Imgur: Stored XSS on imgur profile

Hello, I submitted a report on imgur, but the staff marked it as duplicate. 482841 I reviewed the report of the first submitted report. 381553 We are on the same situation and his case is already fixed because I tried visiting his site too which is https://12test.imgur.com/ and even redoing his...

Imgur: Ability to login to the Nexus Repo Manager from https://nexus.imgur.com/

Hello Imgur Administrators, I am not sure if this falls in your scope but I wanted to alert you that your Nexus Repository Manager can be accessed through https://nexus.imgur.com/ Usually the default user/pass for the NRM are admin/admin123 but there is an alternative way to login using the below...

Imgur: Go.imgur.com can be used to phish for account information

Right now the go.imgur.com domain is pointing to godoc.org/go.imgur.com but there is nothing at this resource. It is possible with encoded double dots to redirect go.imgur.com URLs to pages that phish for imgur account information. Proof of Concept === PoC 1:...

Imgur: CSRF leads to a stored self xss

Followup from 311460 Summary Self xss and CSRF are both out of scope, but when paired it is possible to create an attack on a user. Description A favorites folder with an xss payload for a name will launch when saving an image to said folder. This can be verified by following these steps Visit yo...

Imgur Confirms 2014 Breach of 1.7 Million User Accounts

Popular image sharing community Imgur said last week it was the victim of a data breach in 2014 that exposed 1.7 million user accounts. In a breach notice posted to its website last Friday, the company said users are being notified via email that they must update their passwords immediately. “On...

Imgur was hacked in 2014; affecting 1.7M users

By Waqas Its just another day with just another data breach This is a post from HackRead.com Read the original post: Imgur was hacked in 2014; affecting 1.7M users...

Imgur—Popular Image Sharing Site Was Hacked In 2014; Passwords Compromised

Only after a few days of Uber admitting last year's data breach of 57 million customers, the popular image sharing site disclosed that it had suffered a major data breach in 2014 that compromised email addresses and passwords of 1.7 million user accounts. In a blog post published on Friday, Imgur...

Imgur: Xss on community.imgur.com

Hello Team Description: I found a reflected cross site scripting on community.imgur.com Steps To Reproduce: Visit https://community.imgur.com/email/[email protected]%27%22%3E%3Csvg/onload=alertdocument.domain%3E F226739 Regards Santhosh...

Imgur: SSRF in imgur video GIF conversion

Hi, There was issue in - https://hackerone.com/reports/115748 We have found similar one but in next steps Affected request ============================ POST /vidgif/upload HTTP/1.1 Host: imgur.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:52.0 Gecko/20100101 Firefox/52.0 Accept: /...

Imgur: RCE by command line argument injection to `gm convert` in `/edit/process?a=crop`

Summary The y parameter of /edit/process endpoint with a=crop is vulnerable to command-line argument injection to something that appears to be GraphicsMagick utility probably gm convert. Due to GraphicsMagick's hacker-friendly processing of |-starting filenames supplied to -write option, it leads...

Imgur: Remote Code Execution on Git.imgur-dev.com

Hi, Imgur Security Team: I just found that your GitHub Enterprise Serverhttps://git.imgur-dev.com/ didn't patch to the latest version2.8.7. And there is a Rails static key leads to RCE vulnerability! You can see the PoC from my screenshots :...

Imgur: Stored xss in ALBUM DESCRIPTION

Album descriptions that take user generated text typically have strong protections around XSS, however the researcher was able to bypass this protection by adding unsafe text to the description field in a rarely accessed area of the site. This led to a reflected XSS which would trigger as soon as...

Imgur: Unauthenticated Docker registry

A docker registry was open and unauthenticated, giving access to outdated Imgur source code and secret keys...

Imgur: Stored XSS in albums on http://m.imgur.com/

Special characters were not being escaped on the mobile web product properly. This allowed an attacker to set a description or title to an XSS payload which would then execute upon loading...

Cry Ransomware Using UDP, Imgur, Google Maps

Ransomware purporting to come from a phony government agency, something called the Central Security Treatment Organization, has been making the rounds, researchers say. The ransomware, which is already known by a number of names including Cry, CSTO ransomware, or Central Security Treatment...

Imgur: Reflected XSS in m.imgur.com

There is a reflected XSS vulnerability in https://m.imgur.com as shown below: https://m.imgur.com/account/testcatplzignore%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3E/messages It appears that the username field in the url does not sanitize angle bracket characters on the mobile version...

Imgur: Awesome Images & GIFs - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Imgur: Awesome Images & GIFs published at the 'play' market has multiple vulnerabilities...

Imgur: XSS via React element spoofing

Hello, I noticed an XSS on imgur. Proof of concept: visit the URL http://imgur.com/vidgif/ticket/aaaaaaaa?errorpropsdangerouslySetInnerHTMLhtml=%3Cimg%20src=a%20onerror=%22alert%27XSS%20on%20%27%2bdocument.domain%22%3E&errorisReactElement=true&errortype=body It's not the simplest case as it...

Imgur: Local file read in image editor

Filepaths were able to traverse up outside of their intended directory when using the /edit/process API endpoint. Insufficient imageid filtration in image editor allowed an attacker to read arbitrary files. An attacker could read files by setting file path in imageid GET param in /edit/process AP...

Imgur: SSRF / Local file enumeration / DoS due to improper handling of certain file formats by ffmpeg

Hello! Short description ======== https://imgur.com/vidgif/upload endpoint is vulnerable to a SSRF/LFE vulnerability which allows an attacker to craft connections originating from imgur servers to any destination on the internet and imgur internal network and disclose lists of files located on...