15579 matches found
Rocket.Chat: Message ID Enumeration with Regular Expression in getReadReceipts Meteor method
Summary The getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs. Description Authenticated users are able to query the getReadReceipts Meteor server method to enumerate existing...
Acronis: No server side check on terms of service page which leads to bypass
Hi team, I have found that there is no server side check implemented on the "Acronis Terms of Service and Privacy Statement" Page that is shown after filling the registration form which results in bypassing it without even accepting it. Steps To Reproduce: 1. Register as a new user by filling out...
Mail.ru: Stored XSS on top.mail.ru
Stored XSS via incorrect handling of http page headers on top.mail.ru at created counters...
HackerOne: Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack
Summary: Hi, The host hackerone.com uses cloudlfare to cache static files. The header x-forwarded-scheme can be used to cause a redirect loop, which will be cached by cloudflare. By taking down a JS file, it is possible to cause a total loss of availability on hackerone.com Disclaimer No actual...
Nextcloud: Attacker can obtain write access to any federated share/public link
Hi mates, I stumbled across this with public links. But the same holds true for any federated share. I will try to describe the link scenario. At first I thought there were more steps and resharing was involved. But it really is very simples: 1. An attacker obtains a public link again plenty of...
Moneybird: No rate Limit
Mailing to our support team using the support center in the application was improperly rate limited. There is now a better rate limiter in place...
CS Money: Blind Based SQL Injection in 3d.sc.money
Greetings, Hope Y'all good and fine! Summary: I found a Boolean Blind based SQL Injection in your website = 3d.cs.money It's a URI path injection. The vulnerability tested on the Original IP behind the CloudflareWAF and I've already reported this in my other report 1105673 The Affected URI :...
CS Money: Origin IP found, Cloudflare bypassed
Greetings!, Hope Y'all good and fine. Summary: I would like to report another vulnerability very Similar to my other report in 975991 Due to lack of secure design, I was able to find the origin IPs behind Cloludflare WAF. The IPs I found belong to : 3d.cs.money Description: I was able to find and...
U.S. Dept Of Defense: Reflected XSS on https://█████
Summary: Reflected xss can use to steal user information because it is coming from trusted website. an user can easily trust it and attacker can easily steal user information Steps To Reproduce: 1. go to https://████?profileid=%22%3E%3C/script%3E%3Cscript%3Ealert%27xss%27%3C/script%3E 2. you will...
Mail.ru: SDC bypass on calendar.mail.ru
SDCS cookie was not properly checked for few calendar.mail.ru endpoints, allowing to bypass SDC secure domain cookies protection for privilege separation between projects...
Nextcloud: Leaked of Profile Image from URL changing
Chaning the email address of url will show other's profile images. Impact Leakage of Users Profile Pictures if known email...
Ubiquiti Inc.: Camera adoption DoS - UniFi Protect
A vulnerability was found in UniFi Protect v1.13.7 and earlier that would allow an attacker to use spoofed cameras to perform a denial-of-service attack that could cause the UniFi Protect controller to crash. This vulnerability is fixed in UniFi Protect v1.17.1 and later versions. Affected...
RBKmoney: Apple Pay cryptogram replay and amount tampering
During Apple Pay in-app or on-site payments the device generates a payment cryptogram, which contains a transaction ID, encrypted payment data, etc. This is an example of the cryptogram which the phone passes to the internet acquiring service on api.transferwise.com: "token": "paymentData":...
ExpressionEngine: SQL injection at /admin.php?/cp/members/create
SQL injection vulnerability in the control panel. This is limited to users who have access to the control panel, and the ability to create members...
GitLab: Unauthorized user is able to access schedule pipeline variables and values
Summary The feature allows to add or overwrite variables that are passed to jobs in order to modify the behavior just for that specific instance. As per this https://gitlab.com/gitlab-org/gitlab-foss/-/issues/32568note32531510 , the current security model is If you are owner of schedule as...
Mail.ru: Account takeover in cups.mail.ru using punycode characters
A logical bug in database collation usage for string comparison during access recovery process allowed to takover account in cups.mail.ru by registering colliding Unicode domain...
Omise: Authenticity token doesnt expire after single use leading to CSRF
Summary Once you said that you ruby framework for making the authenticity-token which acts as a CSRF protection. You also send me this as to help me understand https://medium.com/rubyinside/a-deep-dive-into-csrf-protection-in-rails-19fa0a42c0ef . After finding i found that an authenticity-token c...
Visma Public: A sales only user can edit the purchase invoice drafts.
The researcher has found a missing authorization issue: a sales only user could edit the purchase invoice drafts that he shouldn't...
U.S. Dept Of Defense: XSS via X-Forwarded-Host header
Summary: The █████ website is vulnerable to a cross-site scripting flaw if the server receives a crafted X-Forwarded-Host header. Description: The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a...
HackerOne: GraphQL field on Team node can be used to determine if External Program runs invite-only program
On 19th May, A new parameter policymarkdownhtml been introduced inside the team Graphql query. Using Graphql query, We can able to determine External program running privately on Hackerone as policymarkdownhtml parameter was able to fetch private internal policy. Note: Using this parameter, it wa...
U.S. Dept Of Defense: Arbitrary file upload and stored XSS via ███ support request
Summary: A malicious user can upload files of any type when submitting a support request. Impact This would allow the attacker to upload malicious executable files as well as .html or .svg files which would allow the attacker to execute malicious code on behalf of the ████ customer support...
Mail.ru: IDOR in tracking driver logs at city-mobil.ru
IDOR vulnerability in taxiserv interface allowed to access a track log of a different driver...
HackerOne: Read-only team members can read all properties of webhooks
Description: A team member can view all properties of webhooks despite not needing them. Steps To Reproduce 1. Have an admin of a program setup webhooks 2. As a team member read-onlylog in 3. Run the following graphql query: query teamhandle: "security" name webhooks nodes id secret url 4. See th...
Weblate: HTML injection and information disclosure in support panel
Hello Weblate Team! I found HTML injection and information disclosure in support panel Description There is a form to weblate.org and hosted.weblate.org to send to support I poisoned the request, where I inserted such payload in all fields: " After that, when my payload got into the support panel...
pixiv: Open redirect protection (https://www.pixiv.net/jump.php) is broken for novels
Summary: I found that pixiv has a open redirect protection, any external link in illustration is converted to https://www.pixiv.net/jump.php?. For example https://i3mx4usociis8twimpcu2ty0erkh86.burpcollaborator.net/abc in https://www.pixiv.net/memberillust.php?mode=medium&illustid=74148892 is...
Midpoint (European Commission - DIGIT): Attacker can read password from log data
Summary: Attacker can read plain text password from log data. Steps To Reproduce: 1. From application dashboard choose Users section, I simultaneously ran process hacker to see the process disk write and read behavior. 2. change the password of one of the users, and you see in process hacker wind...
Internet Bug Bounty: Invalid Read on exif_process_SOFn
This bug is present in exifscanthumbnail method of ext/exif/exif.c file. Detailed description and steps to reproduce for this bug is present in bug report submitted to php.net. Bug Report : https://bugs.php.net/bug.php?id=77540 PHP version : 7.1.26 CVE-ID : 2019-9640 Impact This bug may allow an...
OLX: XSS inside HTML Link Tag
Hello, i discovered XSS in sharjah.dubizzle.com. XSS is reflected inside HTML Link tag so it need some condition to trigger the payload. Step to Reproduce - Visit https://sharjah.dubizzle.com/property-for-sale/land" accesskey="X" onclick=alert1337...
Grammarly: DOM based CSS Injection on grammarly.com
Summary: An attacker can inject an external css file which can lead to phishing attacks and xss in older browsers. Description: Within the main.js file the following code exists: javascript t.prototype.componentWillMount = function var e = this.getCtx.nav.waypoint.query, t = e.extcss, n =...
RATELIMITED: Missing Protection Mechanism in Mail Servers allows malicious user to use staff.ratelimited.me email could lead to identity theft.
Hello ratelimited, I'm not really sure how your mail servers being configured but i guess there is a mis-configuration or missing protection mechanism that fails to verify if the email that is going to be sent are only made by authorized ratelimited staff only. From this point of view a malicious...
Chrome: CVE-2019-5765: 1-click HackerOne account takeover on all Android devices
████████████...
Nextcloud: Stored XSS/HTML injection in autocomplete suggestions for sharing
encrypted report, see attached GnuPG file. I tried to send this by mail, but [email protected] told me that I'm forced sic! to signup here. Please use 7F40 5A4F FAA3 F51B FEFD EE2F CE82 B2C8 6DCE BB9F to contact me. Impact encrypted report, see attached GnuPG file...
Infogram: User account blocking by Internal Server error
If you send a language=en in https://infogram.com/api/users/me user be forever get an Internal Server error EVEN AFTER re-logining: https://youtu.be/AxYa11lEiWA I idk why does hackerone can't upload this video so I uploaded this video privately to the youtube! In this video, I'm trying to relogin...
Mail.ru: ******.*****.my.com open proxy
A proxy host in my.com domain related to partner service located in external network was misconfigured as an open proxy...
Miniclip: xss in miniclip.com
I know this is out of scope but I thought maybe you would like to know about it. video attached Impact Steal session cookies, install keylogger etc etc...
Ruby on Rails: Untrusted strings that are cache fetched with raw option are automatically marshal loaded
This vulnerability effects application code that caches a string from an untrusted source using the raw: true option. For example, vulnerable application code might looks something like the following ruby body = Rails.cache.fetchkey, raw: true, expiresin: ttl do res = Net::HTTP.getresponseremoteu...
Mail.ru: ДОБАВЛЕНИЕ СВОИХ ДАТ В КАЛЕНДАРЬ ПОЛЬЗОВАТЕЛЮ !
Reporter pointed to possibility to mark scheduled meeting request sent via ICS file as accepted in calendar via CSRF by bruteforcing attachment id. Currently, this behavior is not believed to introduce real additional security risks, because meeting can be added anyway without user's intervention...
Mail.ru: [e.mail.ru] XSS в поиске
Reflected XSS in e.mail.ru via GET paramters Multiple reflected XSS in the mailbox via the search param Timeline: Friday, July 6 2018, 23:26 – reported Saturday, July 7 2018, 01:13 – triaged Saturday, July 7 2018, 11:12 – temporary fix Monday, July 23 2018, 14:25 – resolved...
Mail.ru: слепая XSS в админ панели torg.mail.ru через отзыв
Blind XSS in admin panel for torg.mail.ru. torg.mail.ru is not in bug bounty program's scope, a bounty was awarded due to high potential impact. Недостаточная фильтрация приводит к XSS в административной панели в одном из поддоменов mail.ru через имя пользователя при оставлении отзыва...
Dropbox: Bypass Local Authentication (TouchID)
This report describes an attack to bypass TouchID in the Dropbox Mobile iOS application on jailbroken iOS devices. Dropbox doesn’t consider jailbroken devices in scope for our bounty program...
Uber: Reflected XSS in https://eng.uberinternal.com and https://coeshift.corp.uber.internal/
The base parameter of /oidauth/prompt on multiple uberinternal.com subdomains was not sanitized before being reflected into the page body, making it vulnerable to reflected XSS. Additionally, these pages were affected by a clickjacking vulnerability that made exploitation easier, since a click wa...
Shopify: XSS *.myshopify.com/collections/vendors?q=
WAF cut ", but " and ' still in. 1. PoC example link" style="font-size: 1001pt;" 2.mouse on X 3. .. 4.XSS alert message Impact XSS atack...
MyCrypto: Reflected XSS { support.mycrypto.com }
A reflected XSS was reported by sup3r-b0y that was activated by displaying unsanitized values of query parameters. The MyCrypto team worked with sup3r-b0y to identify and verify the fix, and are happy to confirm that the vulnerability described in the report has now been fixed. We are happy to...
RubyGems: Delete directory using symlink when decompressing tar
In 2.7.6, the safety of symlink is confirmed with mkdirpsafe, Before that FileUtils.rmrf destination is running. Therefore, if tmp/dir is specified after tmp - /tmp, the following /tmp/dir is deleted. Proof of concept builder.rb ruby require 'rubygems/package' class GemBuiler def initialize spec,...
Informatica: [http://www.informatica.com]- info disclosure
Researcher has identified and reported an sensitive information leakage in one of our domain. He helped us in resolving the issue...
VK.com: error
Useless logs. Сначало был информатиФФФФ потом лог удалили и ресолвед бат ноу баунти...
Open-Xchange: IDOR allow to extract all registered email
STEP TO REPRODUCE ============================= vulnerable request.... PUT /appsuite/api/user?action=list&columns=1%2C20%2C500%2C501%2C502%2C505%2C524%2C555%2C606%2C614&session=144ebd4f736c475f9e7d681c07a6a50a&timezone=utc HTTP/1.1 Host: sandbox.open-xchange.com User-Agent: Mozilla/5.0 X11; Linux...
Open-Xchange: SSRF - RSS feed, blacklist bypass (301 re-direct)
FYI - Tested on local installation of App Suite 7.8.4 REV 17 Hello, There appears to be another SSRF re-direct vulnerability, similar to my earlier reports that will allow scanning of the App Suite local ports or internal hosts, regardless of blacklist protection in place. The endpoint is the...
VK.com: clickjacking в /lead_forms_app.php
Кликджекинг в «Форме сбора заявок». Можно было угнать номер и почту любого человека который нажмет на кнопкуbuton на нашем сайте, я считаю это довольно серьезно, ибо нажать кнопку можно было под любым предлогом, к примеру создав фейковый опрос на нашем сайте, а подтверждением голосования добавить...