Server Side Request Forgery(SSRF) in the Jira Trello importer - CVE-2017-16865

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...

Server Side Request Forgery(SSRF) in the Jira Trello importer - CVE-2017-16865

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...

CVE-2017-16865: Server-Side Request Forgery (SSRF)

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...

Trello: Sessions Token In Get Parameter Request Initiating Websocket Connection

When anyone login into trello.com application then after authentication, application sends session token into get parameter. so attacker can sniffing this session token form web history, proxy history or log cause fully account takeover. HTTP Request : GET...

Trello: Able to run script on https://trello-attachments.s3.amazonaws.com/ [N/A]

HI Trello Security Team this pratik From India ------------------------------------------------------------------------------ I have Founded Stored XSS On your Website critical issue need to be patched before someoneattacker exploit this...

Trello: CSV injection [N/A]

Hello, We can inject commands in the name field of a board =210 or =cmd|'/C calc'!AO for example, and when it's exported to CSV it will be evaluated to 20 in the corresponding cell, this enables an attacker to spread malware and execute system level commands on a victim's machine if the victim...

Trello: Subdomain Takeover Possible [N/A]

Hello , Team Trello Security Today == 04/11/2017 , 03:52 , I Discovred A Issue in Your Website , i found this error In : http://d2k1ftgv7pobq7.cloudfront.net/ ======================================================= ERROR The request could not be satisfied. Bad request. Generated by cloudfront...

Trello: A CRLF injection into the redirect URL of https://trello.com/1/authorize can be used to cause a denial of service when later redirected to

Just found this, tested it on a whim and deeply regretted it. Sorry! So to recreate the issue: 1. Visit...

Trello app for iOS cross-site scripting vulnerability

Trello app for iOS is a free iOS-based project management tool developed by the American company Trello. The product features high flexibility and a visual interface. A cross-site scripting vulnerability exists in versions of Trello app prior to 4.0.8 for iOS-based platforms. A remote attacker ca...

Cross site scripting

Cross-site scripting XSS vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card...

CVE-2017-9244

Cross-site scripting XSS vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card...

CVE-2017-9244

Cross-site scripting XSS vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card...

CVE-2017-9244

The Trello iOS app (pre-4.0.8) contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card. Affected versions are prior to 4.0.8; the issue is triggered when handling the image attach...

CVE-2017-9244

Cross-site scripting XSS vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card...

CVE-2017-9244: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card...

Trello: Unpatched (https://hackerone.com/reports/221928)- Unviladate File Upload to XSS on trello-attachment Bucket

Report no: https://hackerone.com/reports/221928 is unpatched. Poc: https://trello-attachments.s3.amazonaws.com/59663070a9025afc4b32c7c6/596641e05abfc29b1bd67ff8/9c5258c6acf27ffdf5e80d5bfabbb83b/lol.svg XSS Link...

Trello: api flaw

Hope you guys are doing great. While going through your api documentation on https://developers.trello.com/advanced-reference/cardpost-1-cards-card-id-or-shortlink-actions-comments , an api endpoint POST /1/cards/card id or shortlink/attachments supposed to be rate-limited after 100 attachment bu...

Trello: XML entity expansion using svg file

Hope you guys are doing great. I want to report xml entity expansion bug while uploading svg file . When adding a card in boards it also allows to upload attachments which can include svg files. Users or admin can then download those attachment but the problem is when svg file is uploaded, websit...

Trello: Cross-Site Scripting on Trello's iPhone App

Description There is a Stored Cross-Site Scripting vulnerability on Trello's iPhone App due to the incorrect handling of the uploaded file in Trello's Card Attachment. This allows an attacker to execute JavaScript. Proof of Concept I used Burpsuite to intercept the request and 2 devices Laptop an...

Trello: Malicious file can be hidden as Card Attachment or Card Cover image

You can upload infected jpeg files to a card. If a user clicks on the attachment image, the infected file will get downloaded instead of showing the image. On opening it, any sort of system calls can be run on the victim. Steps to Reproduce 1 Navigate to https://trello.com/ 2 Click on the Tutoria...