15580 matches found
GitHub Security Lab: CodeQL query for disabled revocation checking
This bug was reported directly to GitHub Security Lab...
Showmax: [stories.showmax.com] Cross Origin Misconfiguration - Sensitive Information Exposure
The hacker reported user enumaration on https://stories.showmax.com/wp-json/wp/v2/users/ and CORS. The user enumeration didn't disclose any sensitive information except usernames which are not problematic because we have 2FA login in place and the usernames could be obtained even from standard...
8x8: PHPinfo page on http://█████.callstats.io
PHPInfo file was exposed on legacy system. phpinfo was available at callstats.io subdomain. It disclosing information on a server and PHP version information...
HackerOne: program_analytics_benchmarks query shows information not visible in public
Summary: programanalyticsbenchmarks is displaying information i don't see yet in public profile of a program. Description: I tried querying programanalyticsbenchmarks for the program security and ██████ and it showing information i cannot find in public profile especially in ███████ Steps To...
Staging.every.org: Improper email address verifiation while saving Account Details
Summary: Attacker could be able change its email to any email address even already created another user's email address.Even though UI doesnot allow it Steps To Reproduce: 0. Set up proxy. 1. Singup with any email address 2. Go to profile section 3. Click on update button 4. Monitor call in rever...
Node.js third-party modules: [crypto-js] Insecure entropy source - Math.random()
Module module name: crypto-js version: 3.1.9-1 npm page: https://www.npmjs.com/package/crypto-js Module Description JavaScript library of crypto standards. Module Stats Replace stats below with numbers from npm’s module page: 184959 downloads in the last day 912568 downloads in the last week...
Internet Bug Bounty: Basic Authentication Heap Overflow
Summary: An attacker can get arbitrary data overflowed in the heap via Basic Authorization base64 blob. Even when basic auth isn't configured. Report sent to developers When calling HttpHeader::getAuth the field value will be base64 decoded. The call to the decode method doesn't ensure that the...
Smule: Missing Rate Limit in Forgot Password can Lead to email address leakage of all smule accounts
Hello Smule, I have found a vulnerability by which an attacker can get access of all the gmail accounts associated with Smule. The forgot password parameter can be brute forced through which an attacker can get the email address. Steps to Reproduce Enter your email address and for the forgot...
Infogram: User enumeration via forgot password error message
Hi Team, Vulnerable URL : https://infogram.com/forgot Description: During testing forgot password field whether it's rate limiting is working or not, I noticed forgot password field is vulnerable to user enumeration. When user enter email id which is not available into database it shows an error ...
Cuvva: CRLF Injection [vpn.corp.cuvva.com]
Hi team, Found a CRLF injection in vpn.corp.cuvva.com Poc https://vpn.corp.cuvva.com/sessionstart/%0aSet-Cookie:NEWCOOKIE123 Response: HTTP/1.1 302 Found Date: Wed, 24 May 2017 18:13:57 GMT Connection: close Content-Type: text/html; charset=UTF-8 Location: https://vpn.corp.cuvva.com/...
WordPress: Lack of Password Confirmation when Changing Password and Email
Hello Team, I noticed that it is not necessary to put your Password when Changing Emails, Password, etc.. which is easy to an attacker to Change it's Victim's Credentials when he hijack or takeover an account on wordpress forum account. Let me know if you need more information. Best Regards,...
HackerOne: Possible CSRF during joining report as participant
Hi, I think i found a possible csrf issue with joining report as participant endpoint, Actually one of the bug got duplicated and the company added me into the original bug as a participant. then, I got invitation from hackerone to joing the report. After opening the invitation link, there was tw...
HackerOne: mailto: link injection on https://hackerone.com/directory
I just found that entering a non-existing porogram returns the following response: The Directory doesn't have a profile matching these criteria. If an organization has published security contact information or a vulnerability disclosure policy, please let us know. The bold part has a mailto: link...
U.S. Dept Of Defense: Unauthorized Access Exposing Sensitive Data
The identified page allowed unauthorized access to a user's profile management functionality without requiring authentication. Sensitive user details, such as name, email address, and EDIPI, were exposed upon accessing the page...
Smule: Possible Subdomain Takeover For Inbound Emails
The affected URL email.smule.com pointed to sendgrid.net via a DNS CNAME record. As a result, a subdomain takeover was possible by registering the subdomain email.smule.com on Sendgrid...
Internet Bug Bounty: Electron CVE-2022-35954 Delimiter Injection Vulnerability in exportVariable
Describe the summary: The Electron Website provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write...
Kubernetes: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC
Report Submission Form I was asked by Kubernetes Product Security and H1 Employee @turtleshell to open a new report with the same details as report 995699. Summary: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Kubernetes Version: 1.19 Component Version:...
Shopify: Blind Stored XSS Via Staff Name
Hey Team, I found blind stored XSS when i add staff name in https://your-store.myshopify.com/admin/settings/account Step to reproduce : 1. Go to https://your-store.myshopify.com/admin/settings/account 2. Add Staff Account 3. Fill First & Last Name with this payload "$.getScript"//█████████.xss.ht...
U.S. Dept Of Defense: Subdomain takeover due to an unclaimed Amazon S3 bucket on ███
Summary: An unclaimed Amazon S3 bucket on █████████ gives an attacker the possibility to gain full control over this subdomain. Description: ███████ pointed to an S3 bucket that did no longer exists. The bucket points to an Amazon S3 website bucket in the US East region. I claimed this bucket and...
HackerOne: Unauthorized access to metadata of undisclosed reports that were retested
Summary: reportretests object in User node discloses some information about undisclosed report Description: An attacker can get some infomation such as "assetname" , "assettype" , "severityrating" , "weaknessname" of undisclosed report Steps To Reproduce 1. Invoke the below graphql call POST...
Equifax-vdp: Important information leaked on Github
While searchin on Github about Equifax i found some juicy information like a username and password of this subdomain https://transport5.ec.equifax.com/, internal ip of the database and its username & password In the following link...
RATELIMITED: Hackerone1
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: add summary of the vulnerabili...
Open-Xchange: Web Browser XSS Protection Not Enabled
Web Browser XSS Protection is not enabled, or is disabled by the configuration of the 'X-XSS-Protection' HTTP response header on the web server http://www.dovecot.fi/s=..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Csystem.ini&submit=Search...
Internet Bug Bounty: Flash Cross Domain Policy Bypass by Using File Upload and Redirection - only in Chrome
CVE-2015-0337: https://helpx.adobe.com/security/products/flash-player/apsb15-05.html + https://code.google.com/p/chromium/issues/detail?can=2&start=0&num=100&q=&groupby=&sort=&id=425280 ==VULNERABILITY DETAILS== It is possible to bypass Flash Cross Domain policy in Google Chrome to read other...
HackerOne: CSV injection in the credentials export
Summary: Hello team! We have found out that a hacker can inject malicious excel formulas into the credentials details which will be executed when program user exports the credentials details via https://hackerone.com/hackeroneh1pbbp3/credentials - export credentials and opens this CSV using MS...
TikTok: Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platform
Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially added, deleted, or updated rules for other users' pixel events in the TikTok ads portal. We thank @bubbounty for reporting this to our team and confirming the resolution. This report is one of my...
X (Formerly Twitter): AppLovin API Key hardcoded in a Github repo
Hello, I found a Sensitive Data Exposure in github/mopub-android-mediation project, the AppLovin UI API key is hardcoded in source code. And in the comment it's mentioned that "This is a unique SDK Key from AppLovin. Get yours from the AppLovin UI". Github Link:-...
Liberapay: User Enumeration
@offgouvea reported a user enumeration issue. User enumerations are out-of-scope as mentioned in our program's policy...
Node.js third-party modules: flatmap-stream malicious package (distributed via the popular events-stream)
I would like to report a case of malicious package flat-stream that made it's way into many other npm packages. One such popular package is event-stream user dominictarr transferred the ownership of an npm module to another user because he wasn't actively maintaining it. That user then added...
HackerOne: Team object in GraphQL discloses team group names and permissions
Summary: Hi team. We can disclosed your team member groups ; Description: Because of the communications error, we can disclose the data - teammembergroupsid,name,permissions Steps To Reproduce 1. "query": "query...
HackerOne: information disclosure of another company bug on video.
An information disclosure vulnerability was discovered in a company's system and reported on a bug bounty platform. The vulnerability allowed access to sensitive information about the company and its subdomain. The vulnerability was disclosed publicly, potentially causing harm to the affected...
Internet Bug Bounty: Request line injection via HTTP/2 in Apache mod_proxy
I've written this issue up fully here: https://portswigger.net/research/http2request In case it's useful, here's the original report as sent to Apache: I'd like to report a vulnerability in Apache modproxy when used with HTTP/2 enabled. It fails to reject HTTP requests that contain spaces in the...
Elastic: CVE-2021-40870 on [52.204.160.31]
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. The IP has a SSL certificate pointing to ElasticSearch. curl -kv...
GitHub Security Lab: [Java]: CWE 295 - Insecure TrustManager - MiTM
This bug was reported directly to GitHub Security Lab...
Urban Company: Insufficient Session Expiration
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Name of Vulnerability:...
GitHub Security Lab: Java: Fix NashornScriptEngine detection in ScriptEngine query
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Java : Add a query to detect Spring View Manipulation Vulnerability
This bug was reported directly to GitHub Security Lab...
U.S. Dept Of Defense: Read-only path traversal (CVE-2020-3452) at https://████████
Summary: I discovered a vulnerability Read-only path traversal CVE-2020-3452 at https://████████ Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote...
BlockDev Sp. Z o.o: load scripts DOS vulnerability
load scripts DOS vulnerability...
Liberapay: twitter api access token leaked on github
sensitive token were leaked on GitHub page of liberapay . also mixpanel token was leaked TWITTERCONSUMERKEY=QBB9vEhxO4DFiieRF68zTA TWITTERCONSUMERSECRET=mUymh1hVMiQdMQbduQFYRi79EYYVeOZGrhj27H59H78 +TWITTERACCESSKEY=34175404-G6W8Hh19GWuUhIMEXK0LyZsy7N9aCMcy1bYJ9rI...
GitHub Security Lab: Java: QL Query Detector for JHipster Generated CVE-2019-16303
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CodeQL query to detect OGNL injections
This bug was reported directly to GitHub Security Lab...
h1-ctf: [h1-2006 2020] CTF Walkthrough
h1-2006-ctf Writeup June 2020 https://hackerone.com/h1-ctf/ The Competition Begins! The tweet announces the CTF challenge. Looks like we will need to find a way to process some payments. F863442 Initial Exploring Reading up on the extended description at https://hackerone.com/h1-ctf/ reveals that...
h1-ctf: [h1-415 2020] Multiple chained vulnerabilities lead to leaking secret document
Hi! Summary Multiple chained vulnerabilities lead to leaking secret documents. Improper sanitization in registration allows an attacker to create a QR recover code for any email address. This leads to an account takeover. Using that technique on jobert's account, attacker can access the support...
HackerOne: Confidential data of users and limited metadata of programs and reports accessible via GraphQL
Summary: The GraphQL endpoint doesn't have access controls implemented properly. Description: Any attacker can get personally identifiable information of users of Hackerone such as email address, backup hash codes, facebookuserid, accountrecoveryphonenumberverifiedat, totpenabled, etc. These are...
Khan Academy: [critical] sql injection by GET method
Hey there, after tampering a bit with the values, since I figured out your backend is not php most likely django or nodejs, I found an SQL injection . You can view my steps to reproduce, if you need additional screenshots, please let me know. Regards Gabriel Kimiaie Impact If I dig deeper, I may ...
Instacart: Hyperlink Injection in Friend Invitation Emails
Description A user can change their name to a URL in order to send email invitations containing malicious hyperlinks. Steps to Reproduce 1. Create a new Instacart account with the first name http://example.com 2. Navigate to https://www.instacart.com/store/referrals 3. Send an email invitation to...
Whisper: Insecure Local Data Storage : Application stores data using a binary sqlite database
Android provides several options for developers to save persistent application data. The local DB should store data depending on whether the data should be private to your application or accessible to other applications and users. In any case, sensible data always have to be encrypted to avoid...
HackerOne: Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint
The Insecure Direct Object Reference IDOR vulnerability allowed viewing private report details through the /bugs.json endpoint. Any private reports could be accessed by sending a POST request to the endpoint with the organization ID and a single-digit text query. This gave access to sensitive...