Files Drop public link can be added as federated share

None...

End to end encryption folder locking is not properly protected

None...

IPS Community Suite 4.5.4.2 PHP Code Injection

------------------------------------------------------------------------------ IPS Community Suite = 4.5.4.2 previewBlock PHP Code Injection Vulnerability ------------------------------------------------------------------------------ - Software Link: https://invisioncommunity.com - Affected...

Nextcloud: Ransomware protection is missing extentions take 2

As requested in https://hackerone.com/reports/1195568 Impact So not spam ;...

Sifchain: CORS Misconfiguration

Summary: An cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of th...

Nextcloud: public webdav endpoint not bruteforce protected

Again related to https://hackerone.com/reports/1173684 I am having some trouble finding the code. However if you do curl -u "RANDOM1:RANDOM2" -X PROPFIND https://server/public.php/webdav And then check your ocbruteforceattempts table. You'll see there is no entry registered. Impact Low just like ...

Sifchain: wrong url in hackerone > goes to wix.com > unconnected

Summary: Hi there, this is a very small issue out of scope. Your current domain name in your hackerone program is wrong: http://sifchain.finance and moves to wix.com Steps To Reproduce: 1. Login as a researcher 2. Open the program from sifchain: https://hackerone.com/sifchain?type=team 3. click o...

Sifchain: Possibility of DoS attack at https://sifchain.finance// via CVE-2018-6389 exploitation

There is possibility in /wp-admin/load-scripts.php script to generate large 3Mb amount of data via simple non-authenticated request to server. The vulnerability is registered as https://vulners.com/cve/CVE-2018-6389 Details Detailed attack scenario is described for example here:...

Exploit for Path Traversal in Gitlab

GitLab CVE2020-10977 Introduction This script provides re...

HackerOne: Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack

Summary: Hi, The host hackerone.com uses cloudlfare to cache static files. The header x-forwarded-scheme can be used to cause a redirect loop, which will be cached by cloudflare. By taking down a JS file, it is possible to cause a total loss of availability on hackerone.com Disclaimer No actual...

HackerOne: Private program disclosure of `██████████` through notifications

Summary: Private program disclosure of ██████ through notifications Description: It looks like there is a private program called ████████ - https://hackerone.com/████████ which I'm not yet invited yet. However, I received a notification alert in my H1 account notification box indicating the priva...

Sifchain: Email Spoofing bug

Hi team, An SPF/DMARC record is a type of Domain Name Service DNS record that identifies which mail servers are permitted to send email on behalf of your domain. The purpose of an SPF/DMARC record is to prevent spammers from sending messages on the behalf of your organization. Remediation: Create...

HackerOne: Stored XSS in IE11 on hackerone.com via custom fields

Hi There, i found stored xss via Custom Fields F1275694 ---------------------------------- F1275691 POC: F1275692 Impact The attacker can use this issue to execute malicious script code in the victim user browser also redirect the victim user to malicious sites...

UPchieve: No Rate Limit On Reset Password

welcome all : i found that no rate limit in reset password in ::: ==https://app.upchieve.org/resetpassword== Summary: No rate limit check on forgot password which can lead to mass mailing and spamming of users and possible employees A little bit about Rate Limit: A rate limiting algorithm is used...

Reddit: Content Spoofing

Vulnerability: Content Spoofing or Text Injection Description: This vulnerability will reflect text on to the web page which is used to scam a victim to visit or send information to a malicious website. Because it is inside the domain and trusted web page, there is chances of scam. Open the Url a...

Kryptor: Kryptor/SECURITY.md missing HACKERONE program update.

Hi Team, I was going through code and found that in this https://github.com/samuel-lucas6/Kryptor/blob/master/SECURITY.md , "Security Policy" is missing update regrading Hackerone platform that "Security Bug now be submitted @ https://hackerone.com/kryptor/ this . Please update the policy...

Ruby: OS Command Injection in 'rdoc' documentation generator

Details: If the removeunparseable function receives a list of files with a command in the name of one of them, it will be executed. Just enough the name to match the pattern. The problem code: ruby def removeunparseable files files.reject do |file, | file =...

HackerOne: New link opening method makes hackerone vulnerable to tabnabbing

Summary: Hackerone recently changed how it opens the external links and this new way is vulnerable to tabnabbing. Description: Please see the POC. Steps To Reproduce 1. Click here: https://awasthi7.github.io/ 2. Click on proceed when warning appears. 3. The site will open in new tab and hackerone...

HackerOne: Tab nabbing in Hackerone inbox.

Description: Tab nabbing vulnerability occurs When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change its location using the window.opener property and from this a lot of phishing attacks could happen. This scenario occurs on...

HackerOne: Enumerating HackerOne Pentests

Summary: An attacker can enumerate companies that performed pentests using the HackerOne platform. Steps To Reproduce: HackerOne pentests usually have an alias ending in -h1p. We will use the HTTP Request below to enumerate pentests update X-CSRF-Token, Cookie, and contextteamhandle. PATCH...