15693 matches found
GitHub Security Lab: gagliardetto: Query to detect incorrect conversion between numeric types
This bug was reported directly to GitHub Security Lab...
Open-Xchange: Missing (or redundant) null check in `dcrypt_openssl_sign`
Function dcryptopensslsign in file src/lib-dcrypt/dcrypt-openssl.c has the following code if EVPPKEYbaseidkey-key == EVPPKEYRSA errorr = "Format does not support RSA"; return FALSE; and later if md == NULL if errorr != NULL errorr = tstrdupprintf "Unknown digest %s", algorithm; return FALSE; So,...
HackerOne: Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com
Greetings, I believe I may have found a way to bypass CSP on hackerone.com The issue lies here: img-src 'self' data: www.google-analytics.com As you can imagine, how can image tags be used maliciously here to this safe site? Well, as you know, on google-analytics.com we have the ability to host...
Reddit: Blind SSRF to internal services in matrix preview_link API
A vulnerability was found in the previewlink functionality of Matrix software used in Reddit's new chat system. The endpoint allowed for partially blind SSRF, enabling attackers to send GET requests and exfiltrate data about internal services. This could potentially lead to service enumeration an...
curl: CVE-2023-27538: SSH connection too eager reuse still
A vulnerability CVE-2023-27538 existed in the SSH connection reuse feature of cURL library. The vulnerability allowed for connection reuse even when different SSH keys were used, due to a broken check for SSH key matching. The vulnerability could potentially lead to unauthorized access to sensiti...
U.S. Dept Of Defense: [███████] Remote Code Execution at ██████ [CVE-2021-44529] [HtUS]
IP Address used to find vulnerability: ██████ Vulnerable Website URL or Application: https://████ pomcldsvr2.████ Proof of ownership: ███ Summary: The server at https://███ is running a vulnerable version of CSA. A code injection vulnerability in the Ivanti EPM Cloud Services Appliance CSA allows...
GitHub Security Lab: [javascript] CWE-117: CodeQL query to detect Log Injection
This bug was reported directly to GitHub Security Lab...
Shopify: Stocky App Administrator can create a backdoor admin account by using an existing POS User
Details The Stocky App has POS Users that are being created once a POS Staff logs in into the application from the Point Of Sale application on a mobile device. From the users management page located at https://stocky.shopifyapps.com/users there's no visible way to edit those POS users. Although,...
h1-ctf: [h1-2006 2020] Write up for H1-2006 CTF
I huffed and puffed my way up a flight of stairs into a dimly lit, dusty room, looking for Sherlock. As I made way through scattered books, I exclaimed, "Sherlock, wake up! It’s that time of the year. h1-ctf, a chance to get an invitation to hackerone’s live hacking event. “zer0ttl, of course! Yo...
Bumble: The login of Hotor Not is Vulnerable to bruteforce.
I was able to validate that The Login of HotorNot is Vulnerable to BruteForcing . Steps to reproduce: 1. https://hotornot.com/signin 2.Use Burp intruder attack for BruteForcing 3.Send as many requests you want. Fix: Proper mitigation of BruteForcing should be done using Ratelimitng etc...
Semrush: Cross-origin resource sharing misconfig
Description An HTML5 cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other...
Nextcloud: Design Issues on ( ███ ) Lead to show ( IPS of Users )
Hello , I know this Domain is maybe out of scope But it Connected to the main Website I have see it Cashable the Download IPS for Users Status. As I saw that You active statics awstats That show me Full access to Status on the website . POC...
U.S. Dept Of Defense: [CVE-2020-3452] Unauthenticated file read in Cisco ASA
i found out that https://█████████/ was vulnerable to CVE-2020-3452 The IP has a SSL certificate pointing to █████████ curl -kv https://██████████/ Output Server certificate: subject: C=US; ████.mil Impact Anyone can read any file present on the server. System Hosts ███ Affected Products and...
h1-ctf: Hacky Holidays CTF Writeup
Greetings team Yay! Finally I made it to the end, thank you very much for launching this fantastic event, I had to review topics that I thought I knew, learned a lot and I am sure that I will continue learning with the community : F1130889 Hacky Holidays! P.S. I will put my writeup in my next...
GitHub Security Lab: Java: CWE-939 - Address improper URL authorization
This bug was reported directly to GitHub Security Lab...
curl: curl overwrite local file with -J
Summary: curl supports the Content-disposition header, including the filename= option. By design, curl does not allow server-provided local file override by verifying that the filename= argument does not exist before opening it. However, the implementation contains 2 minor logical bugs that allow...
Visma Bug Bounty Program: [IDOR]Ability to View/Delete/Edit (Forward to attachment archive) Email of other user if GUID is known.
Insecure Direct Object Reference IDOR vulnerability is discovered via a certain endpoint and the application exposes a reference to an internal implementation object which allows the attacker to perform unauthorized actions...
Ian Dunn: Dos https://iandunn.name/ via CVE-2018-6389 exploitation
Similar to 752010 Detail:- There is possibility in /wp-admin/load-scripts.php script to generate large 3Mb amount of data via simple non-authenticated request to server. The vulnerability is registered as https://vulners.com/cve/CVE-2018-6389 Detailed attack scenario is described for example here...
Starbucks: Information disclosure on sim.starbucks.com
Description: Hi,there.I found the sim.starbucks.com host deployed the jira server which version is 7.9.2,there is many public vulnerability on this low version. Information disclosured vulnerability 1.CVE-2019-3403https://jira.atlassian.com/browse/JRASERVER-69242 visit the URL address,you can che...
Pornhub: Reflected XSS in Meta Tag
The researcher reported a reflected XSS bug in a meta tag in the search bar. XSS found with @the-useless-one! All details here: https://the-useless-one.github.io/posts/2017/03/28/meet-beautiful-xss-in-your-area-a-youporn-bug-bounty-sfw/...
withinsecurity: WordPress Failure Notice page will generate arbitrary hyperlinks
Description: When the "WordPress Failure Notice" page is returned, if the parameter wphttpreferer was supplied with a valid URL, this URL will be used as the "Please try again." link see attachment. A way to reliably generate this page, is to append ?wpcspReceiveCSPviol=1&wphttpreferer=example.co...
U.S. Dept Of Defense: SQL injection on ██████████ via 'where' parameter
An SQL injection vulnerability was discovered in the 'where' parameter of the ArcGIS server. The vulnerability allowed an attacker to retrieve database content by injecting malicious SQL queries into the 'where' parameter. Esri released an update to ArcGIS Server 10.1 Service Pack 1 to address th...
Daimler Truck: Time-based SQL Injection
CWE: CWE-89 CVSS: 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N URL: www.bharatbenz.com//dealer/0'XORifnow=sysdate,sleep20,0XOR'Z QL injection SQLi refers to an injection attack wherein an attacker can execute malicious SQL statements that control a web application's database server. Impact ...
GitHub Security Lab: [Java] CWE-601: Add Spring URL Redirect ResponseEntity sink
This bug was reported directly to GitHub Security Lab...
Rockstar Games: phpinfo() on graph.rockstargames.com exposes sensitive information
In this report, the researcher identified a subdomain that was improperly made public while sensitive information was disclosed, including phpinfo. We were able to fix the deployment and remove the sensitive information, thus resolving the issue...
OLX: SQL Injection https://www.olx.co.id
I found the SQL Injection security hole on the website https://www.olx.co.id, this is a critical finding. here is the POC from the findings that I got Affectect:https://www.olx.co.id/ajax/buybundle/getbundle/ POC: Request DATA POST /ajax/buybundle/getbundle/ HTTP/1.1 Host: www.olx.co.id User-Agen...
Internet Bug Bounty: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
Full write up: http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recovery-attack-on-dh-small.html DH small subgroups CVE-2016-0701 ================================== Severity: High Historically OpenSSL usually only ever generated DH parameters based on "safe" primes. More recently in version...
Mail.ru: Heartbleed: my.com (185.30.178.33) port 1433
MacBook-Pro-Kirill:Pentest isox$ python heartbleed.py 185.30.178.33 -p 1443 defribulator v1.16 A tool to test and exploit the TLS heartbeat vulnerability aka heartbleed CVE-2014-0160 Connecting to: 185.30.178.33:1443, 1 times Sending Client Hello for TLSv1.0 Received Server Hello for TLSv1.0...
Mozilla: Denial of Access to Static Resources via Cache Poisoning on addons.allizom.org
A cache poisoning vulnerability was identified on addons.allizom.org that allowed an attacker to block access to static resources such as images and JavaScript files. The issue was exploited by processing the X-HTTP-Method-Override header, which was honored by the origin server and treated the...
Acronis: [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-day
Summary The website at nps.acronis.com is vulnerable to CVE-2021-44228 Steps To Reproduce I used this script to find this. It spins up an interact-sh server to receive the callback and send the payload in the query string and about 30 diffent headers. You can reproduce manually with curl and...
8x8: Subdomain takeover of ███.wavecell.com
An EC2 instance was terminated but the DNS record was initially not updated/removed. The issue has been rectified...
GitHub Security Lab: [Java] CWE-312: Query to detect cleartext storage of sensitive information using Android SharedPreferences
This bug was reported directly to GitHub Security Lab...
Qulture.Rocks: Privilege escalation from member user ( editor ) to admin user
Qulture.Rocks has multiple levels of admins, where you could manage parts of the application. One of those levels had a wrong configuration, which did not blocked it from updating its level to a higher one. Our team worked rapidly to fix this issue, blocking said level of updating itself...
Shopify: Shopify admin authentication bypass using partners.shopify.com
@uzsunny reported that by creating two partner accounts sharing the same business email, it was possible to be granted "collaborator" access to any store without any merchant interaction. We tracked down the bug to incorrect logic in a piece of code that was meant to automatically convert an...
Gratipay: Missing Certificate Authority Authorization rule
Hi Team, Summary Certificate Authority Authorization supported by LetsEncrypt and other CAs allows a domain owner to specify which Certificate Authorities should be allowed to issue certificates for the domain. All CAA-compliant certificate authorities should refuse to issue a certificate unless...
Ubiquiti Inc.: Read-Only user can execute arbitraty shell commands on AirOS
This vulnerability is very similar to 128750, but it avoid the solution applied to the last beta XM firmware. In this report is used the last beta XM firmware: XM.v6.0-beta9 Vulnerability The vulnerability resides in the function fetchCookies file remote.inc:117. Just like last time is a non...
Greenhouse.io: openssh-server Forced Command Handling Information Disclosure Vulnerability on blog.greenhouse.io
Summary of the issue: The authparseoptions function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorizedkeys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by...
WordPress: Parameter tampering : Price Manipulation of Products
Hello Security Team, I have found that you can buy any products in less amount or even we can say as free by changing the price of the product!! POC : 1 go to https://mercantile.wordpress.org/ 2 choose any product and add to cart 3 Now go to cart add your billing details 4 Intercept request with...
mycompany VDP: This test report has been disclosed by 20_root.
This test report has been disclosed by 20root. ████...
Smule: Possible Subdomain Takeover For Inbound Emails
The affected URL email.smule.com pointed to sendgrid.net via a DNS CNAME record. As a result, a subdomain takeover was possible by registering the subdomain email.smule.com on Sendgrid...
Zomato: The vulnerabilities found were XSS, Public disclosure, Network enumeration via CSRF, DLL hijacking.
Summary IP found using ping command- 52.77.124.190 Then I used nmap tool to find the indepth information. I used burp suite and DNS scanner but it was not fruitful. Then I explored some GitHub repositories to perform thorough web-application testing. Using Aquatone I found some hidden domains. Th...
h1-ctf: [H1-2006 2020] Multiple vulnerabilities allow to leak sensitive information
Summary: --------------------- Hello team! This report is detailed write-up for chain of vulnerabilities that ended up with leaking sensitive information - a flag. CTF itself was really fun and I've enjoyed it. Hope you find my report valid and useful. Steps To Reproduce: ---------------------...
Razer: [api.easy2pay.co] SQL Injection at fortumo via TransID parameter [Bypassing Signature Validation🔥]
The tester discovered the api.easy2pay.co suffered from a SQL injection vulnerability, affecting Razer Gold Thailand. Razer thanks the tester for his report and diligence...
Starbucks: Minimal information disclosure of internal asset names and links which were not publicly accessible.
e4366eolywrgpidfbio discovered an application with links to internal Starbucks related resources. No public access to these resources was available, resulting in minimal information disclosure of host and resource names. @e4366eolywrgpidfbio — thank you for reporting this issue...
Starbucks: Subdomain takeover on svcgatewayus.starbucks.com
Hello, this is pretty serious security issue in some context, so please act as fast as possible. Overview: One of the starbucks.com subdomains is pointing to Azure, which has unclaimed CNAME record. ANYONE is able to own starbucks.com subdomain at the moment. This vulnerability is called subdomai...
Nextcloud: bypass of 2FA
Improper protection of the 2FA login made a bypass of the 2FA possible. The bug required to know user credentials but effectively rendered the 2FA ineffective. The issue has been fixed by the Nextcloud team and has been validated by the reporter...
Ruby on Rails: Active Record SQL Injection Vulnerability Affecting PostgreSQL
This vulnerability was reported directly to Rails. https://groups.google.com/forum/!msg/rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J...
Urban Company: Insufficient Session Expiration
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Name of Vulnerability:...
h1-ctf: CCC H1 June 2021 CTF Writeup
CTF Summary This was my first H1 CTF and I was excited to work with several others to collaborate on the CTF and find the flag. I'll write up the solution process and vulnerabilities involved in the solution: Knowledge basic of S3 operations XML External Entities and Local File Exfiltration SQL...