Node.js third-party modules: `useragent` is vulnerable to ReDoS in user-agent string

Denial of Service by passing crafted user-agent strings...

carloseliseo.org XSS vulnerability

Open Bug Bounty ID: OBB-569273 Description| Value ---|--- Affected Website:| carloseliseo.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

VK.com: Просмотр любого видео из частной группы и кто загрузил

Просмотр некоторых видеозаписей из закрытых групп...

Node.js third-party modules: `macaddress` concatenates unsanitized input into exec() command

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report code injection i...

QIWI: Imformation Disclosure on id.rapida.ru

Привет, Происходит раскрытие путей на id.rapida.ru/dp.php Шаги для воспроизведения: 1 Перейти на https://id.rapida.ru/login 2 Попробовать авторизоваться через телефон, ожидая смс-код. 3 Попробовать ввести не рабочий смс кодлюбой 4 В респонсе можно увидеть пути HTTP/1.1 200 OK Server: nginx Date:...

kostroma.vsebankitut.ru XSS vulnerability

Open Bug Bounty ID: OBB-564786 Description| Value ---|--- Affected Website:| kostroma.vsebankitut.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

phisite.org XSS vulnerability

Open Bug Bounty ID: OBB-564463 Description| Value ---|--- Affected Website:| phisite.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

spartoo.it XSS vulnerability

Open Bug Bounty ID: OBB-564372 Description| Value ---|--- Affected Website:| spartoo.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

HackerOne: Unicorn worker pool exhaustion by continuously updating payout preferences

please this time i hope you listen to me - please see the included video as POC - please this is not self DOS , not self DOS, not self DOS - i hope this time you find out that this is last report that i have , please see the video to the end again this is not a self DOS i have invulded one...

RubyGems: Delete directory using symlink when decompressing tar

In 2.7.6, the safety of symlink is confirmed with mkdirpsafe, Before that FileUtils.rmrf destination is running. Therefore, if tmp/dir is specified after tmp - /tmp, the following /tmp/dir is deleted. Proof of concept builder.rb ruby require 'rubygems/package' class GemBuiler def initialize spec,...

Mail.ru: CSRF на добавление товара на продажу

CSRF in lootdog.io allowed to put item on sale. Вело к выставлению предмету за любую цену 1 рубль и возможности выкупить после этого с другого аккаунта...

Mail.ru: CSRF on lootdog.io

CSRF vulnerability for phone/email change action. On the time of reporting, lootdog.io clientside vulnerabilities were not covered with bug bounty...

jsconsultancy.nl XSS vulnerability

Open Bug Bounty ID: OBB-560757 Description| Value ---|--- Affected Website:| jsconsultancy.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

magazin.photosynthesis.bg XSS vulnerability

Open Bug Bounty ID: OBB-559743 Description| Value ---|--- Affected Website:| magazin.photosynthesis.bg Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

latitudeenfant.fr XSS vulnerability

Open Bug Bounty ID: OBB-559664 Description| Value ---|--- Affected Website:| latitudeenfant.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Mail.ru: blind XXE in autodiscover parser

Как воспроизвести: 1 Закинуть на сервер атакующего xml должен быть доступен на сервере атакующего по адресу /autodiscover/autodiscover.xml: Я сделал такой ответ при запросе любой xml'ки: obmhld.com/autodiscover/autodiscover.xml email settings SMTP 52.34.103.214 1191 off [email protected] yandex....

onlineshop.nero.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-558179 Description| Value ---|--- Affected Website:| onlineshop.nero.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Disclosure Standard:| Coordinated Disclosure based on...

shop.smartbear.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-558123 Description| Value ---|--- Affected Website:| shop.smartbear.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Disclosure Standard:| Coordinated Disclosure based on I...

svaiza.com XSS vulnerability

Open Bug Bounty ID: OBB-557972 Description| Value ---|--- Affected Website:| svaiza.com Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until disclosure Disclosure Standard:| Coordinated Disclosure based on ISO 29147...

bonappetit.com XSS vulnerability

Open Bug Bounty ID: OBB-557521 Description| Value ---|--- Affected Website:| bonappetit.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure base...