Open-Xchange: Blind XXE via Powerpoint files

Summary During the parsing of Powerpoint files it seems that it is possible to include XXE payload which will be executed on the Open-XChange server. I was able to identify which files exist on the server, and cause the server make arbitrary request to my own server, and I am pretty sure it is al...

U.S. Dept Of Defense: Remote Code Execution (RCE) in a DoD website

A remote code execution RCE vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. @0daystolive and @dly were able to demonstrate this vulnerability by developing a custom script that caused the webserver to execute a benign...

Zendesk: SMTP user enumeration via mail.zendesk.com

Several methods exist that can be used to ██████████ SMTP to enumerate valid usernames and addresses; namely VRFY, EXPN, and RCPT TO. mail.zendesk.com does not reply to EXPN or RCPT TO so we will concentrate on VRFY in this report. The VRFY command will request that the receiving SMTP server veri...

HackerOne: Signals get affected once reports closed as self

According to your documentation "https://hackerone.com/blog/introducing-signal-and-impact" Examples ActivityReputation Report Self close as N/A : 0 . its means Signals are not affected . But our case signal affected by self-closed reports Signals doesn't take the 0 baseline into consideration for...

Shopify: GraphQL AdminGenerateSessionPayload is leaked to staff with no permission

@hiffley reported the ability to generate app tokens via the adminGenerateSession mutation in Shopify Admin, as a staff member with no permissions. This allowed for accessing a small subset of installed apps that are using this new flow including Shopify Email. Access was limited to the current...

Node.js third-party modules: [notevil] - Sandbox Escape Lead to RCE on Node.js and XSS in the Browser

I would like to report a sandbox escape / code injection vulnerability in notevil. It allows an attacker to escape the intended sandbox and execute javascript code in the global context, meaning that he/she can achieve arbitrary command execution RCE when running in nodejs and cross site scriptin...

XVIDEOS: Self-XSS on Suggest Tag dialog box

Summary: Stored cross-site scripting arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. vulnerable URL : https://www.xvideos.com/video57921571/friendb.ifd. Vulnerability Description : Application have a add ta...

GitHub Security Lab: [Java] CWE-327: Add more broken crypto algorithms

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query to detect open Spring Boot actuator endpoints

This bug was reported directly to GitHub Security Lab...

Reverb.com: Disclosure of all uploads to Cloudinary via hardcoded api secret in Android app

Hi, in file com/reverb/app/CloudinaryFacade.java you have hardcoded the following config: java private static final java.lang.String CONFIG = "cloudinary://434762629765715:█████@reverb"; where 434762629765715:████████ is basic auth details. It shouldn't be disclosed to third parties as official...

Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding

Summary: The llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS. Description: When Node receives the following request: http GET / HTTP/1.1 Transfer-Encoding: chunked , identity 1 a 0 it...

Nextcloud: Admin audit is not properly logging unsetting of expiration date

In relation to https://hackerone.com/reports/1177353 1. Enable the audit log 2. Share a file 3. Set and expiration date So far all looks good in the log 4. Unset the the expiration date. 5. See a pretty useless log line Impact The audit log is used to get a full trail of the actions which is now...

Chaturbate: A 10GB file is reachable

Summary A file is 10GB is accessible on the following server: http://edge193.stream.highwebmedia.com:8080/. Steps To Reproduce: 1. Open the following link: http://edge193.stream.highwebmedia.com:8080/download Additional notes: I tried to download the file and analyze it, but after 20 seconds the...

LocalTapiola: /icons/README available on viestinta.lahitapiola.fi

Basic report information Summary: Informational message that the file http://viestinta.lahitapiola.fi/icons/README exists. Description: http://viestinta.lahitapiola.fi/icons/README exists. Domain: http://viestinta.lahitapiola.fi/ Browsers / Apps Verified In: any browser any client Steps To...

Mail.ru: SMTP Header Injection at http://abonement.ucs.ru

It was possible to abuse the functionality of abonement.ucs.ru to send messages to arbitrary e-mail via CRLF injection vulnerability...

Palo Alto Software: Unauthorised access to pagespeed global admin at https://webtools.paloalto.com/

Summary: I came across this subdomain https://webtools.paloalto.com/ which took my attention, after a bit enumeration I found an endpoint which allows anyone to access PageSpeed Global Admin without any type of authentication. Vulnerable URL: https://webtools.paloalto.com/pagespeed-global-admin/...

8x8: Disclosure of Users Information On Wordpress Api [https://jitsi.org/]

Jitsi was running a default WordPress site that had not yet been hardened to prevent user enumeration via the API...

h1-ctf: Hacky Holidays Writeup

On December 12th, 2020, the CTF became live and the scope that we are allowed to attack was In Scope Domain - hackyholidays.h1ctf.com Our main motive was to infiltrate his network and take him down. The challenges appeared one by one till 24th of December. Here we will be going through all the...

Acronis: [acronis.secure.force.com] - Insecure Salesforce default/custom object permissions leads to information disclosure

Hi there, I know that this domain https://acronis.secure.force.com is not listed in scope but I thought it would be a good idea to share this finding with you because this endpoint is leaking internal information/meetings. Target: The Salesforce instance at https://acronis.secure.force.com...

Node.js third-party modules: Bypass of SSRF Vulnerability

Bypass of SSRF report https://hackerone.com/reports/793704 Fix applied after reporting the actual report did not prevent from SSRF issue. https://github.com/TryGhost/Ghost/commit/47739396705519a36018686894d1373e9eb92216diff-3aa52b4b8c6e0fb8422de65648e35887R101 The function fetchOembedData only...

Uber: Pixel flood attack in https://riders.uber.com/profile

Hi, It is the exact issue described here: https://hackerone.com/reports/390 Where uploading lottapixel.jpg it causes your service to time out HTTP/1.1 504 Gateway Time-out Server: nginx Date: Wed, 30 Mar 2016 02:29:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 13928 Connection:...

Ruby on Rails: JSON keys are not properly escaped

Rails does not escape hash keys properly in tojson when generating json. Values are escaped as expected ruby irbmain:001:0 "a"="".tojson = ""a":"\u003c\u003e"" However keys are not: ruby irbmain:002:0 ""="a".tojson = """:"a"" This is because the json gem calls .tos on the keys here which...

curl: CRLF Injection / Protocol Smuggling in libcurl via CURLOPT_USERNAME (IMAP)

Summary: I have discovered a CRLF injection vulnerability in the IMAP protocol implementation of libcurl. The vulnerability exists because the imapatom function in lib/imap.c fails to properly sanitize or quote Carriage Return \r and Line Feed \n characters when processing the CURLOPTUSERNAME...

curl: CVE-2023-28322: more POST-after-PUT confusion

A vulnerability existed in libcurl that allowed an attacker to inject unintended data or cause a segfault by confusing the POST and PUT methods. The previous fix for this vulnerability was insufficient as it only corrected the CURLOPTPOST option, which is not always used when sending data with th...

Liberapay: Full Path disclosure on 500 error

On manipulating cookie + parameter: gitHub 500 error returned with path disclosing of Python Files. Error Below: Traceback most recent call last: File "/opt/python/run/venv/local/lib/python3.6/site-packages/statechain.py", line 328, in loop newstate = functiondeps.askwargs File...

ReddAPI: Login page password-guessing attack

Hello team of Reddapi! Here to report a vulnerability on your site. Affected site: www.reddapi.com Vulnerability: Login page password-guessing attack Severity:Low. Vulnerability description: A brute-force attack is an attempt to discover a password by systematically trying every possible...

curl: CVE-2021-22947: STARTTLS protocol injection via MITM

Summary: A man-in-the-middle can inject cleartext forged responses to future encrypted commands by pipelining them to the STARTTLS response. Steps To Reproduce: Use the attached test case within the curl test system. It is based on IMAP FETCH with explicit TLS. Upon test failure, the downloaded...

U.S. Dept Of Defense: https://█████ is vulnerable to CVE-2020-3452 Read-Only Path Traversal Vulnerability

Summary: https://████████ is vulnerable to a Read-Only Path Traversal Vulnerability Description: Get request parameters at the /+CSCOT+/translation-table and the /+CSCOT+/oem-customization are not properly sanitized which allows for reading files within the webroot directory that are not intended...

Kubernetes: Private IP addresses Disclosure

The following URL leaks the Private IP Addresses:- kubernetes.io/feed.xml The following Server’s Cluster RFC 1918 IP addresses were disclosed in the response: • 10.1.2.3 • 10.104.207.136 • 10.224.0.0 • 10.250.0.0 • 10.250.112.0 • 10.250.96.0 • 10.55.252.216 • 10.96.0.0 • 10.96.0.1 • 10.96.15.180 ...

Ruby on Rails: Open Redirect (6.0.0 < rails < 6.0.3.2)

Hello, I was looking at the change log https://github.com/rails/rails/commit/2121b9d20b60ed503aa041ef7b926d331ed79fc2 for CVE-2020-8185 and found another problem existed. https://github.com/rails/rails/blob/v6.0.3.1/actionpack/lib/actiondispatch/middleware/actionableexceptions.rbL21 ruby redirect...

Internet Bug Bounty: Linux kernel: CVE-2017-1000112: a memory corruption due to UFO to non-UFO path switch

Hi! CVE-2017-1000112 is a vulnerability I found in the Linux kernel caused by a UFO to non-UFO path switch for UFO packets. It can be exploited to gain kernel code execution from an unprivileged process. This vulnerability was reported to [email protected] and linux-distros@ following the...

Uber: Golang expvar Information Disclosure

Package expvar provides a standardized interface to public variables, such as stack trace information and operation counters in servers...

New Relic: Verification Link not expiring leading to Account Takeover.

@bbunnny reported that verification links that are sent out on account creation can be used to access a victim's account until those links have expired. As access to those links requires that an attacker have access to the victim's email, this issue is out of scope for our program...

Udemy: [engineering.udemy.com] - Subdomain Takeover (ghost.io)

Hi Security Team, Found that DNS record of engineering.udemy.com domain was pointing to inactive ghost.io instance. So when we visit https://engineering.udemy.com we will be notified that site doesn't exist. F310092 $ host engineering.udemy.com engineering.udemy.com is an alias for...

Pornhub: Mixed Reflected-Stored XSS on pornhub.com (without user interaction) in the playlist playing section

The researcher discovered a temporarily cached stored XSS using the playlist function of the website. I discovered a Reflected XSS under the PornHub playlists and reported it. Some time after, I noticed, that Reflected XSS using the pkey parameter of the playlist, e.g...

Quora: [controlsyou.quora.com] 429 Too Many Requests Error-Page XSS

Summary: XSS on the error page when the user makes too many requests. Steps To Reproduce 1. Make a lot of requests to get the error 429 2. Open PoC in FireFox https://controlsyou.quora.com/'-alertdocument.domain-' HTTP Response ... ga'set', 'dimension1', 'board-'-alertdocument.domain-''; ga'set',...

Gratipay: grtp.co is vulnerable to http-vuln-cve2011-3192

vulnerability i have found! | http-vuln-cve2011-3192: | VULNERABLE: | Apache byterange filter DoS | State: VULNERABLE | IDs: CVE:CVE-2011-3192 OSVDB:74721 | The Apache web server is vulnerable to a denial of service attack when numerous | overlapping byte ranges are requested. | Disclosure date:...

GitHub Security Lab: Java : Add query to detect Apache Struts enabled Development mode

This bug was reported directly to GitHub Security Lab...

Kaspersky: [Fixed] KIS for macOS is vulnerable to AV bypass due to improper client authorization on XPC service

Note! Thank you for your report. For the purposes of the further analysis of the vulnerability, that you kindly report to us, could you please fill all fields in square brackets. This information will help us to respond you more quickly and triage your report. Thanks a lot for your assistance...

Shopify: Password reset link not expired at Stocky App

You can use password reset link to reset password multiple times. Steps: 1. Go to https://stocky.shopifyapps.com/users/forgottenpassword and Send the password reset link to your email. if this page doesn't appear you should add login details via this https://stocky.shopifyapps.com/preferences/use...

Ubiquiti Inc.: RCE in AirOS 6.2.0 Devices with CSRF bypass

There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution. These vulnerabilities can be also can be also paired with other e...

InVision: CORS Man-in-the-Middle account compromise

Description ==================== The invisionapp application implements HTTPS correctly by redirecting any HTTP traffic to HTTPS; this prevents, for example, the person sitting in the same office or home as you, or someone on the same open-wireless network as you e.g. McDonalds or airport, from...

Slack: State parameter missing on google OAuth

Hi, State parameter i.e anti-csrf token to prevent session hijacking attacks is missing on Google OAuth i.e...

GitHub Security Lab: Java: CWE-297 Insecure JavaMail SSL configuration

This bug was reported directly to GitHub Security Lab...

Zomato: Free food bug done by burp suite

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: By this...

Internet Bug Bounty: Argo CD reconciles apps outside configured namespaces when sharding is enabled

An authorization bypass vulnerability was found in Argo CD versions 2.5.0-rc1 and later, allowing a malicious user to deploy applications outside of the configured allowed namespaces when sharding is enabled. The vulnerability was triggered when an application was updated, and the controller...

ownCloud: Remote Code Execution on ownCloud instances with ImageMagick installed

A vulnerability in ownCloud instances with ImageMagick installed allowed attackers to execute arbitrary code on the system by uploading a specially crafted file and knowing the file path of a previously uploaded file. The vulnerability was due to the usage of ImageMagick for preview generation fo...

Pornhub: Account takeover via Pornhub Oauth

The researcher found it was possible to take over a YouPorn account by using an unverified account with matching email address to sign up to PornHub. this vulnerability works by abusing an insecure OAuth implementation. Due to improperly implemented oauth fuctionality and lack of user information...

HackerOne: Account takeover of existing HackerOne accounts through SCIM provisioning

The SCIM provisioning feature in HackerOne's sandbox program was vulnerable to account takeover. An attacker could create a user with an email they controlled, import existing users, assign the victim account to the attacker's user, change the email parameter, and reset the password to gain acces...

U.S. Dept Of Defense: Reflected XSS via Moodle on ███ [CVE-2022-35653]

A reflected XSS vulnerability was identified in the LTI module of Moodle. The vulnerability was caused by insufficient sanitization of user-supplied data in the LTI module. A remote attacker could have tricked a victim into following a specially crafted link, which could have executed arbitrary...