Internet Bug Bounty: CVE-2019-11043: a buffer underflow in fpm_main.c can lead to RCE in php-fpm

The vulnerability exists in php-fpm because of missing bounds check in fpmmain.c. If the FastCGI variable PATHINFO is empty, the underflow happens when the code tries to calculate the value of the pathinfo variable. An invalid pointer in pathinfo leads to a single byte out-of-bounds write, which...

Nextcloud: Docker image with FPM is vulnerable to CVE-2019-11043

The CVE-2019-11043 vulnerability can be exploited in the latest nextcloud:fpm image. This is due to the specific nginx configuration recommended for nextcloud: https://github.com/nextcloud/dockerbase-version---fpm...

Ruby on Rails: XSS by file (Active Storage `Proxying`)

Hello, I've seen similar issues with 407319 and 429868 occur with Active Storage's new File serving strategies Proxying. Commit is https://github.com/rails/rails/commit/dfb5a82b259e134eac89784ac4ace0c44d1b4aee. ruby...

Keybase: SOP bypass using browser cache

Summary An attacker has the ability to extract sensitive information from user's accounts, due to a CORS issue. On a minor note, this also is a cross-site leak as we can fingerprint what exact keybase user has accessed the attacker's website. Information disclosed:...

Shipt: Multiple Subdomain Takeovers: fly.staging.shipt.com, fly.us-west-2.staging.shipt.com, fly.us-east-1.staging.shipt.com

A researcher identified 3 different abandoned subdomain CNAME records that pointed to a 3rd party service fly.io that Shipt had recently stopped using. Upon receiving the report, the Shipt information security team responded quickly and resolved the issue by removing the stale DNS records...

Ruby: Escape sequence injection vulnerability in WEBrick BasicAuth

WEBrick BasicAuth outputs any non-existing user name to logs without sanitizing. By exploting this, an attacker can inject malicious escape sequences to its logs. This issue is exactly the same as the old already-fixed vulnerability. How to reproduce: 1 Run this WEBrick server program in a...

Starbucks: CSRF: add item to victim's cart automatically (starbucks.com - updatecart)

Steps: 1. Victim login their starbucks account first. 2. Attacker send a form/link to victim. 3. If victim click the form/link, An item would automatically add to victim's cart. 4. If victim do not find this item, he/she would pay for this item which can greatly influence your repuation. Attached...

O1 Labs: SPF Records

The vulnerability was that you can spoof their email address and then the attacker can send emails from their email address which could lead to sending fake emails or attempts of phishing. To see if you can send an email of a target domain you need to check if it has an SPF Sender Policy Framewor...

Yelp: JDBC credentials leaked via github

Summary: jdbc credentials found on a public github repo.though the repo belongs to yelp or not there is a doubt.I have found many more sensitive data on that repo.so kindly check the repo all together.sensitive data found publicly. Platforms Affected: website Steps To Reproduce: 1. visit the link...

h1-ctf: [h1-415 2020] Spent a week and failed at solving the last step.

Summary: I found something interesting with Headless chrome debugging in the last step, I am sure I am going to solve this after trying very hard for about a week, I don't know when this CTF is going to end, that's why I am submitting a summary of how to solve this so that I can write the full...

Node.js third-party modules: Denial Of Service in Strapi Framework using argument injection

I would like to report Denial Of Service in Strapi Framework.It allows attacker to force restart the server using argument injection. Module module name: strapi version: 3.0.0-beta.18.3 and earlier npm page: https://www.npmjs.com/package/strapi Module Description The Strapi HTTP layer sits on top...

Pornhub: Unsecured Elasticsearch Instance

The researcher has found an insecure Elasticsearch instance accessible to the public. A publicly accessible server running Elasticsearch instance was identified, due to a firewall misconfiguration. The instance was only intermittently accessible because of round robin ordering. The instance...

Mapbox: Mapbox API Access Token with No Scope Can Read Styles

HI I created one api token with 0 scope. Then I sent the following request to server GET /styles/v1/katilthe?accesstoken=pk.eyJ1Ijoia2F0aWx0aGUiLCJhIjoiY2lsbWJwcWpjNjhmNnZubWNhYXdwZm5obyJ9.2cPnaIiXcFnDRFMfrD1TRw HTTP/1.1 Host: api.mapbox.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:44.0...

Sifchain: Path Transversal inside saveContracts.js

Reference: https://portswigger.net/web-security/file-path-traversal Directory traversal also known as file path traversal is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data,...

GitHub Security Lab: Java: CWE-522 Insecure basic authentication

This bug was reported directly to GitHub Security Lab...

U.S. Dept Of Defense: No Rate Limiting on https://██████/██████████/accounts/password/reset/ endpoint leads to Denial of Service

Summary: No-Rate Limit on Password reset endpoint results mail-spam functionality to be abused. Additionally, the password-reset link remain the same after each request. Description: Malicious user could Spear-target █████████ user mail and Spam it for as many requests as he would like. Possible...

Stripo Inc: subdomain takeover at status-stage0.stripo.email

The subdomain status-stage0.stripo.email was pointed at uptimerobot.com whereas it was not being used , but having Cname record as stats.uptimerobot.com . Hence anyone can takeover it. I have parked it with an account on uptimerobot.com note : this issue is similar to report but with another...

8x8: CVE-2019-11248 on http://█.█.█.█:9100/debug/pprof/goroutine

@mrk0anti reported to us an exposed debugging endpoint /debug/pprof over the unauthenticated Kubelet healthz port 9100. No sensitive information has been disclosed & the affected host belonged to our staging environment. The issue has been rectified...

Tor: Information Exposure Through Directory Listing

Vulnerability description The web server is configured to display the list of files contained in this directory. This is not recommended because the directory may contain files that are not normally exposed through links on the web site. Link as POC: https://www.torproject.org/static/...

8x8: Subdomain takeover of ████.jitsi.net

Summary █████.jitsi.net points to an AWS EC2 instance at 18.195.93.116 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing ...

h1-ctf: h1 hacky holidays CTF solution

Simple script to print all the flags. Full solution to follow want to spend more time writing this, but am racing to be first 10 submissions: echo "Flag 1 -- robots.txt" curl https://hackyholidays.h1ctf.com/robots.txt 2/dev/null | grep flag echo "" echo "Flag 2 -- js descrambed --...

GitHub Security Lab: CodeQL query for SpEL injections

This bug was reported directly to GitHub Security Lab...

Qulture.Rocks: Unrestricted File Upload in Chat Window

Summary: The application allows the attacker to upload dangerous file types that can be automatically processed within the product's environment. Steps To Reproduce: 1. Hit the browser with below URL. https://qa.qulture.rocks/en/users/signin 2. Open The Cat window. 3. Upload any exe file . 4. Cli...

Ubiquiti Inc.: RCE in AirOS 6.2.0 Devices with CSRF bypass

There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution. These vulnerabilities can be also can be also paired with other e...

CodeIgniter: Vulnerable Javascript library

Hi @codeigniter, Description You are using a vulnerable Javascript library. One or more vulnerabilities were reported for this version of the Javascript library. Consult Attack details and Web References for more information about the affected library and the vulnerabilities that were reported...

Slack: Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack users

An issue in Slack's Create snippet feature results in filetypes being displayed incorrectly. This can lead to RCE if a Slack user downloads an executable file thinking that it is a CSV or other benign file type. https://www.youtube.com/watch?v=cIlGfnn4iG8...

U.S. Dept Of Defense: DoS at ████████ (CVE-2018-6389)

An unauthenticated attacker could cause a denial of service resource consumption on a WordPress site by using the large list of registered .js files to construct a series of requests to load every file many times. The vulnerability was registered as CVE-2018-6389...

Imgur: 8ybhy85kld9zp9xf84x6.imgur.com Subdomain Takeover

Hello Gents, + While testing Imgur I found an unclaimed subdomain which is; “8ybhy85kld9zp9xf84x6.imgur.com”, and I was able to claim it! + But actually I didn't upload or host a simple file like mrbaka.html, because I need to upgrade the account to be able to use this custom domain! + Anyway, yo...

Clario: Google API key leaks and security misconfiguration leads Open Redirect Vulnerability

Summary: Hello, when i search your targets and javascript files I found an googleapikey leaks in url = https://account.clario.co/js/main.044af6485f6b0cd90809.js. Part of the leak down below; 'https://firebasedynamiclinks.googleapis.com/v1/shortLinks?key=AIzaSyAw-SpLHVTIP3IFEIkckCuEmIhnUrY9OrQ';...

U.S. Dept Of Defense: Remote Code Execution on █████████

Summary: An unauth solr lead to RCE on ██████████ Description: Hello, I found a solr unauth at https://██████/solr/ This version is 5.5.1, vulnerable with CVE-2019-0192 and CVE-2019-0193, i have try CVE-2019-0193 and successful RCE. Impact Attacker can get shell on server. Step-by-step Reproducti...

Shopify: SSL cookie without secure flag set

hello shopify security team, I have found security vulnerability. Vulnerable URL :- https://app.shopify.com/services/signup/track/ The following cookie was issued by the application and does not have the secure flag set: signupsessionid=0875b12b680173807271e6c444a964e8; path=/; expires=Mon, 04 Ma...

Sifchain: No Valid SPF Records/don't have DMARC record

Hiii, There is any issue No valid SPF Records on https://sifchain.finance/ Desciprition : There is a email spoofing vulnerability.Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing ...

Zomato: Information Disclosure through Sentry Instance ███████

Hello team I found a bug sensitive information can be used from attackers to perfom attack in youre server I don't know if this in scope so i'm sorry if i'm wrrong withou spending youre time here the steps how i found this bug : 1-Please use burp suite to reproduce the same result 2-i notice you...

Informatica: [███] Cross-Site Scripting (XSS) via /ssl-vpn/getconfig.esp at GlobalProtect VPN Portal

A Cross-Site Scripting XSS vulnerability was discovered in the GlobalProtect VPN portal's getconfig.esp endpoint. The vulnerability existed because the application reflected user input from the user parameter in an XML response without proper sanitization. This allowed an attacker to inject SVG...

Weblate: Open Github Repo Leaking WEBLATE SECRET KEY

Team, While going through Github search I discovered a public repository which contains Weblate Secret Key Issue & Poc: Repo: https://github.com/WeblateOrg File:https://github.com/WeblateOrg/weblate/blob/592472958f7b847701c51b36f4768b9784219fa1/weblate/settingsdocker.py SECRETKEY = os.environ.get...

Smule: Open redirect bypass & SSRF Security Vulnerability

Open redirect issue. Full disclosure/writeup: https://medium.com/@snwlvl...

Snapchat: Exposed Kubernetes API - RCE/Exposed Creds

@txt3rob found one of Snaps internal Kubernetes instances exposing an API endpoint without authorization to the public. With access to this API he was able to run arbitrary code/jobs as a cluster-admin and gained access to credentials with internal access to a significant number of instances...

Gratipay: UDP port 5060 (SIP) Open

SIPSession Initiation Protocol udp port 5060 is open in www.gratipay.com host . Bug id - CSCtj04672 Refer CVE-2011-3280 It may be the cause of DDOS and many other attack...

X (Formerly Twitter): HTTP Response Splitting (CRLF injection) due to headers overflow

Hi, I would like to report another HTTP Response Splitting vulnerability caused by header fields "overflow" that allows attackers to inject arbitrary headers in the response. Note that this issue is similar to 52042 but the root cause is different. Also, the below PoC is not the only affected pag...

curl: Buffer Overflow Vulnerability in strcpy() Leading to Remote Code Execution

Summary: The vulnerability in the program arises from a classic buffer overflow, triggered by the unsafe use of the strcpy function without bounds checking. The program copies data from a source buffer to a destination buffer, allowing attackers to overflow the buffer if the input string exceeds...

TikTok: URL Scheme misconfiguration on TikTok for IOS

A misconfigured URL schema on a TikTok iOS endpoint could have resulted in a user being forced to follow other accounts by visiting a malicious website or HTML page. We thank @glassplant for reporting this to our team...

GitHub Security Lab: [go]: Add query for detecting CORS misconfiguration

This bug was reported directly to GitHub Security Lab...

Stripo Inc: No length on password

Hey when I try to set the password while creating account I noticed that you haven't kept any password limit. You need to decrease password length :There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource consumption on behalf of...

LocalTapiola: Disclosure of Users Information via Wordpress API (?rest_route)

Summary: It's possible to get information about the users registered such as: id, name, login name, etc. without authentication in Wordpress via API on www.lahitapiolarahoitus.fi. Description: By default Wordpress allow public access to Rest API to get informations about all users registered on t...

U.S. Dept Of Defense: LDAP Anonymous Login enabled in ████

LDAP Anonymous Login was enabled in ██████████, allowing unauthorized users to connect to the LDAP server without providing any authentication credentials. This could lead to unauthorized access and retrieval of sensitive information stored in the LDAP directory...

GitHub Security Lab: CodeQL query to detect Server-Side Template Injections (JavaScript)

This bug was reported directly to GitHub Security Lab...

Alibaba BBP: SSRF / Arbitrary File Read on Alibaba Cloud Academy

Summary: Alibaba Cloud Academy certificate download function is vulnerable with SSRF bug. It can also read arbitrary file on the server. Steps To Reproduce: - Login to your https://edu.alibabacloud.com/ account - Click the url to Ping external...

Insolar: XDSI(Cross Domain Script Inclusion)

Summary: As I did not get the proper CWE id over id to add but the proper CWE id is 829: The page includes one or more script files from a third-party domain. Here you are including in your website, someone else's code; You don't have any control over what is in that code, and you don't have any...

Stripo Inc: Information disclosure through Server side resource forgery

Summary: The application https://my.stripo.email has a template feature where can we can enter html code. By including an iframe in the html template, I was able to make a call to my server. This exposed an internally running web application. Please refer below, 63.33.82.168 - -...

HackerOne: latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users

Mini information disclosure related with team's internal comments/assign group activity id and datetime are exposed Steps: 1 As victim, Create a sandbox team and create report 2 Add attacker as a participant for the report 3 As victim, create some internal comments team -only comments /assign gro...