Imgur: De-anonymization Attack: Cross Site Information Leakage

Dear Imgur Security Team, We are researchers at the IMDEA Software Institute in Madrid, Spain. We have been working on analyzing Cross-Site Browser Leaks xsleaks and building a tool for finding instances of it on target web sites. Recently we tested imgur.com and discovered a flaw that can affect...

Imgur: BUG XSS IN "ADD IMAGES"

I want to report bug XSS in "ADD IMAGES" How To Produce it : 1. Login to your Account 2. Then Add Images With XSS Payload In filename example : ".png 3. Click on Image that you upload 4. in the name of picture XSS will fired Impact https://www.owasp.org/index.php/Cross-siteScriptingXSS...

WordPress iOS App Bug Leaked Secret Access Tokens to Third-Party Sites

If you have a "private" blog with WordPress.com and are using its official iOS app to create or edit posts and pages, the secret authentication token for your admin account might have accidentally been leaked to third-party websites. WordPress has recently patched a severe vulnerability in its iO...

Imgur: Stored XSS on imgur profile

Hello, I submitted a report on imgur, but the staff marked it as duplicate. 482841 I reviewed the report of the first submitted report. 381553 We are on the same situation and his case is already fixed because I tried visiting his site too which is https://12test.imgur.com/ and even redoing his...

Imgur: Ability to login to the Nexus Repo Manager from https://nexus.imgur.com/

Hello Imgur Administrators, I am not sure if this falls in your scope but I wanted to alert you that your Nexus Repository Manager can be accessed through https://nexus.imgur.com/ Usually the default user/pass for the NRM are admin/admin123 but there is an alternative way to login using the below...

Imgur: Go.imgur.com can be used to phish for account information

Right now the go.imgur.com domain is pointing to godoc.org/go.imgur.com but there is nothing at this resource. It is possible with encoded double dots to redirect go.imgur.com URLs to pages that phish for imgur account information. Proof of Concept === PoC 1:...

Imgur: CSRF leads to a stored self xss

Followup from 311460 Summary Self xss and CSRF are both out of scope, but when paired it is possible to create an attack on a user. Description A favorites folder with an xss payload for a name will launch when saving an image to said folder. This can be verified by following these steps Visit yo...

Imgur Confirms 2014 Breach of 1.7 Million User Accounts

Popular image sharing community Imgur said last week it was the victim of a data breach in 2014 that exposed 1.7 million user accounts. In a breach notice posted to its website last Friday, the company said users are being notified via email that they must update their passwords immediately. “On...

Imgur was hacked in 2014; affecting 1.7M users

By Waqas Its just another day with just another data breach This is a post from HackRead.com Read the original post: Imgur was hacked in 2014; affecting 1.7M users...

Imgur—Popular Image Sharing Site Was Hacked In 2014; Passwords Compromised

Only after a few days of Uber admitting last year's data breach of 57 million customers, the popular image sharing site disclosed that it had suffered a major data breach in 2014 that compromised email addresses and passwords of 1.7 million user accounts. In a blog post published on Friday, Imgur...

Imgur: Xss on community.imgur.com

Hello Team Description: I found a reflected cross site scripting on community.imgur.com Steps To Reproduce: Visit https://community.imgur.com/email/[email protected]%27%22%3E%3Csvg/onload=alertdocument.domain%3E F226739 Regards Santhosh...

Imgur: SSRF in imgur video GIF conversion

Hi, There was issue in - https://hackerone.com/reports/115748 We have found similar one but in next steps Affected request ============================ POST /vidgif/upload HTTP/1.1 Host: imgur.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:52.0 Gecko/20100101 Firefox/52.0 Accept: /...

Imgur: RCE by command line argument injection to `gm convert` in `/edit/process?a=crop`

Summary The y parameter of /edit/process endpoint with a=crop is vulnerable to command-line argument injection to something that appears to be GraphicsMagick utility probably gm convert. Due to GraphicsMagick's hacker-friendly processing of |-starting filenames supplied to -write option, it leads...

Imgur: Remote Code Execution on Git.imgur-dev.com

Hi, Imgur Security Team: I just found that your GitHub Enterprise Serverhttps://git.imgur-dev.com/ didn't patch to the latest version2.8.7. And there is a Rails static key leads to RCE vulnerability! You can see the PoC from my screenshots :...

Imgur: Stored xss in ALBUM DESCRIPTION

Album descriptions that take user generated text typically have strong protections around XSS, however the researcher was able to bypass this protection by adding unsafe text to the description field in a rarely accessed area of the site. This led to a reflected XSS which would trigger as soon as...

Imgur: Unauthenticated Docker registry

A docker registry was open and unauthenticated, giving access to outdated Imgur source code and secret keys...

Imgur: Stored XSS in albums on http://m.imgur.com/

Special characters were not being escaped on the mobile web product properly. This allowed an attacker to set a description or title to an XSS payload which would then execute upon loading...

Cry Ransomware Using UDP, Imgur, Google Maps

Ransomware purporting to come from a phony government agency, something called the Central Security Treatment Organization, has been making the rounds, researchers say. The ransomware, which is already known by a number of names including Cry, CSTO ransomware, or Central Security Treatment...

Imgur: Reflected XSS in m.imgur.com

There is a reflected XSS vulnerability in https://m.imgur.com as shown below: https://m.imgur.com/account/testcatplzignore%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3E/messages It appears that the username field in the url does not sanitize angle bracket characters on the mobile version...

Imgur: Awesome Images & GIFs - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Imgur: Awesome Images & GIFs published at the 'play' market has multiple vulnerabilities...