2703 matches found
Starbucks: Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS record
Hi, I discovered that happymondays.starbucks.com DNS CNAME record is pointing to S3 AWS bucket which doesn't exist. Here's the screenshot of vulnerable domain: F138556 As happymondays.starbucks.com was free to register on AWS S3 service and DNS-setup is already correct set-up: F138557 I was able ...
██████: AWS Credentials leaked: access to production database backups, SSL certs and more
I found a public accessible Jenkins instance: https://██████jenkins.██████.com This instance requires login, however, it is possible to register an account using the signup page: https://██████jenkins.██████.com/signup Arbitrary file reads From there it is possible to use the Jenkins Script Conso...
Wordpress s3-video plugin cross-site scripting vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL servers to set up a personal blog site. s3-video is one of the video plugin. A cross-site scripting vulnerability exists in version 0.983 of the...
CVE-2016-1000148
Reflected XSS in wordpress plugin s3-video v0.983...
CVE-2016-1000148
Reflected XSS in wordpress plugin s3-video v0.983...
CVE-2016-1000148
Reflected XSS in wordpress plugin s3-video v0.983...
CVE-2016-1000148
Summary (CVE-2016-1000148) : A reflected Cross-Site Scripting (XSS) vulnerability exists in the WordPress S3 Video plugin for versions = 0.984. PoCs and attacker guidance are present in connected references.
PT-2016-4540
Name of the Vulnerable Software and Affected Versions s3-video version 0.983 Description The issue is related to a Reflected XSS in the wordpress plugin. Recommendations For version 0.983, update to a newer version that contains a fix for this issue...
CVE-2016-1000148: Improper Neutralization of Input During Web Page Generation
Reflected XSS in wordpress plugin s3-video v0.983...
HackerOne: Obtain the username & the uid of the one doing the S3 sync on Hackerone
Obtain the username & uid of hackerone.com S3 using GET, it's possible to obtain the username & uid of the one doing the S3 sync on Hackerone. Doing a GET on : http://hackerone.com Give the following header : content-security-policy = default-src 'none'; base-uri 'self'; block-all-mixed-content;...
Udemy: Udemy s3 storage can be used by an attacker personal website because of missing CSRF Token
The report was about a staging S3 bucket where we allow any file to be uploaded and then further process it from there. It was closed as informative because there is no security risk associated with it...
Reverb.com: Possible Blind Writing to S3 Bucket
Hi All, I noticed that you are using S3 and I believe I may have found one of your buckets and am able to write to it. However, I can not list the files in the bucket and such can not be 100% sure you own it. If you don't, I'd really appreciate being able to close this report myself or have you...
PT-2016-3386
Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.1u OpenSSL versions prior to 1.0.2i Description The issue is related to a buffer over-read in the certificate parser of OpenSSL, which could allow remote attackers to cause a denial of service. This is achieved...
DigitalSellz: Access to Amazon S3 bucket
@sameoldstory discovered a vulnerability that allows a user can gain access to S3. This Vulnerability has been fixed...
DigitalSellz: AWS Signature Disclosure in www.digitalsellz.com allows access to S3
@skorov discovered a vulnerability that allows a user can gain access to S3. This Vulnerability has been fixed. An information disclosure vulnerability was found that allowed an attacker to have arbitrary AWS requests signed with the secret key. The signature could then be used to view, edit,...
Bugs in Signal Messaging App Corrupt Attachments, Crash App
Makers of the mobile encrypted chat app Signal say they have fixed vulnerabilities in the Android version of the messaging app that allowed attackers to corrupt encrypted attachments and remotely crash the application. The vulnerabilities were discovered by Jean-Philippe Aumasson and Markus Vervi...
Legal Robot: 2 vulns
the first report is concerning AWS S3 bucket Readable for authenticated aws users , the same as this report 163476 the bucket is sdk.amazonaws.com , i believe it's yours because i found it in a Head request to https://app.legalrobot.com/ : F115189 listing the bucket : 115190 i don't have any...
Legal Robot: Information Disclosure in AWS S3 Bucket
Hi, While this doesn't fall directly under the Program scope, I feel that the subject of this report is directly connected to the primary Legal Robot web properties and would like to inform your team in case this was a misconfiguration concern. I noticed that legalrobot.amazonaws.com is configure...
HackerOne: Users contents on AWS is cacheable
Hi , Background ============================= As I know you are using AWS S3 for saving and serving files . The AWS S3 on https://hackerone-attachments.s3.amazonaws.com are been called every time to show images on hackerone.com . For example view this report 145392 You will see a request for Fran...