLab: SSRF in CI after first run

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: During the first run, the CI...

VK.com: Просмотр записей пользователя, который тебя заблокировал

Отсутствовали проверки черного списка в одном из действий при работе с записями пользователя...

maintenanceportnew.info XSS vulnerability

Open Bug Bounty ID: OBB-633563 Description| Value ---|--- Affected Website:| maintenanceportnew.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Reverb.com: Basic auth details is still work on report ( 351555 )

Hi , Seem report 351555 is not full fixed where 434762629765715:PQlkrSHPqqjhIBc0MmUkdjcqpps basic auth details are Still work on login Poc : https://api.cloudinary.com/v11/reverb/usage F309894 Impact information Disclose...

tipsport.sk XSS vulnerability

Open Bug Bounty ID: OBB-633123 Description| Value ---|--- Affected Website:| tipsport.sk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

cepnet.de XSS vulnerability

Open Bug Bounty ID: OBB-632995 Description| Value ---|--- Affected Website:| cepnet.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Starbucks: PHPinfo page

GET /test.php HTTP/1.1 Host: 52.90.193.152 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.21 KHTML, like Gecko Chrome/41.0.2228.0 Safari/537.21 Accept: / Impact This file may expose sensitive information that may help an maliciou...

gofreebies.com XSS vulnerability

Open Bug Bounty ID: OBB-632962 Description| Value ---|--- Affected Website:| gofreebies.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

VK.com: Уязвимость в методе auth.restore

Недостаточные проверки при восстановлении страницы...

elotouch.com.cn XSS vulnerability

Open Bug Bounty ID: OBB-631883 Description| Value ---|--- Affected Website:| elotouch.com.cn Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Mail.ru: Stealing Arbitrary Private Files of MyMail App

It was possible for local malware application to steal sensitive local files of MyMail / Mail.Ru Mail application due to specifics of file:// schema URI handling in SharingActivity...

Mail.ru: SQL injection on jd.mail.ru

SQL injection via POST parameter in user registration at jd.mail.ru. die ███████████████████████████ ███████▀▀▀░░░░░░░▀▀▀███████ ████▀░░░░░░░░░░░░░░░░░▀████ ███│░░░░░░░░░░░░░░░░░░░│███ ██▌│░░░░░░░░░░░░░░░░░░░│▐██ ██░└┐░░░░░░░░░░░░░░░░░┌┘░██ ██░░└┐░░░░░░░░░░░░░░░┌┘░░██ ██░░┌┘▄▄▄▄▄░░░░░▄▄▄▄▄└┐░░██...

anbtx.com XSS vulnerability

Open Bug Bounty ID: OBB-630280 Description| Value ---|--- Affected Website:| anbtx.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

freelance-info.fr XSS vulnerability

Open Bug Bounty ID: OBB-630151 Description| Value ---|--- Affected Website:| freelance-info.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

VK.com: Долгоживущий хеш + получение частичного доступа к аккаунту после сброса сессии

Hash lifetime...

RBKmoney: SUBDOMAIN TAKEOVER [http://dev.rbk.money/]

The DNS record of dev.rbk.money pointed to the Github, but the domain was not used in any Github account. So it was possible to bind it to any repository...

rygarden.se XSS vulnerability

Open Bug Bounty ID: OBB-629425 Description| Value ---|--- Affected Website:| rygarden.se Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

quakegriffin.com XSS vulnerability

Open Bug Bounty ID: OBB-628886 Description| Value ---|--- Affected Website:| quakegriffin.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

hanzeadvocaat.nl XSS vulnerability

Open Bug Bounty ID: OBB-628613 Description| Value ---|--- Affected Website:| hanzeadvocaat.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

zavamed.com XSS vulnerability

Open Bug Bounty ID: OBB-628582 Description| Value ---|--- Affected Website:| zavamed.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...