Valve: resetreportedcount & updatetags doesn't verify appid param

This requires an account that has admin permissions on any community hub & Fiddler not 100% required, but I'll use it for the demonstration. resetreportedcount: Step 1: Go to any UGC in the hub you have admin access on, open Fiddler if you haven't yet, click Clear Reports and click OK on the...

flarione.ru XSS vulnerability

Open Bug Bounty ID: OBB-616027 Description| Value ---|--- Affected Website:| flarione.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

VK.com: Получение чужого номера телефона (все цифры) через форму восстановления пароля

В некоторых случаях можно было получить привязанный к странице номер телефона. Данная уязвимость позволяет злоумышленнику получить личный номер телефона жертвы, который привязан к странице Вконтакте. Для использования данной уязвимости достаточно знать только электронный адрес жертвы...

Valve: GetReports works for hubs you don't have access to

Admin permissions on a game hub could be leveraged to view UGC reports on unrelated games. If an account had admin permissions on a game hub, he'd be able to view other game hubs UGC reports by simply making the appid parameter the appid of the game hub he has admin permissions on...

Valve: Buffer overflows in demo parsing

This was originally reported by @yalter at https://github.com/ValveSoftware/halflife/issues/1654...

fire-rescue.gov.bn XSS vulnerability

Open Bug Bounty ID: OBB-614873 Description| Value ---|--- Affected Website:| fire-rescue.gov.bn Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

HackerOne: Team object in GraphQL that have a published external program may expose existence of a private program

Summary: Hi Team! On Team object the parameter "icannotcreatejirawebhookreasons" is not NULL and gets the following default states when called for all programs "CANNOTVIEW","FEATUREGATED","PROGRAMPERMISSIONREQUIRED" If a Company Program runs a Private Program or a Public On the "FEATUREGATED" is...

communities.qld.gov.au XSS vulnerability

Open Bug Bounty ID: OBB-612708 Description| Value ---|--- Affected Website:| communities.qld.gov.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

grosshandel-hahn.de XSS vulnerability

Open Bug Bounty ID: OBB-612661 Description| Value ---|--- Affected Website:| grosshandel-hahn.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

uzin.si XSS vulnerability

Open Bug Bounty ID: OBB-612553 Description| Value ---|--- Affected Website:| uzin.si Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

academic.oup.com XSS vulnerability

Open Bug Bounty ID: OBB-610926 Description| Value ---|--- Affected Website:| academic.oup.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Mail.ru: XSS e.mail.ru fixSpecialSymbols

Domain, site, application -- e.mail.ru Testing environment -- Firefox Steps to reproduce -- 1. send email from 2. add sender to contacts on https://e.mail.ru/messages/inbox/ 3. using Firefox go to https://e.mail.ru/compose/ 4. click on Кому: to open Contacts Actual results -- alert message Expect...

beachme.me XSS vulnerability

Open Bug Bounty ID: OBB-610695 Description| Value ---|--- Affected Website:| beachme.me Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

hubgroup.com XSS vulnerability

Open Bug Bounty ID: OBB-610673 Description| Value ---|--- Affected Website:| hubgroup.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Ed: Session cookie missing SecureFlag on git.edoverflow.com.

Assigned to:-ED Assigned by:- Kirtikumar Anandrao Ramchandani Assigned on:- 01/05/2018 Bug overview:- Session Cookie without secure flag. Cookie Name:- gitlabsession Description:-Risk description: Since the Secure flag is not set on the cookie, the browser will send it over an unencrypted channel...

Shopify: Publicly Accessible Datadog link

During my daily scanning of shopify and shopify's internal domain Shopify.io, I landed on a personal bookmark of an employee: █████████ who works at Guru at Shopify. The link for personal bookmark is here: ███ There is a personal bookmark called ██████████. When going to the link: ████████ it...

Mail.ru: easyXDM allows cross domain postmessaging with any origin, leaking sensitive info

Mail.Ru Agent uses easyXDM library for crossdomain communication between different mail.ru messaging systems. For modern browsers postMessage is used inside. The security issue was because of lacking ACL for domains. So malicious man could in some circumstances he should know victim's email, forc...

Avito: reflected XSS avito.ru

Привет, авито Я нашел у вас хсс. 1. Переходим по этой ссылке https://www.avito.ru/sankt-peterburg?verifyUserLocation=1login?next=javascript:alert;// 2. Логинимся через ОК, ВК и т.д. 3. XSS выполнена. Impact XSS...

Mail.ru: Stored xss в пересланном сообщении.

Здравствуйте! Обнаружил такую особенность пересланных сообщений, что мы можем изменять их содержимое. И тут я вспомнил про свою self xss, когда можно было изменить id стикера к примеру на " и воспроизводился js, но стикер не отправлялся из за ошибки, то есть сообщение было видно только нашей...

Mail.ru: lootdog.io XSS

В данной ссылке можно наблюдать опенредирект: 1. https://lootdog.io/register?next=http://mail.ru?https%3A%2F%2Flootdog.io%2F Заполняем эту форму, подтверждаем номер: F290679 Нас перекидывает на http://mail.ru Impact open redirect...