PayPal Fixes CSRF Vulnerability in PayPal.me

PayPal recently fixed a vulnerability on its PayPal.me site that could have let an attacker change a user’s profile without permission. The issue stemmed from a cross-site request forgery CSRF vulnerability that existed in PayPal.me, a site the company launched last year to let its users request...

HackerOne: Reward Money Leakage

By monitoring the average bounty amounts of a team, you can infer a certain amount of information about the size of the bounties awarded, even if the team has chosen not to show bounty amounts. we have decided to close this report as Informative as we are okay with the current state of the bounty...

HackerOne: Possible CSRF during joining report as participant

Hi, I think i found a possible csrf issue with joining report as participant endpoint, Actually one of the bug got duplicated and the company added me into the original bug as a participant. then, I got invitation from hackerone to joing the report. After opening the invitation link, there was tw...

Concrete5 5.7.3.1 Local File Inclusion

------------------------------------------------------------------------------- Concrete5 installed 329. $response = $this-getEarlyDispatchResponse; 330. 331. if !isset$response 332. $collection = Route::getList; 333. $context = new \Symfony\Component\Routing\RequestContext; 334...

Concrete5 5.7.3.1 - (Application::dispatch) Local File Inclusion

Exploit for php platform in category web applications ------------------------------------------------------------------------------- Concrete5 installed 329. $response = $this-getEarlyDispatchResponse; 330. 331. if !isset$response 332. $collection = Route::getList; 333. $context = new...

Concrete5 CMS 5.7.3.1 - 'Application::dispatch' Method Local File Inclusion

------------------------------------------------------------------------------- Concrete5 installed 329. $response = $this-getEarlyDispatchResponse; 330. 331. if !isset$response 332. $collection = Route::getList; 333. $context = new \Symfony\Component\Routing\RequestContext; 334...

Concrete5 CMS 5.7.3.1 - Application::dispatch Method Local File Inclusion

Concrete5 CMS 5.7.3.1 - Application::dispatch Method Local File Inclusion ------------------------------------------------------------------------------- Concrete5 installed 329. $response = $this-getEarlyDispatchResponse; 330. 331. if !isset$response 332. $collection = Route::getList; 333...

HackerOne: Know undisclosed Bounty Amount when Bounty Statistics are enabled.

Hi, When a program does not disclose How much bounty is paid to particular report , but if bounty statics is enabled then undisclosed Bounty Amount can be enumerated. For example Uber does not disclose bounty awarded to particular researcher but show bounty statics so we can write a script that...

HackerOne: Race Conditions in Popular reports feature.

This vulnerability allows you to explore a race condition bug on a new feature of hackerone, the popular reports.. To reproduce this bug, you need to intercept the POST request that trigger the "upvote" action. After having this POST request, i created a script that repeats that POST with multipl...

Meet the 18-Year-Old Who Hacked the Pentagon

Ask David Dworken when he was in tenth grade what a cross-site scripting vulnerability is and you might get a strange look from the Alexandria, Va., teen. Fast forward two years and pose the same question Dworken and you’ll get a well-versed answer from the now white hat hacker and recent high...

Internet Bug Bounty: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize

https://bugs.php.net/bug.php?id=72434 This vulnerability was discovered during the auditing of a vendor on Hackerone. Similar to our other submission on bugs.php.net and here, this vulnerability is remotely exploitable. Please feel free to ask for more technical details if necessary. Thank you fo...

Sucuri: SSRF in sitecheck.sucuri.net

Hi, Sucuri Security Team. I found a SSRF in https://sitecheck.sucuri.net/ Although there was already an protection to prevent SSRF, but it can be bypassed by 302 redirection! ssrf.php https://sitecheck.sucuri.net/results/orange.tw/ssrf.php And your port will receive "HELLO WORLD" orange@z:$ nc -v...

Hack the Pentagon: Hackers find over 100 Bugs in U.S. Defense Systems

The "Hack the Pentagon" bug bounty program by the United States Department of Defense DoD has been successful with more than 100 vulnerabilities uncovered by white hat hackers in Pentagon infrastructure. In March, the Defense Department launched what it calls "the first cyber Bug Bounty Program i...

HackerOne: Old titles are not hidden in reports with limited disclosure

When a report is made public it shows all activity that took place in that report. This includes showing if the title of the report was changed and what it was changed from. This could cause information to be public that the business may not wish to make public if the person that created the repo...

HackerOne: Able to remove the admin access of my program

Hey Jobert, There is a functional bug in hackerone, using which i am able to make the my program admin free. This shouldn't be happen in the program because atleast one admin be there in program. Request: PUT /sasas/groups/12307 HTTP/1.1 Host: hackerone.com User-Agent: Mozilla/5.0 Macintosh; Inte...

Ubiquiti airOS - Arbitrary File Upload (Metasploit)

Exploit for unix platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ubiquiti airOS Arbitrary File Upload', 'Description' = %q This module exploits a pre-auth fi...

Pornhub Launches Bug Bounty Program; Offering Reward up to $25,000

With the growing number of cyber attacks and data breaches, a significant number of companies and organizations have started Bug Bounty Programs to encourage hackers and security researchers to find and responsibly report bugs in their services and get a reward. Now, even pornography sites are...

HackerOne: Inadequate access controls in "Vote" functionality???

Hello there, First of all let me congratulate you for including pornhub in the list of bug bounty programs, me and my colleagues will have a lot of fun with it hahahahahah. Awesome... Anyways, I stumbled upon something whilst testing hackerone's main site. I don't know if it's a feature that it's...

LocalTapiola: Amazon Bucket Accessible (http://inpref.s3.amazonaws.com/)

Searching through the source code of your homepage shows a few http://inpref.s3.amazonaws.com/ URLS. I assume that you own this s3 Amazon bucket. The problem here is, visiting that amazon bucket on a browser will shows the files on the bucket, whilst a secure bucket would bring up an access denie...

HackerOne: RCE in profile picture upload

Issue ===== The profile picture upload at /settings/profile/edit is vulnerable to remote code execution due to the uploaded file being passed to ImageMagick without checking whether it's an actual image. Combined with the fact that ImageMagick parses ASCII text as so called MVG Magic Vector...