HackerOne: ImageMagick GIF coder vulnerability leading to memory disclosure

Hello Hackerone Security Team, Well,we are aware of Imagemagick Gif parsor method to collect the pixels and then we can recover it to gain server information. https://github.com/neex/gifoeb However,it has no impact on hackerone since it's immune to gif files uploading functionality. So, ,gif...

HackerOne: HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com

The subdomain info.hackerone.com is vulnerable to HTTP header injection. I'm aware that you are only interested in critical issues affecting this subdomain. However, you may be interested in this issue as a vulnerability in this domain may affect the domain hackerone.com. The vulnerability is a...

Internet Bug Bounty: Buffer overflow in req_parsebody method in lua_request.c

Software Versions ------------------- Ubuntu - 18.04 32-bit Apache 2.4.51 32-bit Description ------------- This bug is present in "reqparsebody" method of modules/lua/luarequest.c file. Below mentioned lines of code cause this bug. cpp ... sizet vlen = 0; ... ... vlen = end - crlf - 8; buffer =...

Nextcloud: Full path disclosure vulnerability via Upload .htaccess file

Hello Security team, i foud Full path disclosure vulnerability via Upload .htaccess file see POC video. Thankz Impact Sensitive File/Folder Information...

h1-ctf: [h1-415 2020] I found Joberts missing file!

The key is: h1ctfy3s1mc0sm1cn0w My writeup is available unpublished at: https://p4fg.github.io/h14152020/ I might edit some styling but the main contents is there. The twist of my writeup is that tried to give a detailed account of EVERYTHING to allow new hackers to follow along my discoveries an...

Rockstar Games: LFI and SSRF via XXE in emblem editor

This summary is provided by the researcher who submitted this report, @alexbirsan . About one year after I started messing with the emblem editor, I finally found a full SSRF and LFI. I was able to extract text files from the server and HTTP responses by rendering them on my crew emblem. For thos...

LocalTapiola: OpenSSL Padding Oracle Attack (CVE-2016-2107) on viestinta.lahitapiola.fi

Hello Lahitapiola Security Team, I would like to make two reports: 1. Subdomain viestinta.lahitapiola.fi is vulnerable to CVE-2016-2107 . 2. All the Lahitapiola domains/subdomains in scope of bug bounty have weak cipher suites and are susceptible to various SSL related attacks. Subdomain...

Node.js: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests

Summary: Node.js is vulnerable to HTTP denial of service DOS attacks based on delayed requests submission which can make the server unable to accept new connections. Description: An attacker can open an arbitrary number of HTTP connections and keep the server busy by never completing the request...

Legal Robot: SSL BREACH attack (CVE-2013-3587)

Hello security team, The site legalrobot.com is potentially vulnerable to the BREACH attack. Allowing an attacker the ability to: - Inject partial chosen plaintext into a victim's requests - Measure the size of encrypted traffic - can leverage information leaked by compression to recover targeted...

Glovo: Moodle XSS on evolve.glovoapp.com

Cross Site Scripting XSS / Moodle XSS Summary : Cross-site scripting XSS is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by...

GitHub Security Lab: CodeQL query to detect JNDI injections

This bug was reported directly to GitHub Security Lab...

h1-ctf: [h1-415 2020] h1ctf{y3s_1m_c0sm1c_n0w}

Summary: add summary of the vulnerability Account takeover was possible because of the email validation used - [email protected] could be registered, but when the the system created the recovery QR code the extra symbols would get stripped leaving us with a valid recovery QR code to log into...

RBKmoney: Information Disclosure - Composer.lock

Non-sensitive information disclosure via composer.lock...

GitHub Security Lab: CPP: Out of order Linux permission dropping without checking return codes

This bug was reported directly to GitHub Security Lab...

Courier: Logout page does not prevent CSRF

Summary: Cross-Site Request Forgery CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. ... If the victim is an administrative account, CSRF can compromise the entire web application. Steps To Reproduce: 1.Create a...

X (Formerly Twitter): Sub Domain Takeover at mk.prd.vine.co

Hey It looks like the EC2 Instance at mk.prd.vine.co has been stopped and now it has been assigned to someone else Proof of Concept 1. http://mk.prd.vine.co/ few days back didn't have port 443 open but now it does have an open port 443 Response 400 Bad Request 400 Bad Request awselb/2.0 So it loo...

IRCCloud: Exposed, outdated nginx server (v1.4.6) potentially vulnerable to heap-based buffer overflow & RCE

Summary ======== During my reconnaissance for your bug bounty program, I discovered an instance of nginx version 1.4.6 running at the IP address https://54.153.101.52. To locate it, I search for IRCCloud-related certificated and found the self-signed certificate for this server...

h1-ctf: [h1ctf-Grinch Networks] MrR3b00t Saving the Christmas

Disclaimer: Certain things are a bit modified to set the pieces for the story. Also you can find the flags for all 12 challenges in file F1138300 , Now enjoy : █▀▄▀█ █▀█ ░ █▀█ █▄▄ █▀█ █▀█ ▀█▀ █░▀░█ █▀▄ ▄ █▀▄ █▄█ █▄█ █▄█ ░█░ saves the Christmas Episode - 0x00 Pil0t.py It was a gloomy clear night,...

RATELIMITED: xss in /users/[id]/set_tier endpoint

Summary: add summary of the vulnerability Hello there ! I found an XSS since you forgot to add the json content-type response header right there: https://github.com/gtsatsis/RLAPI-v3-OOP/blob/508d3c610ccc9076753bdc81151a5e8d76871a3e/src/Controller/UserController.phpL93 The tier parameter is...

Chaturbate: No rate limiting in changing room subject.

Before i shed more light on this: I noticed i can create over 200 apps but i don't really know how valid that was. I want to report that there is no rate limiting in changing room subject. Attacker scenrio: 1. Navigate to https://chaturbate.com/b/your username 2. Try to create a room subject and...

hostinger : 1 Click Account Takeover via Auth Token Theft on marketing.hostinger.com

The vulnerability discovered in the marketing.hostinger.com subdomain allowed for one-click account takeover through the theft of authentication tokens. An attacker could exploit the whitelisted redirect functionality of the subdomain to steal a victim's authentication token, which could then be...

GitLab: RCE when removing metadata with ExifTool

Summary When uploading image files, GitLab Workhorse passes any files with the extensions jpg|jpeg|tiff through to ExifTool to remove any non-whitelisted tags. An issue with this is that ExifTool will ignore the file extension and try to determine what the file is based on the content, allowing f...

InnoGames: Cache Poisoning via uppercase letters in invalid path

Summary of the issue Cache poisoning vulnerability appears in the request to innogames.com. The issue arises when language path parameter from the url gets processed on the backend to become lowercase. Then if a path provided in X-Forwarded-Host does not exist on the server, 301 response is...

curl: CVE-2022-27776: Auth/cookie leak on redirect

Summary: Curl can be coaxed to leak Authorisation / Cookie headers by redirecting request to http:// URL on the same host. Successful exploitation requires that the attacker can either Man-in-the-Middle the connection or can access the traffic at the recipient side for example by redirecting to a...

U.S. Dept Of Defense: ███ ████████ running a vulnerable log4j

Report Description: https://vulners.com/cve/CVE-2021-44228 Impact Probably arbitrary code execution System Hosts ███████ Affected Products and Versions CVE Numbers CVE-2021-44228 Steps to Reproduce 1. Browse to https://██████████/█████████https%3A%2F%2F███%2F 2. Enter a...

TikTok: Unauthorized Access to TikTok Account [Private Videos] via API Endpoint

The vulnerability on a TikTok endpoint that allowed unauthorized viewing of videos from private accounts was discovered and reported by @datph4m. The issue was subsequently remediated...

OneWeb: Vulnerable Jira Instance

Multiple information exposure vulnerabilites were identified in a Jira Server instance unauthenticated access to APIs and system browser functions. @lesleybw found multiple CVEs and exposures on a Jira instance owned by OneWeb 1...

GitHub Security Lab: XPath Injection query in java

This bug was reported directly to GitHub Security Lab...

Node.js third-party modules: [exceljs] Possible XSS via cell value when worksheet is displayed in browser

Hi Team, I would like to report Stored XSS vulnerability in exceljs module. It allows to execute JavaScript code embeded in the XLS sheet when data from the sheet are displayed in the browser. Module module name: exceljs version: 1.4.6 npm page: https://www.npmjs.com/package/exceljs Module...

Showmax: Wordpress directories/files visible to internet

A misconfiguration caused two directories being listable in our marketing blog that's running on wordpress. As the domain is out-of-scope of our program and the uploaded files include marketing material, it had no serious impact...

Node.js: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)

A timing side-channel vulnerability in the crypto library's privateDecrypt API allowed attackers to remotely exploit and decrypt or forge signatures when processing encrypted messages...

Mail.ru: [iot-hackathon.geekbrains.ru] Tilda Subdomain Takeover

iot-hackathon.geekbrains.ru subdomain was delegated to tilda.cc service, which is vulnerable to takeover...

X (Formerly Twitter): IDOR- Activate Mopub on different organizations- steal api token- Fabric.io

Hello, There is an option to enroll your organization in fabric.io for mopub , but this particular end point is missing proper authorization checks allowing any user to steal API tokens. Vulnerable request ================ POST /api/v3/organizations/5460d2394b793294df01104a/mopub/activate HTTP/1....

HackerOne: Login page password-guessing attack

A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works. hackerone.com page doesn't have any protection against password-guessing attacks brute force...

Flickr: Information Disclosure: .dockerignore file is publicly accessible

Vulnerability description not provided...

Dropbox: Full Response SSRF via Google Drive

This researcher pointed out that HelloSign's Google Drive doc export feature had a URL parsing issue that could allow extra parameters to be passed to Google Drive API. By making use of an extra parameter in the Google Drive API, it was possible for researchers to force HelloSign to parse externa...

PlayStation: Use-After-Free In IPV6_2292PKTOPTIONS leading To Arbitrary Kernel R/W Primitives

Summary Due to missing locks in option IPV62292PKTOPTIONS of setsockopt , it is possible to race and free the struct ip6pktopts buffer, while it is being handled by ip6setpktopt. This structure contains pointers ip6popktinfo that can be hijacked to obtain arbitrary kernel R/W primitives. As a...

SHEIN: RCE via npm misconfig -- installing internal libraries from the public registry

The following node package has been installed on at least one shein owned build/development server directly from the public npm registry. https://www.npmjs.com/package/shineout-mobile This package should normally be downloaded from the internal shein registry, but a misconfiguration appears to ha...

Khan Academy: Cross site scripting (content-sniffing)

Your website may be vulnerable to cross site scripting attacks HTTP request: GET...

Bumble: Email Spoofing

There is an Email Spoofing Vulnerability. Steps to reproduce: 1 Go to http://emkei.cz/ 2 Fill "From Email" field to [email protected] or any other badoo email. 3 Fill the victim's address your address to "TO" field and fill in other details as you wish. You will receive email from badoo admin...

ownCloud: SMB User Authentication Bypass and Persistence

Authentication Bypass ================== The external user authentication app in OwnCloud does not properly authenticate against an SMB server. In it's current implementation, the file owncloud/apps/userexternal/lib/smb.php, line 46-47 uses the command smbclient -L //host/dummy -Uuser%pass, where...

Nord Security: Arbitrary Set-Cookie via "?coupon=" due to semi-colon not encoded

Related to , the separator in the cookie header is semi-colon ; and this issue is caused by semicolon ; not encoded, so the attacker can arbitrarily manipulate cookies. Arbitrary set cookie will cause several problems like: - Session Fixation - Cookie Bomb Client-Side DoS - Etc Vulnerable Endpoin...

Razer: Expired reCAPTCHA site key leads to Rate Limit Bypass and Email Enumeration

The tester discovered a configuration issue involving Google reCAPTCHA that would allow adversaries to enumerate valid email addresses for users. While minor, Razer appreciates the report and clear PoC...

Node.js: url.parse() hostname spoofing via javascript: URIs

Summary: Using url.parse in security sensitive checks is dangerous as an arbitrary hostname can be spoofed via javascript: URIs. Description: The original url.parse API is dangerous as it allows to spoof an arbitrary hostname via a javascript: URI: bash $ node -e...

Pornhub: Reflect XSS on Mobile Search page

The user was able to exploit the 'search' parameter being reflected in the page body in order to execute reflected XSS within the context of Redtube. Many of developer confuse that adding slashes at double quotes can protect the xss. However, At the DOM, Adding slashes is not protecting XSS...

Pornhub: [IDOR] Deleting other users comment

Hello, Normally you cannot delete comments if you post on someones stream and i have found a way to delete others comment. PoC: https://youtu.be/mxEE9vcxKA Let me know if you cannot reproduce it ! Thanks! Mikko...

Sifchain: Vulnerable javascript dependency at Main domain

Hello, Issue detail, Burp observed 1 outdated JavaScript libraries with 4 known vulnerabilities. Burp detected bootstrap version 4.0.0, which has the following vulnerabilities: CVE-2019-8331: XSS in data-template, data-content and data-title properties of tooltip/popover CVE-2018-14041: XSS in...

Uber: RCE via npm misconfig -- installing internal libraries from the public registry

The hacker spotted some orphaned references to Uber-branded Node.js library packages and claimed them on the public NPM registry to run their own proof-of-concept code. Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies...

h1-ctf: [H1-2006 2020] Bypassing access control checks by modifying the URL, internal application state, or the HTML page, or using a custom API attack tool

H1-2006 CTF Writeup F859938 Summary: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification or destruction of all data, or performing a business function outside of the limits of...

Kubernetes: No valid SPF record found

Desciprition : There is a email spoofing vulnerability.Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing is a tactic used in phishing and spam campaigns because people are more...