Sifchain: Found a url on source code which was disclosing different juicy informations like ip addresses and available endponts

Summary: I found a link in " https://github.com/Sifchain/sifnode/blob/develop/deploy/rake/cluster.rake" page which was exposing ip adresses and different endpoints which could be missused by hackers. Link Is=https://rpc.sifchain.finance/ Steps To Reproduce: 1. Visit https://rpc.sifchain.finance/...

GitHub Security Lab: Java : Add a query to detect Spring View Manipulation Vulnerability

This bug was reported directly to GitHub Security Lab...

U.S. Dept Of Defense: Read-only path traversal (CVE-2020-3452) at https://████████

Summary: I discovered a vulnerability Read-only path traversal CVE-2020-3452 at https://████████ Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote...

GitHub Security Lab: CodeQL query to detect OGNL injections

This bug was reported directly to GitHub Security Lab...

New Relic: CRLF Injection in email address

The researcher discovered an issue where control characters can be used when intercepting a request to update an email address. This would result in an inaccessible account without intervention by our Support team. As denial-of-service is out of scope for our program, and since it is scoped to a...

Pornhub: CRITICAL ISSUE : Leak of all accounts mail login md5 pass and more

The researcher has found a critical issue on a specific endpoint allowing him to leak usernames and hashed passwords. I reported here a critical issue on a specific endpoint allowing to collect easily all tube8 accounts sensitive information, including email and password. The report could be easi...

Khan Academy: [critical] sql injection by GET method

Hey there, after tampering a bit with the values, since I figured out your backend is not php most likely django or nodejs, I found an SQL injection . You can view my steps to reproduce, if you need additional screenshots, please let me know. Regards Gabriel Kimiaie Impact If I dig deeper, I may ...

Mail.ru: e.mail.ru: File upload "Chapito" circus

Начинаем пихать зиробайты в имя файла на загрузке и поведение сервера неадекватно. Пока ничего страшнее чем local path disclosure, но боюсь импакт больше чем кажется. В имени файла в примере "������t123123", в хексе "220000000000007431323331323322" POST...

Homebrew: Bypass of the installation sandbox by injecting keystrokes with TIOCSTI

While doing some internal testing recently, we ran into installation sandboxing and found a way to bypass it so that a formula's install script can execute commands outside of the sandbox. I understand from https://github.com/Homebrew/brew/issues/2986 that the sandbox is intended to prevent...

GitHub Security Lab: 3,880 Pull Requests Generated to fix JHipster RNG Vulnerability CVE-2019-16303

This bug was reported directly to GitHub Security Lab...

Mail.ru: Reflected XSS on http://info.ucs.ru/settings/check/

Reflected XSS due to unsafe usage of POST parameter in info.ucs.ru...

h1-ctf: [H1-2006 2020] How I solved my first H1 CTF

Introduction: Hello! My name is @cr33pbp0y and I going to tell you how I resolved my first HackerOne CTF. Prelude One day, I was reading some tweets about some new vulnerabilities and new hunters adquisitions when the Great H tweeted: F861267 I thought: "WoW, a new virtual event!! It could be...

Visma Bug Bounty Program: A 'Read only' user can modify the company logotype and invoice background image

A 'Read only' user can modify the company logotype and invoice background image in his own company, which should not be allowed for this permission level...

Shopify: Reverse Proxy misroute leading to steal X-Shopify-Access-Token header

Hello Shopify team! I found out that on /admin/api/graphql endpoint server fetches content of Host header value $HTTPHost + /admin/api/graphql. If my own host was sent to server, request comes from ██████████or ██████████ your google cloud cluster. Also I can grab all reverse proxy headers...

Smule: Possible Subdomain Takeover For Inbound Emails

The affected URL email.smule.com pointed to sendgrid.net via a DNS CNAME record. As a result, a subdomain takeover was possible by registering the subdomain email.smule.com on Sendgrid...

U.S. Dept Of Defense: Exposed Docker Registry at https://████

Summary: The docker registry at https://██████ has no authentication in place and is therefore exposed to the public. This leads to full disclosure of all available docker containers, the possibility to upload docker container and manipulate and delete existing docker containers. Description: Fro...

Courier: disable test send feature if user's email address isn't verified

Summary: There is no mechanism to limit the request in places while send the preview email Steps To Reproduce: There is a weak account registration process, which allow user to register and login without any email confirmation. L'say say for example that i'm the user A that want to send a phishin...

curl: Invalid write (or double free) triggers curl command line tool crash

Summary: Whilst fuzzing libcurl built from git commit a158a09, a crash triggered by an invalid write or maybe a double/invalid free was found. Steps To Reproduce: Run: echo "LVQvCnVyIDA=" | base64 -d test0000 ./curl --verbose -q -K test0000 file:///dev/null Stack: valgrind -q src/curl --verbose -...

Visma Bug Bounty Program: [IDOR]Ability to Pause & Resume the Invoice of other users If GUID is known.

Insecure Direct Object Reference IDOR vulnerability is discovered via a certain endpoint and the application exposes a reference to an internal implementation object. It reveals the real identifier and format/pattern used of the element in the storage backend side...

Lyst: Subdomain takeover of storybook.lystit.com

Summary: The subdomain storybook.lystit.com had an CNAME record pointing to an unclaimed S3 bucket. This is a high severity security issue because an attacker can register the bucket on AWS and therefore can serve her own content on the subdomain. This allows for various attacks. Description: The...

Zomato: [Zomato's Blog] POST based XSS on https://www.zomato.com/blog/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=8.2

Issue details: POST based XSS Vulnerable URL: https://www.zomato.com/blog/wp-admin/admin-ajax.php?tdthemename=Newspaper&v=8.2 Vulnerable Parameter: loopStatemoduleId Payload: promptdocument.domain Steps to reproduce: As this is a post based you need to create a html csrf to trigger xss. HTML code...

Pornhub: Unsecured Grafana instance

The researcher has found a Grafana instance accessible to the public. User sign-up was left open which allowed him to open an account and access charts on various server resource usage. This report is considered out-of-scope but Pornhub chose to reward the researcher due to the severity of the...

HackerOne: Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery

Vulnerability description not provided...

U.S. Dept Of Defense: [█████] Bug Reports allow for Unrestricted File Upload

Unrestricted file upload was possible through the bug report feature of a web page, allowing an attacker to attach a malicious file to a bug report and execute malware on the support agent's system. The web server did not validate the extension and size of the uploaded file...

Weblate: Secret_key in GitHub

hello I have found secretkey in GitHub is public and noticed something this key have comment Make this unique, and don't share it with anybody. and it's public in GitHub also I noticed this file has coding to do the payment.db I think information like this must be private SECRETKEY =...

HackerOne: Hacker.One Subdomain Takeover

Hello HackerOne Sec Team, Description : This report is about domain takeover of hacker.one via instapage 0day issue which i just found . Step To Verify : + Visit : https://www.hacker.one + You will see some html updated by me. Impact : + as its one of offical website of hackerone , so attacker ca...

Ubiquiti Inc.: Shell Injection via Web Management Console (dl-fw.cgi)

NCC Group Security Advisory https://www.nccgroup.trust -------------------------------------------- Shell Injection via Web Management Console Vendor: Ubiquiti Networks Vendor URL: https://www.ubnt.com Versions affected: airOS XM board line potentially all airOS lines, unverified Systems Affected...

HackerOne: Unintended HTML inclusion as a result of https://hackerone.com/reports/110578

Hi, I was just reading https://hackerone.com/reports/110578 and testing out the changes. I had previously noticed that the editor would take something like: test and turn it into : test In other words, the code would recursively look at what should be the title string and use the first single or...

Zendesk: CSV Excel Macro Injection Vulnerability in export chat logs

Scenario: An attacker creates a name as =AND21 with a fake email and with random text in the message body. This is similar to a vulnerability recently found in zendesk.com as well. When a team member clicks export as csv and opens it instead of seeing =AND21 they see TRUE. Meaning that cell is no...

Internet Bug Bounty: CVE-2021-3711: SM2 decrypt buffer overflow

CVE-2021-3711 In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the...

8x8: Exposed PHP dependencies at ██.8x8.com

A limited amount of hosts were exposing the PHP vendor directory, which exposed names of internal packages & dependencies. The issue has been rectified...

GitHub Security Lab: [codeql-go]: Add query to find use of constant state parameter in Oauth2 flow

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java] CWE-489: Query to detect main() method in Java EE applications

This bug was reported directly to GitHub Security Lab...

U.S. Dept Of Defense: RCE (Remote code execution) in one of DoD's websites

Summary: The targeted website is vulnerable to CVE-2017-1000486, by only running command was whoami to prove that the RCE exist has been run successfully on the target Description: The target uses a vulnerable version of primefaces : Primetek Primefaces 5.x, that is vulnerable to a weak encryptio...

GlobaLeaks: Since no defined tries for incorrect answer, an attacker can brute the answers and post a submission

Logic of the attack pass 50 answers for per token.. if within the 50 answers this can be increased for more success rate, if there's a valid. the token becomes usable. and then submit the submission POST data. Screenshot of script running F733033 Screenshot of inbox F733034 Mitigation This can be...

Nord Security: Email address is not validated, No Rate Limit and RCE On Forgot Password Page Of affiliates.nordvpn.com

Go to https://affiliates.nordvpn.com/users/forgotpassword. Enter arbitrary string like %0a or %0a%0d as email. It says, No user account was found for the address given, which proves the query are going till the database. Intercept request using Burp Interceptor, copy to intruder Copy some 300...

PUBG: RXSS to Stored XSS - forums.pubg.com | URL parameter

René Kroka found a Reflected XSS vulnerability that could be chained to a Stored XSS attack in the Invision Community forums software used by PUBG. By crafting a malicious URL the attacker is able to trigger Javascript to execute on their own page; known as Reflected XSS. The attacker then create...

Semrush: Open redirect in semrush.com

Summary: There is an open redirect on https://www.semrush.com/login/?redirectto=. By using /\ at the start of the link, you can bypass the open redirect filter. Description: An attacker can control the value of the "redirectto" parameter and make it redirect to a malicious endpoint. Steps To...

Internet Bug Bounty: Use After Free Vulnerability in session deserializer

https://bugs.php.net/bug.php?id=70219...

GitHub Security Lab: [JAVA]: CWE-347 - Improper Verification of Cryptographic Signature : Potential for Auth Bypass

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: ihsinme: CPP add query for CWE-788 Access of memory location after the end of a buffer using strlen.

This bug was reported directly to GitHub Security Lab...

Revive Adserver: Open redirection bypass in /www/admin/campaign-modify.php

Description - There is an open redirect on /www/admin/campaign-modify.php?returnurl= F713773 - By using //// at the start of the link, you can bypass the open redirect filter. - example: /www/admin/campaign-modify.php?clientid=&campaignid=&returnurl=%2F%2F%2F%2Fhackerone.com Impact This...

ok.ru: Multiple critical vulnerabilities in Odnoklassniki Android application

Hello, I have recently found several critical vulnerabilities in Odnoklassniki Android application, which is one of your projects, thus I am reporting it here. The first vulnerability is so called Intent spoofing. The vulnerability lies in ability to start the video upload activity of Odnoklassni...

Mozilla: Private Emails of Moz Workers Leaked in Public file

Vulnerability description not provided...

U.S. Dept Of Defense: LDAP Server NULL Bind Connection Information Disclosure

The LDAP server allowed anonymous access, which could lead to information disclosure. Attackers could exploit this vulnerability to gain access to sensitive information. The recommended mitigation is to configure the service to disallow NULL BINDs...

curl: CVE-2023-27534: SFTP path ~ resolving discrepancy

A vulnerability CVE-2023-27534 existed in libcurl's Curlgetworkingpath function, which resolved as remote users' home directory in an undocumented way for the sftp protocol. This could lead to unexpected final paths for sftp access, allowing an attacker with partial path access to gain access to...

Smule: No Rate Limiting On Phone Number Login Leads to Login Bypass

Hey Team, Introduction: A rate limiting algorithm is used to check if the user session has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame. Description: I was able to Bypass Authentication of any user by enumerating th...

Shopify: Stored XSS in Shopify Chat

1.install app Shopify Chat 2.Click chat on the shop homepage or Shopify Ping to send poc javascript:alert1//https://dqdqdqdqdq.myshopify.com 3.Click url, alert F657395 Impact 1.Front end user Self-XSS 2.Administrator XSS foreground user...

Starbucks: Bulgaria - Subdomain takeover of mail.starbucks.bg

nukedx discovered that the mail.starbucks.bg domain was pointing to a mail service from icn.bg and confirmed that icn.bg did not host this domain. nukedx successfully claimed the subdomain from icn.bg, configured login credentials through the web panel and setup a valid email server. nukedx then...

Nextcloud: Nextcloud Clickjacking Vulnerability

hi! Test domain : https://nextcloud.com Summary ====== https://nextcloud.com/ A clickjacking vulnerability was detected because the X-Frame-Options Header was not set.More Steps To Reproduce == 1. Create a new HTML file 2. Include the following payload Trusted web page https://nextcloud.com 3. Op...