5449 matches found
GitLab: Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com
Hi, Previously a blog post went out about Uber's Sendgrid issues: http://blog.pentestnepal.tech/post/149985438982/reading-ubers-internal-emails-uber-bug-bounty Also, a report from @uranium238 went out due to a similar issue with Slack that I know uses Mailgun: https://hackerone.com/reports/163938...
Broken CORS
Overview Affected versions of sails have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious...
Aternity version 9 vulnerable to cross-site scripting and remote code execution
Overview The Aternity webserver, version 9 and prior, is reportedly vulnerable to cross-site scripting XSS on several web pages, and remote code execution via inclusion of untrusted functionality by default due to improper authentication before execution. Description CWE-80: Improper Neutralizati...
The vulnerability of the Microsoft Office software package, which allows a hacker to bypass the ASLR protection mechanism
The vulnerability of the Click-to-Run package for Microsoft Office programs is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the ASLR protection mechanism by using a specially created application...
Zomato: CSRF in the "Add restaurant picture" function
Overview I found a CSRF vulnerability within the process responsible for adding photos for a restaurant which can lead to tricking victims into adding arbitrary photos to their restaurant's page. Details The CSRF vulnerability exists due to a misconfiguration on your part in which your X-CSRF-TOK...
Zomato: CORS Misconfiguration on www.zomato.com
The website at https://www.zomato.com tries to use Cross-Origin Resource Sharing CORS to allow cross-domain access from all subdomains of zomato.com. However, due to a flaw in the implementation, it actually allows cross-domain access from all domains ending in zomato.com including notzomato.com ...
Legal Robot: 2 vulns
the first report is concerning AWS S3 bucket Readable for authenticated aws users , the same as this report 163476 the bucket is sdk.amazonaws.com , i believe it's yours because i found it in a Head request to https://app.legalrobot.com/ : F115189 listing the bucket : 115190 i don't have any...
Legal Robot: Information Disclosure in AWS S3 Bucket
Hi, While this doesn't fall directly under the Program scope, I feel that the subject of this report is directly connected to the primary Legal Robot web properties and would like to inform your team in case this was a misconfiguration concern. I noticed that legalrobot.amazonaws.com is configure...
New Relic: Cookie Misconfiguration
1 install add ons "Edit this Cookie" in google chrome" 2 login your account/create an account 3 get the cookie using "edit this cookie" 4 logout the account 5 delete the current cookie using edit this cookie and put the cookie what you copy and refresh the tab Video...
Mozilla Firefox Forgery Attack Vulnerability
Mozilla Firefox is an open source web browser; Mozilla Firefox fails to properly set the LINKABLE and URISAFEFORUNTRUSTEDCONTENT flags for about: URLs used by error pages, allowing remote attackers to exploit the vulnerability to build malicious WEB pages that can be tricked into parsing by users...
The vulnerability of the SolarWinds Virtualization Manager software allows a hacker to increase their privileges.
The vulnerability of the SolarWinds Virtualization Manager software is related to configuration errors. Exploiting this vulnerability can allow an attacker, operating locally, to gain increased privileges due to incorrect configuration of sudo...
The vulnerability of the GNU Wget download manager, which allows a hacker to modify any files at will
The vulnerability of the GNU Wget download manager is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to remotely modify any files by redirecting requests from HTTP to a specially created FTP server...
USN-3032-1 ecryptfs-utils vulnerability
It was discovered that eCryptfs incorrectly configured the encrypted swap partition for certain drive types. An attacker could use this issue to discover sensitive information...
Gratipay: don't allow directory browsing on grtp.co
Hello guys, Details: The web server is configured to display the list of files contained in this directory. As a result of a misconfiguration - end user / attacker able to see content of the folders with systemically important files According to yours Scope any other software we publish - I found...
Console: CORS headers set to allow all in Red Hat AMQ
It was found that the Hawtio console setting for the Access-Control-Allow-Origin header permits unrestricted sharing allow all. An attacker could use this flaw to access sensitive information or perform other attacks...
The vulnerability of Google Chrome browser allows a violator to circumvent access restrictions.
The vulnerability of the Google Chrome browser’s blink component is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass access restrictions by using a Java script that utilizes the blink API in its operation...
SolarWinds Virtualization Manager Privilege Gain Vulnerability
Solarwinds Virtualization Manager is a suite of software from SolarWinds, Inc. that is used to manage and monitor virtualization products. The software provides capacity management, performance monitoring and configuration management. A privilege acquisition vulnerability exists in SolarWinds...
Nextcloud: Password reset link remains valid after email change
Hey! I found a token miss configuration flaw in Nextcloud 9.0.50 Latest version, When we reset password for a user a link is sent to the registered email address but incase it remain unused and email is updated by user from control panel then too that old token reset link sent at old email addres...
Nextcloud: nextcloud.com: Directory listening for 'wp-includes' forders
Hello guys, Details: The web server is configured to display the list of files contained in this directory. As a result of a misconfiguration - end user / attacker able to see content of the folders with systemically important files Vulnerable place: /wp-includes directory when I tried to navigat...