Zomato: Bypass OTP verification when placing Order

Description Attacker was able to bypass the OTP verification needed while placing an order with a restaurant...

Nextcloud: Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate

Summary: Call to registerReceiver misses the broadcastPermission argument - no permissions will be checked for the broadcaster, which allows a malicious application to communicate with the broadcast receiver. Supporting Material/References: Screenshot Snyk report references to fixes in other repo...

Internet Bug Bounty: rpcbind "rpcbomb" CVE-2017-8779, CVE-2017-8804

Description: this allowed an attacker to easily disrupt a remote system through excessive memory consumption. Writeup: https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/ Demonstration video: https://www.youtube.com/watch?v=b38H3oEgrQw this video shows...

Internet Bug Bounty: CVE-2022-27776: Auth/cookie leak on redirect

Summary: curl/libcurl can be coaxed to leak Authorization / Cookie headers by redirecting request to http:// URL on the same host. Successful exploitation requires that the attacker can either Man-in-the-Middle the connection or can access the traffic at the recipient side for example by...

GitHub Security Lab: Java: CWE-273 Unsafe certificate trust

This bug was reported directly to GitHub Security Lab...

HackerOne: HTML injection can lead to data theft

Hey, This is more like an in-depth security thing with a reasonable attack scenario. In some occasions, it seems to be possible to leak sensitive data to an external server, not affected by the CSP. This can happen in the following situation: 1. There's a HTML injection vulnerability 2. The...

Pornhub: Publicly exposed SVN repository, ht.pornhub.com

After I found the subversion repository I visited the following location https://netreact.eu/hubtraffic I could see the usernames in the repo and the following weak credentials gave me access: stefan:123456 An attacker can commit code to this location which could be mirrored on the main site and...

Khan Academy: https://www.khanacademy.org/login open-redirect

Hi, I found a bypass in the redirects : https://www.khanacademy.org/login?continue=http://www.olivierbeg.nl won't work. https://www.khanacademy.org/login?continue=http:/www.olivierbeg.nl will work :- Best regards, Olivier Beg...

Tor: Snowflake server: Leak of TLS packets from other clients

TLS packets from other clients were leaked to Snowflake clients due to a vulnerability in the Snowflake pluggable transport server. This issue allowed Snowflake clients to receive "ghost" packets at the KCP layer, containing TLS packets unrelated to the current session. The leaked packets include...

h1-ctf: [H1-2006 2020] Writeup

^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ Prologue The CTF was announced in a Hacker0x01 tweet. The goal is to make payments from Marten Mickos' account on BountyPayHQ. The announcement tweet was followed shortly by a retweet of BountypayHQ, an account made for the event. BountypayHQ has one...

Brave Software: HTTP Request Smuggling

When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being awa...

DRIVE.NET, Inc.: Same site Scripting

Same site scripting I have found an error of some misconfigured DNS in a subdomain of yours which causes same site scripting. PoC 1 Open a terminal and type ping localhost.drive2.ru You would see that it resolves back to 127.0.0.1 A screenshot has been attached Impact This may cause security issu...

Nextcloud: Wordpress 4.7.1

Greetings, I observed that your website https://nextcloud.com still use wordpress 4.7.1 + WordPress version 4.7.1 Released on 2017-01-11 identified from advanced fingerprinting This version of wordpress is vulnerable to : ---- - WPQuery SQLi injection - XSS vulnerability was in the posts list tab...

HackerOne: AWS S3 bucket writeable for authenticated aws users

Hi All, I know that hackerone-attachments is used for file uploads on reports and so I did a quick scan for similar buckets and found . While I can't confirm if you own it or not, it appears that it is publicly writable using the aws cli. When I tried to write to hackerone-attachments, I get: "mo...

HackerOne: Bypassing HackerOne 2FA due to race condition

A race condition vulnerability was discovered in HackerOne's 2FA reset process. The issue allowed an attacker to initiate multiple parallel 2FA reset requests, resulting in multiple reset notification emails. When a user canceled one reset request, the remaining requests would stay active,...

Reddit: CVE-2020-11022

Vulnerability description not provided...

HackerOne: Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information

When a Report is submitted on HackerOne.com, a feature called the Report Duplicate Detector helps program members and triagers find potential duplicates of the submitted report. This feature will match against all reports that were submitted to the program. When the feature was introduced, all...

U.S. General Services Administration: PHP info page disclosure

phpinfo is a debug functionality that prints out detailed information on both the system and the PHP configuration. Step to reproduce: Go here: https://mysmartplans.gsa.gov/phpinfo.php An attacker can obtain information such as: Exact PHP version. Exact OS and its version. Details of the PHP...

curl: Abusing URL Parsers by long schema name

Summary: There is known technique to exploit inconsistency of URL parser and URL requester logic to perform Server Side Request Forgery attack. Firstly it was presented by Orange Tsai at A New Era Of SSRF Exploiting URL Parser. Firstly I found the familiar issue at old versions of curl, but explo...

PortSwigger Web Security: SMTP interaction theft via MITM

See http://www.postfix.org/CVE-2011-0411.html for adetailled description. Impact MitM could obtain user credentials...

Grammarly: Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's origin

Summary: Attacker could trigger Grammarly extension's gnar.fetch command using a crafted page to perform XHR with cookies and any configurational params to any cross-origin resource. Description: Page could Init Grammarly popup editor no user gesture, helper Events have isTrusted property, which...

WHO COVID-19 Mobile App: DMARC and SPF records

If you are encountering this error of No DMARC Record found, this means that your domain does not have a published DMARC record. DMARC Records are published via DNS as a textTXT record. They will let receiving servers know what they should do with non-aligned email received from your domain...

Node.js: `fs.realpath.native` on darwin may cause buffer overflow

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: The libuv's implementation of...

GitHub Security Lab: [javascript] CWE-020: CodeQL query to detect missing origin validation in cross-origin communication via postMessage

This bug was reported directly to GitHub Security Lab...

HackerOne: Potential stored Cross-Site Scripting vulnerability in Support Backend

HackerOne maintains an internal Support Backend system for employees. On the internal user profiles for hackers, a small overview is shown that lists the skills the user tagged their penetration tester profile with. Although the skills are currently managed by HackerOne and a user can only pick...

Myndr: Reflected XSS in https://blocked.myndr.net

Summary: Reflected XSS in Domain https://blocked.myndr.net Steps To Reproduce: 1. Go to the https://blocked.myndr.net. 2. Find the endpoint in the domain -https://blocked.myndr.net/?trg=1 3. Add the payload ?trg="alert1 4. You can see the pop up in your browser. Impact With the help of XSS, a...

GitLab: Container scanning and Dependency scanning report leaked to unauthorized users

Hi GitLab Security team Summary GitLab makes the container scanning and dependency scanning information available as part of a JSON endpoint for merge requests. These reports are output of the CI job and should only be displayed if the visiting user has access to CI. However, right now GitLab...

U.S. Dept Of Defense: https://████████ Impacted by DNN ImageHandler SSRF

Summary: https://███████ runs DNN 8.0.0 to 9.1.1 and is impacted by CVE 2017-0929 allowing for a SSRF through the DNN ImageHandler. Origin servers will request any image file supplied by the attacker. This allows for internal NIPR sites to be mapped and accessed through a vulnerable host. The...

curl: Cache purge requests are not authenticated

Vulnerability description not provided...

curl: CVE-2023-27533: Telnet option IAC injection

A vulnerability existed in the CURLOPTTELNETOPTIONS option of the cURL library, which allowed an attacker to inject unintended TELNET commands to the telnet connection by escaping out of the telnet subnegotiation. This could allow the attacker to execute arbitrary OS commands on the target system...

Node.js: Multiple OpenSSL error handling issues in nodejs crypto library

Multiple OpenSSL error handling issues were discovered in the Node.js crypto library up to version 19.2.0. The library did not clear the OpenSSL error stack after operations that may set it, which could lead to false positive errors during subsequent cryptographic operations that happen to be on...

BlockDev Sp. Z o.o: Email HTML injection

Email HTML injection...

GitHub Security Lab: CodeQL query for unsafe TLS versions

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: CWE-532 sensitive info logging

This bug was reported directly to GitHub Security Lab...

Revive Adserver: bypass old password with array in /admin/account-user-email.php

Short Description - attacker maybe change email or password without enter old password with array param. - version:revive-adserver-5.0.4 - os :window POC F712486 Impact attacker maybe change email or password without enter old password...

Brave Software: Torrent extension: Cross-origin downloading + "URL spoofing" + CSP-blocked XSS

Summary: \378809 allows navigating to chrome-extension:// \378805 allows displaying alert windows on chrome-extension:// origin As I said in 378809, navigation to chrome-extension:// allows attacking dependencies/components of extensions. Brave has only 3 extensions installed by default w\o...

Internet Bug Bounty: CVE-2024-53908: Django Potential SQL injection in `HasKey(lhs, rhs)` on Oracle

CVE-2024-53908: Django potential SQL injection in HasKeylhs, rhs on Oracle was reported. The vulnerability was found in the direct usage of the django.db.models.fields.json.HasKey lookup on Oracle databases when untrusted data was used as an lhs value. Applications that used the jsonfield.haskey...

h1-ctf: How The Hackers Saved Christmas

F1139789 Challenge I 🤖 "What are you doing?" I asked myself. I was about to trespass a clear warning to keep out. F1139744 "Have you lost your mind?" But I couldn't help it. I was born for this. And I wasn't going to back down. There are 12 more days until Christmas Eve, and I wasn't going to let...

h1-ctf: A Visit from The Grinch ~ 'Twas the night before Hackmas...

Foreword This was an amazing CTF! The first from Hackerone that I've finished and one that I have enjoyed the most. Huge shout out to @adamtlangley for creating this downright poetic challenge. My whopping 20+ invitations are already being put to good use. Hacky Holidays and Merry Hackmas! Flag 1...

Mail.ru: SQL injection delivery-club.ru (ClickHouse)

Some requests to clickhouse in delivery-club.ru were externally available potentially allowing SQL-like requests execution...

Nord Security: Incorrect control of the trial period

The report by @corryl identified an issue with service expire time validation. A user was able to bypass the subscription period validation checks which in turn allowed a user to use our service for free for a certain time...

Lob: HTTP Request Smuggling on vpn.lob.com

Hi , vpn.lob.com is vulnerable to CL TE Front end server uses Content-Length , Back-end Server uses Transfer-encoding HTTP request smuggling attack. Steps to reproduce 1. Run the burp suite turbo intruder on the following request POST /auth/session HTTP/1.1 Host: vpn.lob.com User-Agent: Mozilla/5...

Internet Bug Bounty: Linux kernel: CVE-2017-6074: DCCP double-free vulnerability

Hi! CVE-2017-6074 1 is a double-free vulnerability I found in the Linux kernel. It can be exploited to gain kernel code execution from an unprivileged processes. The kernel needs to be built with CONFIGIPDCCP for the vulnerability to be present. A lot of modern distributions enable this option by...

Adobe: Parameter tampering can result in product price manipulation

Parameters set during the shopping cart checkout workflow are vulnerable to tampering. By intercepting POST requests and manipulating the XML payload, product prices could be set to arbitrary values. P.O.C Video URL: https://youtu.be/3VMlV7jyzg...

OLX: Name, email, phone and more disclosure on user ID (API)

Hello, When I checked the OLX.pl app, I found out that when I click on a profile, personal information like email or phonenumber is exposed. GET https://ssl.olx.pl/api/v1/users/1/ HTTP/1.1 Host: ssl.olx.pl Cookie: PHPSESSID=hb6utlcj860nd7p2jt6ha0tu71 Connection: keep-alive Accept: / Version: v1.1...

Trello: DOM based XSS via Wistia embedding

Hi, You are using Wistia to embed video at trello.com. However external script from fast.wistia.com vulnerable to XSS and allows to run malicious javascript on your side. vulnerable code: fast.wistia.net/assets/external/E-v1.js I found that parameter wchannel can be controled to load js from...

HackerOne: Information disclosure (reset password token) and changing the user's password

The user gets an e-mail with password recovery link, which includes reset password token. The user clicks this link and is expected to enter a new password twice. Before entering the password the user clicks a link to a picture https://xkcd.com/936/. When this happens, cross-domain referer leakag...

PortSwigger Web Security: No Rate Limit On Regenerate Password on Portswigger

Introduction A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given timeframe, HTTP-Servers can respond with status code 429...

curl: Data race conditions reported by helgrind when performing parallel DNS queries in libcurl

While running binary built from curl git repo file "docs/examples/10-at-a-time.c" under valgrind specifically with the helgrind tool, reports race condition in getaddrinfo calls. Using the latest curl/libcurl from github repo. From the valgrind documentation "Helgrind is a Valgrind tool for...

Shopify: Open Redirect - www.shopify.com

Hello Shopify team, I found an open redirect in www.shopify.com Link: - https://www.shopify.com/plus/get-cdn-asset?asset=http://evil.com/? Vulnerable parameter: asset Impact - Open redirect that can lead to phishing and other type of attacks. Have a good day, zonduu...