15404 matches found
h1-ctf: [H1-2006 2020] CTF Writeup
Summary: The CTF's objective could be found in the following Twitter post: F858468 As outlined on https://hackerone.com/h1-ctf, all subdomains of bountypay.h1ctf.com are in scope. Doing subdomain enumeration revealed the following subdomains: api.bountypay.h1ctf.com app.bountypay.h1ctf.com...
curl: curl overwrite local file with -J
Summary: curl supports the Content-disposition header, including the filename= option. By design, curl does not allow server-provided local file override by verifying that the filename= argument does not exist before opening it. However, the implementation contains 2 minor logical bugs that allow...
Starbucks: Minimal information disclosure of internal asset names and links which were not publicly accessible.
e4366eolywrgpidfbio discovered an application with links to internal Starbucks related resources. No public access to these resources was available, resulting in minimal information disclosure of host and resource names. @e4366eolywrgpidfbio ā thank you for reporting this issue...
Grammarly: Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's origin
Summary: Attacker could trigger Grammarly extension's gnar.fetch command using a crafted page to perform XHR with cookies and any configurational params to any cross-origin resource. Description: Page could Init Grammarly popup editor no user gesture, helper Events have isTrusted property, which...
Internet Bug Bounty: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
Full write up: http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recovery-attack-on-dh-small.html DH small subgroups CVE-2016-0701 ================================== Severity: High Historically OpenSSL usually only ever generated DH parameters based on "safe" primes. More recently in version...
Daimler Truck: Time-based SQL Injection
CWE: CWE-89 CVSS: 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N URL: www.bharatbenz.com//dealer/0'XORifnow=sysdate,sleep20,0XOR'Z QL injection SQLi refers to an injection attack wherein an attacker can execute malicious SQL statements that control a web application's database server. Impact ...
U.S. Dept Of Defense: [CVE-2020-3452] Unauthenticated file read in Cisco ASA
i found out that https://āāāāāāāāā/ was vulnerable to CVE-2020-3452 The IP has a SSL certificate pointing to āāāāāāāāā curl -kv https://āāāāāāāāāā/ Output Server certificate: subject: C=US; āāāā.mil Impact Anyone can read any file present on the server. System Hosts āāā Affected Products and...
Acronis: [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-day
Summary The website at nps.acronis.com is vulnerable to CVE-2021-44228 Steps To Reproduce I used this script to find this. It spins up an interact-sh server to receive the callback and send the payload in the query string and about 30 diffent headers. You can reproduce manually with curl and...
GitHub Security Lab: Java: Timing attacks while comparing results of cryptographic operations
This bug was reported directly to GitHub Security Lab...
HackerOne: Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information
When a Report is submitted on HackerOne.com, a feature called the Report Duplicate Detector helps program members and triagers find potential duplicates of the submitted report. This feature will match against all reports that were submitted to the program. When the feature was introduced, all...
8x8: Subdomain takeover of āāā.wavecell.com
An EC2 instance was terminated but the DNS record was initially not updated/removed. The issue has been rectified...
Internet Bug Bounty: Integer overflow in CipherUpdate
Summary: I reported an integer overflow to the OpenSSL security list on Dec 13, 2020 and it was fixed in OpenSSL 1.1.1j. Reporting it here for the bounty. It was assigned CVE-2021-23840 https://nvd.nist.gov/vuln/detail/CVE-2021-23840 which NVD rated CVSS 7.5. Amusingly, the same bug worked around...
Basecamp: Information Disclosure of Garbage Collection Cycle
Hello, Upon enumerating a subdomain content I found a directory that discloses the duration of the garbage collection cycles. I think that these information should be kept private because public should not know information about the target application and how it operates or do its garbage...
SMTP2GO: Stored XSS at https://app.smtp2go.com/settings/users/
Vulnerability : A. Type:- Cross Site Scripting Stored B. Description:- Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Summary : When you will create a particular user...
Razer: [api.easy2pay.co] SQL Injection at fortumo via TransID parameter [Bypassing Signature Validationš„]
The tester discovered the api.easy2pay.co suffered from a SQL injection vulnerability, affecting Razer Gold Thailand. Razer thanks the tester for his report and diligence...
GitLab: Container scanning and Dependency scanning report leaked to unauthorized users
Hi GitLab Security team Summary GitLab makes the container scanning and dependency scanning information available as part of a JSON endpoint for merge requests. These reports are output of the CI job and should only be displayed if the visiting user has access to CI. However, right now GitLab...
OLX: SQL Injection https://www.olx.co.id
I found the SQL Injection security hole on the website https://www.olx.co.id, this is a critical finding. here is the POC from the findings that I got Affectect:https://www.olx.co.id/ajax/buybundle/getbundle/ POC: Request DATA POST /ajax/buybundle/getbundle/ HTTP/1.1 Host: www.olx.co.id User-Agen...
Infogram: User enumeration via forgot password error message
Hi Team, Vulnerable URL : https://infogram.com/forgot Description: During testing forgot password field whether it's rate limiting is working or not, I noticed forgot password field is vulnerable to user enumeration. When user enter email id which is not available into database it shows an error ...
Pornhub: [phpobject in cookie] Remote shell/command execution
The researcher was able to exploit a vulnerable deserialization function in PHP leading to remote shell on a production server...
Algolia: API Key added for one Indices works for all other indices too.
Hi, I created one API key and restricted it to only one index by adding it and gave it right for creating record. Now this api can be used to add records in other indeces in same account. Screenshot is attached...
HackerOne: HTML injection can lead to data theft
Hey, This is more like an in-depth security thing with a reasonable attack scenario. In some occasions, it seems to be possible to leak sensitive data to an external server, not affected by the CSP. This can happen in the following situation: 1. There's a HTML injection vulnerability 2. The...
Greenhouse.io: openssh-server Forced Command Handling Information Disclosure Vulnerability on blog.greenhouse.io
Summary of the issue: The authparseoptions function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorizedkeys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by...
Internet Bug Bounty: Apache Airflow Google Cloud Sql Provider Remote Command Execution
An improper input validation vulnerability was discovered in Apache Airflow Google Provider before version 8.10.0, which could allow an attacker to execute remote commands on the victim's machine by modifying the existing connection configuration information. The vulnerability was discovered by X...
Nextcloud: Text app leaks file path of shared files
By sending a request for a share without a README.md, the whole file path will be returned to the user: PUT /apps/text/public/session/create?token=EHTs4P7kATowiMg HTTP/1.1 Host: cloud.nextcloud.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:89.0 Gecko/20100101 Firefox/89.0 Accept...
h1-ctf: [h1-2006 2020] Write up for H1-2006 CTF
I huffed and puffed my way up a flight of stairs into a dimly lit, dusty room, looking for Sherlock. As I made way through scattered books, I exclaimed, "Sherlock, wake up! Itās that time of the year. h1-ctf, a chance to get an invitation to hackeroneās live hacking event. āzer0ttl, of course! Yo...
GitHub Security Lab: [Java] CWE-939 - Address improper URL authorization
This bug was reported directly to GitHub Security Lab...
Ian Dunn: Potential Open-Redirection
Steps To Reproduce: ===================== 1 visit : Normal Link. 2 Sign-in with your wordpress account and you will directed to This 3Change the value of the Parameter : redirectto .. To the attacker website let's say : https://vul-example.com 4NOTE THAT : you must URL-encode the vulnerable link...
Chaturbate: Open redirection at https://chaturbate.com/auth/login/
Hi, Summary An attacker can redirect vicitm on an external website using https://chaturbate.com/auth/login/ endpoint because next parameter is not being validated properly. There is a protection existed but it's weak and can be bypassed. http keyword is detected and protection works if payload...
withinsecurity: WordPress Failure Notice page will generate arbitrary hyperlinks
Description: When the "WordPress Failure Notice" page is returned, if the parameter wphttpreferer was supplied with a valid URL, this URL will be used as the "Please try again." link see attachment. A way to reliably generate this page, is to append ?wpcspReceiveCSPviol=1&wphttpreferer=example.co...
Dropbox: SSRF vulnerablity in app webhooks
Server Side Request Forgery SSRF is a vulnerabilty which allows an attacker to make web requests from the context of the server host machine to arbitrary URL's. This vulnerability can allow the attacker to access resources internal to the network, which would otherwise be inaccessible. This...
Monero: Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node Paralysis
A deadlock vulnerability was discovered in the Monero JSON-RPC interface that allowed a remote, unauthenticated attacker to completely paralyze any Monero node with a single HTTP request containing specific batch methods, leading to permanent denial of service. The vulnerability affected all...
Solana BBP: Sensitive data leaks [username, password, keys]
Summary: Hello team, This bug shows some critical asset like secret username, password, keys, etc. publicly on githubq Steps To Reproduce: Please visit the url below 1. https://github.com/solana-labs/solana/blob/e310bad7ab09a4a5bd23314983bffa1707506230/.buildkite/env/secrets.ejson 2...
Mail.ru: Brute-force any email account through allods.mail.ru
!!! ŠŠ¾Š»Š½Š°Ń Š²ŠµŃŃŠøŃ Š¾ŃŃŠµŃŠ° ŃŠ¾ ŃŠŗŃŠøŠ½ŃŠ¾ŃŠ°Š¼Šø Š½Š°Ń Š¾Š“ŠøŃŃŃ Š²Š¾ Š²Š»Š¾Š¶ŠµŠ½Š½Š¾Š¼ PDF-ŃŠ°Š¹Š»Šµ. Vulnerability Technical description ========================= ŠŠ¾ Š°Š“ŃŠµŃŃ https://allods.mail.ru/account.php Š½Š°Ń Š¾Š“ŠøŃŃŃ ŃŠ¾ŃŠ¼Š° ŃŠµŠ³ŠøŃŃŃŠ°ŃŠøŠø Š½Š¾Š²Š¾Š³Š¾ ŠæŠ¾Š»ŃŠ·Š¾Š²Š°ŃŠµŠ»Ń Š² ŠøŠ³ŃŠµ. Š ŠæŃŠ¾ŃŠµŃŃŠµ Š·Š°ŠæŠ¾Š»Š½ŠµŠ½ŠøŃ ŃŠ¾ŃŠ¼Ń, ŠæŠ¾ŃŃŠ»Š°ŠµŃŃŃ Ajax POST-Š·Š°ŠæŃŠ¾Ń Š²...
Infogram: LFI through the MySQL connection
Hello team! I've found a way to read Infogram's server local files through the MySQL connection. The problem is that you're using the LOAD DATA LOCAL feature with your MySQL client. This how an attacker can easily send server's local files to her/his database. I've successfully readed the...
Liberapay: Insecure Account Deletion
Hi Team, The removal of account is one of the sensitive part of a web application that needs to protect, therefore removing an account should validate the authenticity of the user, however i have found that when removing an account, the system did not require the user to input the account passwor...
Shopify: Shopify admin authentication bypass using partners.shopify.com
@uzsunny reported that by creating two partner accounts sharing the same business email, it was possible to be granted "collaborator" access to any store without any merchant interaction. We tracked down the bug to incorrect logic in a piece of code that was meant to automatically convert an...
WordPress: Lack of Password Confirmation when Changing Password and Email
Hello Team, I noticed that it is not necessary to put your Password when Changing Emails, Password, etc.. which is easy to an attacker to Change it's Victim's Credentials when he hijack or takeover an account on wordpress forum account. Let me know if you need more information. Best Regards,...
Slack: Subdomain takeover on podcasts.slack-core.com
I noticed slack-core.com is used for Slack's call infrastructure. I had never seen that domain before, so I decided to find out what else was running on it. It turned out podcasts.slack-core.com was pointing to a Podcast and RSS hosting service called Feed.Press. However, there was no Feed.Press...
HackerOne: Server Side Request Forgery (SSRF) via Analytics Reports
We recently received a critical server-side request forgery SSRF vulnerability report through our bug bounty program. The issue allowed attackers to make internal requests from our application servers by exploiting a lack of output sanitization in an error message. By crafting malicious requests,...
Acronis: Subdomain takeover of main domain of https://www.cyberlynx.lu/
Summary Hi Acronis Security Team , Hope you well. I found one of your subdomains which is www.cyberlynx.lu One of your Acquisition is pointing towards www.cyberlynx.lu canonical name = www118.wixdns.net. www118.wixdns.net canonical name = balancer.wixdns.net. balancer.wixdns.net canonical name =...
HackerOne: Tab nabbing in Hackerone inbox.
Description: Tab nabbing vulnerability occurs When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change its location using the window.opener property and from this a lot of phishing attacks could happen. This scenario occurs on...
GitHub Security Lab: [Java] CWE-555: Query to detect password in Java EE configuration files
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CodeQL query for disabled revocation checking
This bug was reported directly to GitHub Security Lab...
h1-ctf: [H1-2006 2020] From multiple vulnerabilities to complete ATO on any customer account and staff admin
First of all, thanks for the awesome CTF. I enjoyed it very much : Summary The CTF was about helping HackerOne's beloved CEO, @martenmickos, to approve May bug bounty payments after he has lost his login details for BountyPay. It all started with this tweet: F860982 And as you all know, I had to...
Staging.every.org: Improper email address verifiation while saving Account Details
Summary: Attacker could be able change its email to any email address even already created another user's email address.Even though UI doesnot allow it Steps To Reproduce: 0. Set up proxy. 1. Singup with any email address 2. Go to profile section 3. Click on update button 4. Monitor call in rever...
Ian Dunn: xmlrpc.php FILE IS enable it can be used for conducting a Bruteforce attack and Denial of Service(DoS)
Hi Team, The website https://www.iandunn.name has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DDOS. URL:...
Internet Bug Bounty: A reflected XSS in python/Lib/DocXMLRPCServer.py
I have report this issue to PSRT and it has been resolved now. Details about this issue is at https://bugs.python.org/issue38243 and https://vulners.com/cve/CVE-2019-16935 Impact It's the same with other xss...
Mail.ru: Clickjacking Full account takeover and editing the personal information at [account.my.com]
Hi, while i was testing i found that my.com is vulnerable to clickjacking so i checked if the settings page is vulnerable or not and it was vulnerable so now this has a risk!, the attacker could make an exploit code at the changing password page to takeover the victim account, and the same with t...
Open-Xchange: Web Browser XSS Protection Not Enabled
Web Browser XSS Protection is not enabled, or is disabled by the configuration of the 'X-XSS-Protection' HTTP response header on the web server http://www.dovecot.fi/s=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Csystem.ini&submit=Search...
Pornhub: Stored XSS in photo comment functionality
The photo comment functionality is vulnerable to stored cross site scripting: an attacker can craft a comment that contains malicious code and get it stored. This can be reproduced on my test account at http://www.pornhub.com/photo/166952961. Interestingly, differently from 171901 where i could...