U.S. Dept Of Defense: Exposed Docker Registry at https://████

Summary: The docker registry at https://██████ has no authentication in place and is therefore exposed to the public. This leads to full disclosure of all available docker containers, the possibility to upload docker container and manipulate and delete existing docker containers. Description: Fro...

U.S. Dept Of Defense: Stored XSS at ██████userprofile.aspx

Summary: Stored XSS vulnerability exists at ██████████userprofile.aspx under "say something about yourself...". XSS can be used for a variety of attacks. Impact XSS can be used to steal cookies, password or to run arbitrary code in the victim's browser. Step-by-step Reproduction Instructions 1...

Ruby: Source code disclosed via S3 Bucket

Summary The Ruby having an Amazon S3 bucked named http://rubyci.s3.amazonaws.com/ which lists some of their log files. Those logs having some informations to check the source code server side directories. Steps to Reproduce 1. direct to http://rubyci.s3.amazonaws.com/ which having READ Permission...

Internet Bug Bounty: CVE-2019-5736: Escape from Docker and Kubernetes containers to root on host

description here: https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html PoC: https://github.com/q3k/cve-2019-5736-poc Some more links: https://seclists.org/oss-sec/2019/q1/119 https://access.redhat.com/security/cve/cve-2019-5736 Impact It allows to escape from container t...

ok.ru: Multiple critical vulnerabilities in Odnoklassniki Android application

Hello, I have recently found several critical vulnerabilities in Odnoklassniki Android application, which is one of your projects, thus I am reporting it here. The first vulnerability is so called Intent spoofing. The vulnerability lies in ability to start the video upload activity of Odnoklassni...

Internet Bug Bounty: SOAP serialize_function_call() type confusion / RCE

https://bugs.php.net/bug.php?id=70388...

U.S. Dept Of Defense: XSS found in https://www.████████.mil

The security researcher found a reflected cross-site scripting XSS vulnerability on the www.████████.mil website. The vulnerability was demonstrated using a proof-of-concept link that triggered a JavaScript alert. The affected product was identified as the web server, and the vulnerable code was...

Nextcloud: No password length limit when creating a user as an administrator

Hi, when I try to set the password while creating an account I noticed that you haven't kept any password limit. You need to decrease password length: There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource consumption on behalf...

Nord Security: Account deletion requests not entirely honoured. Misinformation even after seeking clarification from customer support.

Summary: Requesting account deletion from NordVPN customer support that is supposed to have "removed your account from our database." does not truly remove account from database. Even after asking if critical information such a billing information is removed, which customer support confirms...

Stripo Inc: Password token leak via Host header

Password token leak via Host header -------------- Vulnerability Description: Token will be leaked by the Server to that third party site and that token can be used by third parties to reset the password and take over the account & directly login in your account Steps To Reproduce: 1 Send reset...

Nextcloud: Wordpress Vulnerable to Potential Unauthorized Password Reset

Hi Team, Yesterday, a new 0day on wordpress core has been discovered by Dawid Golunski, so i want you guys to be aware of it to take an immediate action since nextcloud was using wordpress. Wordpress has a password reset feature that contains a vulnerability which might in some cases allow...

Mail.ru: e.mail.ru: File upload "Chapito" circus

Начинаем пихать зиробайты в имя файла на загрузке и поведение сервера неадекватно. Пока ничего страшнее чем local path disclosure, но боюсь импакт больше чем кажется. В имени файла в примере "������t123123", в хексе "220000000000007431323331323322" POST...

curl: SMTP Command Injection via CRLF in libcurl MAIL_FROM / MAIL_RCPT (lib/smtp.c)

Summary libcurl’s SMTP implementation fails to properly sanitize CRLF sequences in user-controlled inputs passed via CURLOPTMAILFROM and CURLOPTMAILRCPT. The function smtpparseaddress lib/smtp.c:277 extracts any data following the closing character as a raw suffix and incorporates it directly int...

Mars: ████ ' can change any account email and cannot retrieve his account and access it ' at ███

The security vulnerability described a method to change the email address of any user account, preventing the original user from accessing their account. The vulnerability involved manipulating the user profile update functionality to modify the email address. Despite an error message when...

Nextcloud: @nextcloud/logger NPM package brings vulnerable ansi-regex version

Summary: Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the sub-patterns \;? and ?:;-a-zA-Z\d\/&.:=?%@. Details: Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate...

Homebrew: Bypass of the installation sandbox by injecting keystrokes with TIOCSTI

While doing some internal testing recently, we ran into installation sandboxing and found a way to bypass it so that a formula's install script can execute commands outside of the sandbox. I understand from https://github.com/Homebrew/brew/issues/2986 that the sandbox is intended to prevent...

New Relic: CRLF Injection in email address

The researcher discovered an issue where control characters can be used when intercepting a request to update an email address. This would result in an inaccessible account without intervention by our Support team. As denial-of-service is out of scope for our program, and since it is scoped to a...

Semrush: IDOR in semrush academy

INTRODUCTION I used two accounts to search for this vulnerability: - id: 5410425 email: ████[email protected] - id: 5407773 email: ████@anosimple.com IP used: ███ Endpoint URL: https://www.semrush.com/academy/courses/userEnroll EXPLOITATION Description of Security Issue: When a user clicks on the...

Pornhub: CRITICAL ISSUE : Leak of all accounts mail login md5 pass and more

The researcher has found a critical issue on a specific endpoint allowing him to leak usernames and hashed passwords. I reported here a critical issue on a specific endpoint allowing to collect easily all tube8 accounts sensitive information, including email and password. The report could be easi...

Shopify: Reverse Proxy misroute leading to steal X-Shopify-Access-Token header

Hello Shopify team! I found out that on /admin/api/graphql endpoint server fetches content of Host header value $HTTPHost + /admin/api/graphql. If my own host was sent to server, request comes from ██████████or ██████████ your google cloud cluster. Also I can grab all reverse proxy headers...

VK.com: ПРОСМОТР ЛЮБЫХ ПРИВАТНЫХ ФОТО + ПРЕВЬЮ ЛЮБОГО ПРИВАТНОГО ВИДЕО.

Просмотр закрытых фотографий. Уязвимость была обнаружена в редакторе статей. Уязвимость позволяла смотреть любые приватные фотографии и любое превью приватного видео...

Semrush: XXE in Site Audit function exposing file and directory contents

Summary: The Project Site Audit function is vulnerable to XXE when parsing sitemap.xml files. Description: The Site Audit function spiders a given website and performs analysis on the discovered pages. In order to improve website spidering the URL of a sitemap.xml file can be provided. If provide...

Sifchain: Found a url on source code which was disclosing different juicy informations like ip addresses and available endponts

Summary: I found a link in " https://github.com/Sifchain/sifnode/blob/develop/deploy/rake/cluster.rake" page which was exposing ip adresses and different endpoints which could be missused by hackers. Link Is=https://rpc.sifchain.finance/ Steps To Reproduce: 1. Visit https://rpc.sifchain.finance/...

GitHub Security Lab: 3,880 Pull Requests Generated to fix JHipster RNG Vulnerability CVE-2019-16303

This bug was reported directly to GitHub Security Lab...

Mail.ru: Reflected XSS on http://info.ucs.ru/settings/check/

Reflected XSS due to unsafe usage of POST parameter in info.ucs.ru...

curl: Invalid write (or double free) triggers curl command line tool crash

Summary: Whilst fuzzing libcurl built from git commit a158a09, a crash triggered by an invalid write or maybe a double/invalid free was found. Steps To Reproduce: Run: echo "LVQvCnVyIDA=" | base64 -d test0000 ./curl --verbose -q -K test0000 file:///dev/null Stack: valgrind -q src/curl --verbose -...

Visma Bug Bounty Program: A 'Read only' user can modify the company logotype and invoice background image

A 'Read only' user can modify the company logotype and invoice background image in his own company, which should not be allowed for this permission level...

Lyst: Subdomain takeover of storybook.lystit.com

Summary: The subdomain storybook.lystit.com had an CNAME record pointing to an unclaimed S3 bucket. This is a high severity security issue because an attacker can register the bucket on AWS and therefore can serve her own content on the subdomain. This allows for various attacks. Description: The...

Zomato: [Zomato's Blog] POST based XSS on https://www.zomato.com/blog/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=8.2

Issue details: POST based XSS Vulnerable URL: https://www.zomato.com/blog/wp-admin/admin-ajax.php?tdthemename=Newspaper&v=8.2 Vulnerable Parameter: loopStatemoduleId Payload: promptdocument.domain Steps to reproduce: As this is a post based you need to create a html csrf to trigger xss. HTML code...

HackerOne: Hacker.One Subdomain Takeover

Hello HackerOne Sec Team, Description : This report is about domain takeover of hacker.one via instapage 0day issue which i just found . Step To Verify : + Visit : https://www.hacker.one + You will see some html updated by me. Impact : + as its one of offical website of hackerone , so attacker ca...

curl: CVE-2023-27534: SFTP path ~ resolving discrepancy

A vulnerability CVE-2023-27534 existed in libcurl's Curlgetworkingpath function, which resolved as remote users' home directory in an undocumented way for the sftp protocol. This could lead to unexpected final paths for sftp access, allowing an attacker with partial path access to gain access to...

U.S. Dept Of Defense: [█████] Bug Reports allow for Unrestricted File Upload

Unrestricted file upload was possible through the bug report feature of a web page, allowing an attacker to attach a malicious file to a bug report and execute malware on the support agent's system. The web server did not validate the extension and size of the uploaded file...

Internet Bug Bounty: CVE-2021-3711: SM2 decrypt buffer overflow

CVE-2021-3711 In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the...

Smule: No Rate Limiting On Phone Number Login Leads to Login Bypass

Hey Team, Introduction: A rate limiting algorithm is used to check if the user session has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame. Description: I was able to Bypass Authentication of any user by enumerating th...

h1-ctf: [H1-2006] CTF Writeup

H1-2006 CTF Writeup I am fairly new to CTFs - this is just my second CTF after H1-415 CTF, at which I didn't get far at all. I think the most valuable thing I can do for anyone who comes across this writeup, is to describe exactly what I was thinking at each step along the way, including all my...

Visma Bug Bounty Program: [IDOR]Ability to Pause & Resume the Invoice of other users If GUID is known.

Insecure Direct Object Reference IDOR vulnerability is discovered via a certain endpoint and the application exposes a reference to an internal implementation object. It reveals the real identifier and format/pattern used of the element in the storage backend side...

Semrush: Remote Code Execution on www.semrush.com/my_reports on Logo upload

The Logo upload in the report constructor at: https://www.semrush.com/myreports/constructor F340480 is passed through a not properly patched version of ImageMagick. You can use Postscript to get Ghostscript to run which in return allows to trigger arbitrary commands on the server, leading to Remo...

Trello: SSRF in account webhook (through API)

It was possible to create a webhook that pointed to the EC2 metadata address, http://169.254.169.254. While no data from that address would be returned, the webhook would be created successfully with a 200 status, indicating that proxy used by the webhook requests wasn't blocking access to that...

Pornhub: Unsecured Grafana instance

The researcher has found a Grafana instance accessible to the public. User sign-up was left open which allowed him to open an account and access charts on various server resource usage. This report is considered out-of-scope but Pornhub chose to reward the researcher due to the severity of the...

Ubiquiti Inc.: Shell Injection via Web Management Console (dl-fw.cgi)

NCC Group Security Advisory https://www.nccgroup.trust -------------------------------------------- Shell Injection via Web Management Console Vendor: Ubiquiti Networks Vendor URL: https://www.ubnt.com Versions affected: airOS XM board line potentially all airOS lines, unverified Systems Affected...

Valve: Steam Deck Single Click Root Remote Code Execution

Vulnerability description not provided...

U.S. Dept Of Defense: LDAP Server NULL Bind Connection Information Disclosure

The LDAP server allowed anonymous access, which could lead to information disclosure. Attackers could exploit this vulnerability to gain access to sensitive information. The recommended mitigation is to configure the service to disallow NULL BINDs...

Cloudflare Public Bug Bounty: Origin IP address disclosure through Pingora response header

HTTP responses to cached files served by the Pingora proxy revealed Origin IP address information. An attacker could trigger this misbehaviour by crafting a request with a malformed Range header. The attack was successful under conditions where Cloudflare cache was in REVALIDATED state, the...

GitHub Security Lab: [JAVA]: CWE-347 - Improper Verification of Cryptographic Signature : Potential for Auth Bypass

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [codeql-go]: Add query to find use of constant state parameter in Oauth2 flow

This bug was reported directly to GitHub Security Lab...

curl: CVE-2020-8284: trusting FTP PASV responses

Summary: The issue here arises from the fact that curl by default has the option CURLOPTFTPSKIPPASVIP disabled by default. As a result, an attacker controlling the URL used by curl, can perform port scanning on behalf of the server where curl is running. This can be achieved by setting up a custo...

Courier: disable test send feature if user's email address isn't verified

Summary: There is no mechanism to limit the request in places while send the preview email Steps To Reproduce: There is a weak account registration process, which allow user to register and login without any email confirmation. L'say say for example that i'm the user A that want to send a phishin...

U.S. Dept Of Defense: RCE (Remote code execution) in one of DoD's websites

Summary: The targeted website is vulnerable to CVE-2017-1000486, by only running command was whoami to prove that the RCE exist has been run successfully on the target Description: The target uses a vulnerable version of primefaces : Primetek Primefaces 5.x, that is vulnerable to a weak encryptio...

Nord Security: Email address is not validated, No Rate Limit and RCE On Forgot Password Page Of affiliates.nordvpn.com

Go to https://affiliates.nordvpn.com/users/forgotpassword. Enter arbitrary string like %0a or %0a%0d as email. It says, No user account was found for the address given, which proves the query are going till the database. Intercept request using Burp Interceptor, copy to intruder Copy some 300...

Revive Adserver: Open redirection bypass in /www/admin/campaign-modify.php

Description - There is an open redirect on /www/admin/campaign-modify.php?returnurl= F713773 - By using //// at the start of the link, you can bypass the open redirect filter. - example: /www/admin/campaign-modify.php?clientid=&campaignid=&returnurl=%2F%2F%2F%2Fhackerone.com Impact This...