15525 matches found
Ed: Session Cookie Without Secure Flag,
Assigned to:-ED Assigned by:- Kirtikumar Anandrao Ramchandani Assigned on:- 25/04/2018 Bug overview:- Session Cookie without secure flag. Cookie Name:- gitlabsession Description:-Risk description: Since the Secure flag is not set on the cookie, the browser will send it over an unencrypted channel...
Homebrew: [https://jenkins.brew.sh] Jenkins in Debug Mode with Stack Traces Enabled
The consultant identified that the affected host is running an instance of Jenkins in debug mode, as a result stack traces are enabled. The affected URL below displays a full strack trace from Jenkins: Affected URL: - https://jenkins.brew.sh/adjuncts/3a890183/ Recommendation Disable stack traces...
Shopify: Force 500 Internal Server Error on any shop (for one user)
There is very strange behavior. If user open urls like below: - https://whashp.myshopify.com/?previewthemeid=11288717 - or https://lmfshp.myshopify.com/?previewthemeid=11290937 He got redirect to shop https://whashp.myshopify.com/ and 500 Internal Server Error response, and reload does not help i...
curl: CVE-2026-4873: connection reuse ignores TLS requirement
A vulnerability was discovered in libcurl's connection reuse for cleartext-upgrade mail protocols. The vulnerability was that the later transfer's CURLOPTUSESSL option was not properly included if a plaintext connection was already open and reusable. This affected the smtp://, pop3://, and imap:/...
Snapchat: Delete anyone's content spotlight remotely.
A vulnerability was discovered in Snapchat's Spotlight feature that allowed anyone to delete another user's content remotely. By intercepting and modifying the delete request, an attacker could replace the ID parameter with that of another user's video, resulting in the deletion of their content...
UPchieve: url redirection
Summary: the following url is vulnerable to redirect https://app.upchieve.org Steps To Reproduce: when you add @evil.com the user will be directed to evil.com https://[email protected] Impact Users could get redirected to malicious domain...
New Relic: HTML Injection In Email In one.newrelic.com
Hi, There's a HTML injection vulnerability present inside emails sent from Newrelic when the name on the organization inviting user contains HTML. The html is stored in the backend database and when emails are sent invitation, the HTML is sent along with the rest of the email. Steps to reproduce:...
BugPoC: Reading arbitrary files via running arbitrary python code
Summary: Reading arbitrary files via running arbitrary python code Steps To Reproduce: 1. Go to Python POC and execute arbitrary code to read arbitrary files Recording: F976069 I have stopped testing further. Users can run arbitrary python code. Please do let me know If anything is unclear. Impac...
BugPoC: Solution for XSS challenge calc.buggywebsite.com
Summary: http://calc.buggywebsite.com/ is a angular site designed as a calculator. After observing the source code , there is iframe frame.html with functionality of displaying the data of postmessage in the webpage. js window.addEventListener"message", receiveMessage, false; function...
Automattic: Denial-of- service By Cache Poisoning The Cross-Origin Resource Sharing Misconfiguration Allow Origin Header
Summery: The wp-json implementation on some WordPress websites I've tested is vulnerable to Denial-of-service where by an attacker can provide an arbitrary origin header in the request, which is then echoed back in the response via the Access-Control-Allow-Origin header, which is cached and serve...
Open-Xchange: Buffer over-reads in i_stream_zlib_read
This can be reproduced by a sample program using libcompression int mainint argc, char argv const unsigned char datadec; sizet sizedec; const uint8t data = argv1; sizet size = strlendata; struct istream testinput = testistreamcreatedatadata, size; const struct compressionhandler handler =...
Nextcloud: potential RCE and XSS via file upload requiring user account and default settings
potential RCE and XSS via file upload requiring user account and default settings Requirements 1. User account that can upload files NO admin 2. User account name on creation usually the same as on creation/displayed name 3. data directory inside of nextcloud server folder suggested by...
Internet Bug Bounty: CVE-2019-5736: Escape from Docker and Kubernetes containers to root on host
description here: https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html PoC: https://github.com/q3k/cve-2019-5736-poc Some more links: https://seclists.org/oss-sec/2019/q1/119 https://access.redhat.com/security/cve/cve-2019-5736 Impact It allows to escape from container t...
X (Formerly Twitter): Changing email address on Twitter for Android unsets "Protect your Tweets"
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: Verifying email address on...
Valve: [Half-Life 1] Malformed map name leads to memory corruption and code execution
A stack overflow takes place when map names with malformed names are listed which can be used to execute arbitrary code. I made a Proof of Concept that executes gnome-calculator on Linux. This was tested on Half Life 2018-08-29 on Linux, Ubuntu 18.04. To reproduce: - Extract the attached zip-file...
Chaturbate: Stats Token doesn't expire after deactivating account
The hacker found that the stats token, that a user can use to access their own account information, does not expire when an account is deactivated. This was resolved so the view could not be used after deactivation. Application has a feature Authorize your 3rd party stats that provides users a wa...
Nextcloud: OAuth2 Access Token and App Password Security Vulnerability
The OAuth2 endpoint of the Nextcloud server was not following RFC6749. The server did not perform required verification of provided data. And the server did not properly rotate and expire access tokens. In case of a compromised OAuth client this could lead to unauthorized access. After working...
Semrush: Reflected XSS using Header Injection
Host : www.semrush.com Path : /billing-admin/profile/subscription/?l=de Payload : c5obc'+alert1+'p7yd5 Steps to reproduce : Request Header : GET /billing-admin/profile/subscription/?l=de HTTP/1.1 Host: www.semrush.com Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0;...
WordPress: code.wordpress.net subdomain Takeover
Hy Wordpress sec i found as it is posible to takeover this domain http://code.wordpress.net when you navigate it you will get this error msg: Warning! Domain mapping upgrade for this domain not found. Please log in and go to the Domains Upgrades page of your blog to use this domain. $ host...
Mixmax: Possible Subdomain Takeover
None of the weakness categories really fit this so I apologize for that. The subdomain sales.mixmax.com points to 151.101.16.229, a webflow.io proxy server. Because it 404s, this leads me to believe that a subdomain takeover is possible through the webflow service as whatever this is pointing to ...
HackerOne: Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session
Hi guys , I have found a way to use the open redirect vulnerability that zendesk refused to fix and we discussed it in 101146 to bypass intristial redirect. in 101146 , @bencode said : I tend to agree with Zendesk, we don't really see any security issues with it. We use our interstitial to warn t...
Mail.ru: touch.afisha.mail.ru: XSS
Там весь хост дыряв. Отстреливает тут: alert1ff243" class="portal-footerlink"ÐÐ¾Ð»Ð½Ð°Ñ Ð²ÐµÑÑÐ¸Ñ | ÐÐ»Ð°Ð²Ð½Ð°Ñ | ÐÑе пÑоекÑÑ GET /?page=dab52"alert1ff243 HTTP/1.1 Host: touch.afisha.mail.ru Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT...
Nextcloud: Valid share tokens allow to access tempory upload files of share owner
A vulnerability was discovered that allowed access to temporary upload files of a share owner using valid share tokens...
curl: CVE-2023-46218: cookie mixed case PSL bypass
A vulnerability in libcurl was discovered that allows bypassing cookie domain restrictions through improper hostname normalization. This enables a malicious site to set supercookies readable by other sites under the same top level domain. The issue was caused by libcurl failing to convert the...
GitHub Security Lab: Java: Static initialization vector
This bug was reported directly to GitHub Security Lab...
Nextcloud: Nextcloud Desktop Client RCE via malicious URI schemes
Nextcloud Desktop utilizes QT's QDesktopServices::openUrl to open URLs. This function invokes the OS'/Desktop environment's default application to handling the URI scheme and file extension. During the Nextcloud Add Account flow, the server's login website is opened within a native window/WebView...
Glassdoor: Reflected XSS at https://www.glassdoor.com/ via the 'numSuggestions' parameter
Hi there, I have found the xss vulnerability at: https://www.glassdoor.com/ via parameter: numSuggestions Summary: Affected Parameter: numSuggestions Browsers tested: Firefox, Chrome, Edge latest version Steps To Reproduce: Go to:...
Dropcontact: API key is not validated for C.R.M integration [Pipedrive] of LOGGED IN USER, A user can use another USER'S API key for this operation.
We didn't verified the API key when a new user was using his pipedrive free trial, so someone could take a key of another pipedrive which don't belong to him and make his free trial on this api key. Or launch a free trial on a pipedrive already connected to pipedrive...
Node.js: Child process environment injection via prototype pollution
Summary: prototype pollution causes polluted system environment for child processes. Description: This can be used to inject arbitrary --require flags to node.js child processes or in the case of current node.js versions it can be used to inject arbitrary JavaScript to child processes. In practic...
Razer: Accessible Druid Monitor console on https://api.pay-staging.razer.com/
The tester discovered a monitoring application was available on a remotely accessible administrative console in the Razer Pay staging environment, which could have been used to leverage information that could have compromised the server. The Razer Pay team removed this and other similar servers...
X (Formerly Twitter): Periscope android app deeplink leads to CSRF in follow action
Hello Twitter Team Summary This issue is mainly in the Periscope Android app against CSRF follow action using deeplink. Description In normal Periscope Website, when we share a follow link like www.pscp.tv//follow, we get a response whether to follow a person or not, giving us an option, means CS...
Mail.ru: RCE on shared.mail.ru due to "widget" plugin
Confluence widget connector vulnerable to CVE-2019-3396 was available on shared.mail.ru...
Node.js third-party modules: XSS in express-useragent through HTTP User-Agent
Hello, I would like to report an XSS in express-useragent module due a lack of validating User-Agent header. Please note I already created an Github issue and asked for CVE CVE-2018-9863. I did not know about Node.js third-party modules on hackerone. Description express-useragent is simple...
Vimeo: CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`.
Hello, This time I found a IDORInsecure Direct Object Reference vulnerability. It allows an attacker to get unauthorized access to Videos of Channel whose privacy is set to Only moderators and people I choose without being a member. In simple words, we can access videos of private channel without...
Mars: [XSS] Reflected XSS via POST request in (███████)
A reflected Cross-Site Scripting XSS vulnerability was identified in the celular parameter of a POST request to the homepage of a Mars-owned website. The vulnerability was classified as medium severity with a CVSS score of 6.2. The application failed to properly sanitize user input before renderi...
Internet Bug Bounty: CVE-2023-28755: ReDoS vulnerability in URI
A ReDoS vulnerability was discovered in the URI component of the Ruby programming language. The vulnerability allowed attackers to cause an increase in execution time for parsing strings to URI objects, resulting in high resource consumption, reduced performance, and denial of service. The...
TikTok: Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/upload
Vulnerability description not provided...
Glassdoor: Reflected XSS on https://www.glassdoor.com/job-listing/spotlight
Summary: The application is vulnerable to reflected cross-site scripting attacks on the /job-listing/spotlight URI in the callback parameter. Affected URL or select Asset from In-Scope: https://www.glassdoor.com/job-listing/spotlight Affected Parameter: callback Vulnerability Type: see list below...
Node.js: OOB read in libuv
Summary: The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uvgetaddrinfo. nodejs seems to use libuv and is possibly...
GitHub Security Lab: [Java] CWE-927: Sensitive broadcast
This bug was reported directly to GitHub Security Lab...
Solana BBP: email spoofing
email spoofing Impact step 1:visit: https://www.kitterman.com/spf/getspf3.py step 2:in domain name, type:https://github.com/solana-labs/solana-program-library step 3: check SPF record, it will appear" No valid SPF record found" step 4:visit: https://emkei.cz/ step 5:type name as...
WakaTime: Private leaderboard owner email disclosure when sending invites
Hi , the unVerify email disclosure when invite to any one on Leaderboards . Step .. 1- create account [email protected] . 2- not verify email . 3- go to Leaderboards . 4- check invite any email [email protected] . your friends. 5- your friends look inbox the waketime invite it say [email protected]...
BTFS: misconfigured CORS let to HPP and SOP bypass
Hello team, I found a bug on your website that let me bypass the SOP policy. Hope you fix it, everything is in the video https://www.youtube.com/watch?v=PYsU350S-s4 Impact The attacker my direct a victim to a phishing page of www.bitterrent.com/login and he/she will be convince to enter their ema...
Visma Bug Bounty Program: SSRF in img export
The researcher has found a SSRF vulnerability in the application's image export functionality. The app would take all the html as input and generate an image based on that. By manipulating the html code and adding a src tag, it was possible to trigger a SSRF...
HackerOne: Missing spf flags for hackerone.com
I just checked for SPF records for the hackerone.com domain, and there are none, effectively allowing for spamspoof to originate from that domain. you can validate by testing yourself here: http://www.kitterman.com/spf/validate.html i want to show you an attack scenario An attacker would send a...
Valve: Steam Deck Single Click Root Remote Code Execution
Vulnerability description not provided...
Internet Bug Bounty: CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash example
airflow-2.3.3/airflow/exampledags/examplebashoperator.py has a command injection vulnerability. I can control the runid in the following codeexamplebashoperator.py,So I can inject custom commands. alsorunthis = BashOperator taskid='alsorunthis', bashcommand='echo "runid= runid | dagrun= dagrun "'...
MTN Group: Firebase Database Takeover in https://pulseradio.mtn.co.ug/
Summary: During my test , in one of the subdomain of mtn.co.ug I found firebase configuration disclosed in the source code along with apiKey and database URL . Exploiting this vulnerability attacker is able to upload malicious data in the firebase account of pulseradio.mtn.co.ug and see database...
GitHub Security Lab: [Python] CWE-287: LDAP Improper Authentication
This bug was reported directly to GitHub Security Lab...
U.S. Dept Of Defense: XSS due to CVE-2020-3580 [███.mil]
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the web services interface of an...