Paragon Initiative Enterprises: Full Path Disclosure in airship.paragonie.com '/cabins/'

Hello Team, first am so sorry if i test this in your site, since i got problem to install in my own. So when i see your blog i got end point to https://airship.paragonie.com which is "Powered By Airship" or made using Airship CMS. step To Reproduce 1. register an account 2. navigate to...

paragonproperty.com.au XSS vulnerability

Vulnerable URL: http://www.paragonproperty.com.au/wp-content/plugins/Realty/display/elements/formcontactagent.php?userid="'...

Paragon Initiative Enterprises: directory information disclose

step: 1. goto https://bridge.cspr.ng/my/files/Hull with your login id 2. upload a file 3. click on "File info" and see full path of file is disclose...

Paragon Initiative Enterprises: Cross-site-Scripting

step: 1: goto https://bridge.cspr.ng/my/account of your account 2. in "Custom Profile field option" check the box and enter xss payload in "display name" field payload: "palert'xss'" 3. update the information 4. open the account in INTERNET EXPLORER 11 and xss will executed note: here server is n...

Paragon Initiative Enterprises: Incomplete fix for #181225 (target=_blank vulnerability)

Hi, I believe the fix for 181225 is incomplete in the rules for Airship wysihtml parser rules. At https://github.com/paragonie/airship/blob/58f96aa0e5002b60e74456502d9bfc9483d77b3d/src/public/js/wysihtml5/parserrules/advancedandextended.js, the 'target' parameter for links is allowed to be...

account.paragon.yt XSS vulnerability

Vulnerable URL: https://account.paragon.yt/?id=test%22%27--!%3E%3C/Script/%3E%3CSvg/Onload=confirmOPENBUGBOUNTY%20/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Paragon Initiative Enterprises: Not using Binary::safe* functions for substr/strlen function

Several places in the code don't use Binary::safe or CryptoUtil::safe functions, but use raw functions instead strlen/substr which can act as mbfuncname instead not count bytes for strlen/etc... 1...

Paragon Initiative Enterprises: Missing GIT tag/commit verification in Docker

in: https://github.com/paragonie/airship/blob/master/docker/Dockerfile.airshipL14-L16 RUN git clone https://github.com/jedisct1/libsodium.git /tmp/sodium WORKDIR /tmp/sodium RUN git checkout tags/1.0.10 The code is fetched from Github without one of: 1. signature verification on relevant tag. GPG...

Paragon Initiative Enterprises: DMARC Not found for paragonie.com URGENT

Hi sir, , I am new hacker in hackerone platform I am glad to join paragonie bounty program ..i want to report a very critical bug that is i found DMARC missing for your domain paragonie.com Add DMARC record as soon as possible .. DMARC description Background Email authentication technologies SPF...

Paragon Initiative Enterprises: [Airship CMS] Local File Inclusion - RST Parser

Airship uses the very useful RST Parser from Gregwar. However, the parser has the RST directive include built-in why it isn't a separate directive per the spec, I don't know. However, as a result, LFI is possible in Airship. I realize this isn't directly Paragonie's code, but since Airship uses...

mail.paragonfootwear.com XSS vulnerability

Vulnerable URL: http://mail.paragonfootwear.com/?user=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 10:24 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Paragon Initiative Enterprises: Session Management Issue CMS Airship

Hey, I've found a session management issue in CMS Airship bridge.cspr.ng Issue ---------- When the password of an account is changed from a session, other sessions doesn't expire! Steps to Reproduce + We Need to use two broswers 1. Login to one browser 2. Login to second browser 3. Then change th...

Paragon Initiative Enterprises: Nginx Version Disclosure On Forbidden Page

Hi, PoC 1- Go that link you'll see the version of nginx server https://paragonie.com/static/highlightjs/...

Paragon Initiative Enterprises: Stored Cross-Site-Scripting in CMS Airship's authors profiles

I'm just checking out CMS Airship and some of the security features look pretty nice. Awesome job on that! After clicking around a bit I stumbled however upon a stored XSS vulnerability in the Bridge. As per /bridge/help I use 1.1.0 version installed via Docker, as I couldn't find any reference...

Paragon Initiative Enterprises: Full path disclosure vulnerability on paragonie.com

Sir, I have found a bug which is Full path discloser vulnerability. Vulnerable Point https://paragonie.com/contact my post data...

paragonproperty.com.au XSS vulnerability

Vulnerable URL: http://www.paragonproperty.com.au/wp-content/plugins/Realty/display/elements/formcontactagent.php?userid=%22%3C/script%3E%3Cscript%3Ealert%28/OPENBUGBOUNTY/%29%3C/script%3E%27=1 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:|...

Paragon Initiative Enterprises: Vunerability : spf

Heĺlo sir, im an independent security researcher. I found an vunerability in your website Your website https://github.com/paragonie doesn't have valid spf records. To recover this do validate your spf. Sender Policy Framework SPF: This allows you specify which mail servers are allowed to send mai...

Paragon Initiative Enterprises: Full Path Disclosure In EasyDB

Hi, as reported in 115337 about a full path disclosure in EasyDB you fixed some of them in last commits but single function is vulnerable too and not fixed yet! ifcount$params != count$params,COUNTRECURSIVE throw new \InvalidArgumentException"Invalid params"; this will check $params to be 1d arra...

Paragon Initiative Enterprises: Spf

Vulnerability: spf record Vulnerability domine:https://github.com/paragonie No valid spf record onhttps://github.com/paragonie...

Paragon Initiative Enterprises: Missing SPF for paragonie.com

There is no TXT record in DNS zone that defines Sender Policy Framework entry for domain paragonie.com. This makes it easy to spoof your e-mail address. For SPF record just check this http://www.kitterman.com/spf/validate.html...