HackerOne: Requesting Mediation possible on reports that are too old for mediation

Hi Hackerone Team, it is possible to request mediation for reports, that have the closedTooLongToMediate-parameter set to true, by requesting a mediation for a new report and changing the report id to the old report. PoC report: https://hackerone.com/reports/77834 My Request looks like: POST...

Slack: Stored XSS(Cross Site Scripting) In Slack App Name

Hello Slack, This vulnerability is about a Stored Cross Site Scripting Slack Stored XSS In AppApp Name Vulnerable URLEdit App Page https://api.slack.com/apps/appid/general https://api.slack.com/apps/A21B3V9GA/general Vulnerable Parameter = name Note -Its also work on other user as well. Send this...

Harvest: Record payment for any invoice by PM (Access control Issue)

Hi Team, Description : Project ManagerFull access With Access to limited projects also have limited access to Invoices. So Project manager is assigned to limited project by Admin and he have access to limited Invoices related to assigned project. But Project manager can Actually Record payment of...

QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability

Document Title: =============== QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1895 Release Date: ============= 2016-08-11 Vulnerability Laboratory ID VL-ID:...

Trello: XSS and Open-Redirect via SVG

Hi Trello, When I was uploading image attachments from my computer,I've realized that I can upload SVG files and then I've tried to look SVG file that I attached,and I understood you execute SVG files which is can be malicious redirecting to a website or executing javascript codes for members...

Microsoft Word 2007/2010/2013/2016 - Out-of-Bounds Read Code Execution (MS16-099)

Application: Microsoft Office Word Platforms: Windows, OSX Versions: Microsoft Office Word 2007,2010,2013,2016 Author: Sébastien Morin of COSIG Website: https://cosig.gouv.qc.ca/en/advisory/ Twitter: @SebMorin1, @COSIG Date: August 09, 2016 CVE: CVE-2016-3313 COSIG-2016-31 1 Introduction 2 Report...

Instacart: Cross-Site Request Forgery (CSRF)

Hello, i found Cross-Site Request Forgery CSRF that can change any user ZONE POC: put Zone you want send the request to any user and you will change his Zone Please Watch My POC I Attached For More Details Thanks...

Shopify: (FULL PATH DISCLOSURE) Unknown MySQL server host 'shardm-reader.chi2.shopify.io'

Hello, Found a website of you guys that is poiting to: shardm-reader.chi2.shopify.io' This domain is disclosure fill path because there is none MySQL server host. POC: https://104.196.154.1/ Response a whole page with path disclosures: lib/patches/mysqlmonitoring.rb:19:in connect'...

Nextcloud: XSS on IOS app via HTML rendering

@bugdiscloseguys reported an issue to us leading to a stored XSS attack on the iOS app. To be exploitable the victim would have to open a malicious file shared by an adversary with the user. On request of the reporter, this issue is only disclosed limitedly. While we usually don't agree to disclo...

New Relic: Login CSRF vulnerability

Hi New Relic security team, While doing pentesting on your website, I found that while logging into the account the "authenticitytoken" was not properly validated. I was able to login into my account even without "authenticitytoken". Impact: High Steps to Reproduce: 1 Login to your account. 2 Whi...

Ubiquiti Inc.: IDOR Causing Deletion of any account

The researcher demonstrated how to close other users account, using a IDOR in community.ubnt.com he was able to delete all data in others account using the user id number of the victim. IDOR in Community.ubnt.com :500$ Created two user:-- Attacker with username:--vibhuti123i Victim:-- Johnvictim...

Pocsuite - Remote Vulnerability Testing Framework Developed By The Knownsec Security Team

Pocsuite is an open-sourced remote vulnerability testing and PoC development framework developed by the Knownsec Security Team. It serves as the cornerstone of the team. You can use Pocsuite to verify and exploit vulnerabilities or write PoC/Exp based on it. You can also integrate Pocsuite in you...

Phabricator: Error page Text Injection.

AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...

Atutor 2.2.1 Path Traversal

Advisory ID: HTB23297 Product: Atutor Vendor: Atutor Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Advisory Publication: February 24, 2016 without technical details Vendor Notification: February 24, 2016 Vendor Patch: July 1, 2016 Public Disclosure: August 2, 2016...

Open Upload 0.4.2 - Cross-Site Request Forgery (Add Admin)

Exploit for php platform in category web applications ================================================================================================================ Open Upload 0.4.2 Remote Admin Add CSRF Exploit and Changing Normal user permission...

Open Upload 0.4.2 - Cross-Site Request Forgery (Add Admin)

================================================================================================================ Open Upload 0.4.2 Remote Admin Add CSRF Exploit and Changing Normal user permission...

Halliburton LogView Pro 9.7.5 - .cgm .tif .tiff .tifh Crash (PoC)

Halliburton LogView Pro 9.7.5 - .cgm .tif .tiff .tifh Crash PoC Exploit Title: Haliburton LogView Pro v9.7.5 Exploit Author: Karn Ganeshen Download link: http://www.halliburton.com/public/lp/contents/InteractiveTools/web/Toolkits/lp/HalliburtonLogViewer.exe Version: Current version 9.7.5 Tested o...

Halliburton LogView Pro 9.7.5 - '.cgm' / '.tif' / '.tiff' / '.tifh' Crash (PoC)

Exploit Title: Haliburton LogView Pro v9.7.5 Exploit Author: Karn Ganeshen Download link: http://www.halliburton.com/public/lp/contents/InteractiveTools/web/Toolkits/lp/HalliburtonLogViewer.exe Version: Current version 9.7.5 Tested on: Windows Vista Ultimate SP2 Open cgm/tif/tiff/tifh file -...

DMA Radius Manager 4.1.5 Cross Site Request Forgery

tanks: Dr Ms Jk - n1arash - Milad Hacking - malahsky...

Joomla Extra Search 2.2.8 SQL Injection

Exploit Title : Joomla comextrasearch SQL injection Vulnerability Exploit Author : howucan Website : http://howucan.gr Dork : inurl:/index.php?option=comextrasearch establename Software link : http://www.joomlaboat.com/extra-search Software version : 2.2.8 video : http://adf.ly/1cmGen Tested on:...