15693 matches found
HackerOne: Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com)
The page located at https://sal.██████.com/list/Activity/hour/all/0/ suffers from a Cross-site Scripting XSS vulnerability when a user has set their hostname on their machine to an XSS payload. Vulnerable Page https://sal.██████.com/list/Activity/hour/all/0/ Victim IP Address ███████ Referer...
Mail.ru: Unrestricted file upload on [ambassador.mail.ru]
PHP code execution was possible via file upload functionality in ambassador.mail.ru An attacker was able to execute arbitrary PHP code on the server through the image uploading functionality. The vulnerability was quickly fixed by the Mail.ru team...
Nextcloud: Missing ownership check on remote wipe endpoint
On settings/user/security You can mark a device for wipe out that does not belong to you. Steps: 1. Create 2 accounts one for the hacker and one for the victim 2. On both accounts add devices with different names 3. On the hacker account, while intercepting with burpsuite, select the option to wi...
Smule: stored xss in https://www.smule.com
hi team , I found a stored xss in www.smule.com Summary: add summary of the vulnerability The most damaging type of XSS is Stored XSS Persistent XSS. An attacker uses Stored XSS to inject malicious content referred to as the payload, most often JavaScript code, into the target application. If the...
U.S. Dept Of Defense: SOAP WSDL Parser SQL Code Execution
Summary: SOAP WSDL Parser SQL Code Execution Description: It was possible to parse WSDL resources and read all functions from the SOAP Admin Panel, therefor i was able to repeat the sql query with a tampered request with my own custom SQL command. i was able to extract all the database names for...
Nextcloud: WordPress Vulnerabilities: User Enumeration, Vulnerable Akismet Plugin, XML-RPC Interface available
User Enumeration: It is possible to enumerate four WordPress usernames jancborchardt, jos, lukasreschke, frank. An attacker can use these username to carry out brute-force attack in order to forcefully authenticate. 2. Akismet Plugin2.5.0-3.1.4 vulnerable to unauthenticated Stored Cross Site...
Coinbase: Improper Validation of the Referrer header leading to Open URL Redirection
Using a proxy tool such as Burp, set the Target as https://coinbase.com. Then, send the following request: GET /cdn-cgi/l/chkjschl HTTP/1.1 Host: coinbase.com Referer: http://attacker.com Content-Length: 2 Notice the attacker's domain in the Referrer header. This value is not being validated on t...
curl: MQTT: Missing upper bound on incoming Remaining Length allows server-controlled long wait
Curl's MQTT implementation accepts any valid Remaining Length advertised by the server without an explicit upper bound beyond the MQTT spec maximum of 268,435,455 bytes. A malicious server can send a PUBLISH packet claiming this maximum size but provide only minimal payload, causing curl to wait...
Mozilla: Private Emails of Moz Workers Leaked in Public file
Vulnerability description not provided...
Automattic: Unauthenticated access to webmail at maildev.happytools.dev leading to compromised wordpress site api.happytools.dev [RCE]
Summary: Dear Team, Today when I trying to find bugs on happy tools I have found 2 domains below for staging environment - https://maildev.happytools.dev - https:// api.happytools.dev Two websites above ssl certificate was expired. But you can adjust your date-time to 02/02/2020 or before that ti...
Stripo Inc: No rate limiting for confirmation email lead to huge Mass mailings
this Report based on 997070 Issue Description No rate limit means their is no mechanism to protect against the requests you made in a short frame of time. If the repetition doesn't give any error after 50, 100, 1000 repetitions then their will be no rate limit set. vulnerable has registred in...
8x8: SQL injection (stacked queries) in the export to Excel functionality on Vidyo Server
An abandoned Vidyo server was found to be vulnerable to SQL injection and exposing access to the associated local database. The Vidyo server was retired...
Starbucks: Bulgaria - Subdomain takeover of mail.starbucks.bg
nukedx discovered that the mail.starbucks.bg domain was pointing to a mail service from icn.bg and confirmed that icn.bg did not host this domain. nukedx successfully claimed the subdomain from icn.bg, configured login credentials through the web panel and setup a valid email server. nukedx then...
Nextcloud: Nextcloud Clickjacking Vulnerability
hi! Test domain : https://nextcloud.com Summary ====== https://nextcloud.com/ A clickjacking vulnerability was detected because the X-Frame-Options Header was not set.More Steps To Reproduce == 1. Create a new HTML file 2. Include the following payload Trusted web page https://nextcloud.com 3. Op...
X (Formerly Twitter): Periscope-all Firebase database takeover
Hello, I found one public Firebase database of periscope.tv and I can able to insert data to this database and i only used it once for the testing purposes, so other database queries also possible. Please follow the below link to check the inserted test data. Periscope-all Firebase URL :-...
Mail.ru: RCE on shared.mail.ru due to "widget" plugin
Confluence widget connector vulnerable to CVE-2019-3396 was available on shared.mail.ru...
Node.js third-party modules: Prototype pollution attack (lodash / constructor.prototype)
I would like to report a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype. Module module name: lodash version: 4.17.10 npm page: https://www.npmjs.com/package/lodash Module Description The Lodash library exported as Node.js modules. Modul...
Node.js third-party modules: XSS in express-useragent through HTTP User-Agent
Hello, I would like to report an XSS in express-useragent module due a lack of validating User-Agent header. Please note I already created an Github issue and asked for CVE CVE-2018-9863. I did not know about Node.js third-party modules on hackerone. Description express-useragent is simple...
Snapchat: CRLF Injection at vpn.bitstrips.com
HI I found that the site https://vpn.bitstrips.com/ is vulnerable to a CRLF Injection. By injecting a Carriage Return and Line Feed character, we are able to make the server issue a set-cookie header. GET Request : https://vpn.bitstrips.com/sessionstart/%0aSet-Cookie:maliciouscookie1 Host:...
Pornhub: Unsecured DB instance
The researcher identified vulnerable OrientDB server instances on our infrastructure. The DB servers were found to be vulnerable to script based remote code execution leading to privilege escalation. Two servers running OrientDB were identified, with default login/password combinations. Upon...
curl: Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfers
Summary: libcurl's connection pool match logic does not include the CURLOPTHAPROXYPROTOCOL setting or the CURLOPTHAPROXYCLIENTIP value in its connection match key. Two transfers issued through the same Curleasy or via a shared connection cache CURLLOCKDATACONNECT therefore share one TCP connectio...
Internet Bug Bounty: CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash example
airflow-2.3.3/airflow/exampledags/examplebashoperator.py has a command injection vulnerability. I can control the runid in the following codeexamplebashoperator.py,So I can inject custom commands. alsorunthis = BashOperator taskid='alsorunthis', bashcommand='echo "runid= runid | dagrun= dagrun "'...
curl: CVE-2022-27779: cookie for trailing dot TLD
Summary: In CVE-2014-3620 curl prevents cookies from being set for Top Level Domains TLDs. According to the advisory, curl's "cookie parser has no Public Suffix awareness", but it will "reject TLDs from being allowed". However, a cookie can still be set for a TLD + trailing dot. A trailing dot...
Internet Bug Bounty: CVE-2022-27775: Bad local IPv6 connection reuse
Summary: curl/libcurl doesn't consider IPv6 address zone index when doing connection reuse. if connection exists to specific IPv6 address and other conditions for connection reuse are fulfilled it will be reused for connections regardless of the zone index. Steps To Reproduce: 1. Set up a fake...
GitHub Security Lab: Java: Static initialization vector
This bug was reported directly to GitHub Security Lab...
Doppler VDP: email spoofing on doppler.team
Summary: There is an Email Spoofing vulnerability on your domain doppler.team which allows an attacker to send an email with your domain namesuch as [email protected] and so on. Steps To Reproduce: 1. Go to http://emkei.cz 1. Fill "From Email" field to [email protected] or any other doppler...
Automattic: Denial-of- service By Cache Poisoning The Cross-Origin Resource Sharing Misconfiguration Allow Origin Header
Summery: The wp-json implementation on some WordPress websites I've tested is vulnerable to Denial-of-service where by an attacker can provide an arbitrary origin header in the request, which is then echoed back in the response via the Access-Control-Allow-Origin header, which is cached and serve...
h1-ctf: [h1-415 2020] My writeup on how to retrieve the special secret document
Summary: An attacker without any privilege is able to retrieve the special secret document, hosted on the https://h1-415.h1ctf.com website. To do so, multiple steps are required : 1. The authentication must be bypassed to have a licensed account; 2. The support team portal is vulnerable to a blin...
Capital One: Apache server-status enabled
Apache /server-status displays information about your Apache status. If you are not using this feature, disable it. GET /server-status HTTP/1.1 Connection: keep-alive Accept: / Accept-Encoding: gzip,deflate Host: proxy-copp.capitalone.com User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64...
Chaturbate: Internal loop going to infinite for cb.setTimeout(func, msecs) for broadcast app.
Hi There, I am not sure about that this is vulnerability for @chaturbate or not but in my seeing i thought it can be vulnerable and attacker can use this vulnerability for exploitation on @chaturbate website with normal user so finally i decide to report. As i was just playing with Broadcast app...
Automattic: [app.simplenote.com] Stored XSS via Markdown SVG filter bypass
Hi, A carefully crafted injection used against the Markdown input parser can be leveraged to store and execute arbitrary JavaScript in the app.simplenote.com context. Proof of concept Before proceeding to reproduce this vulnerability, please log in to app.simplenote.com and create a new note with...
inDrive: SSRF in https://couriers.indrive.com/api/file-storage
A server side request forgery vulnerability was present in the url parameter of the https://couriers.indrive.com/api/file-storage endpoint, allowing arbitrary external websites to be requested and their content returned in responses...
Internet Bug Bounty: CVE-2023-28755: ReDoS vulnerability in URI
A ReDoS vulnerability was discovered in the URI component of the Ruby programming language. The vulnerability allowed attackers to cause an increase in execution time for parsing strings to URI objects, resulting in high resource consumption, reduced performance, and denial of service. The...
UPchieve: url redirection
Summary: the following url is vulnerable to redirect https://app.upchieve.org Steps To Reproduce: when you add @evil.com the user will be directed to evil.com https://[email protected] Impact Users could get redirected to malicious domain...
GitHub Security Lab: [Java] CWE-927: Sensitive broadcast
This bug was reported directly to GitHub Security Lab...
Dropcontact: API key is not validated for C.R.M integration [Pipedrive] of LOGGED IN USER, A user can use another USER'S API key for this operation.
We didn't verified the API key when a new user was using his pipedrive free trial, so someone could take a key of another pipedrive which don't belong to him and make his free trial on this api key. Or launch a free trial on a pipedrive already connected to pipedrive...
BugPoC: Solution for XSS challenge calc.buggywebsite.com
Summary: http://calc.buggywebsite.com/ is a angular site designed as a calculator. After observing the source code , there is iframe frame.html with functionality of displaying the data of postmessage in the webpage. js window.addEventListener"message", receiveMessage, false; function...
DuckDuckGo: XSS on Videos IA
Failure found in the videos tab. A user was created on a website https://rutube.ru/video/83a4775f020b3fd68efd3dc9a73031e8/ one with the tag " . When we search DuckDuckGo for the video or user tag, we find a xss flaw in page...
Uber: Arbitrary File Reading on Uber SSL VPN
The hacker has found a series of 0 day related to Pulse Secure SSL VPN...
WordPress: code.wordpress.net subdomain Takeover
Hy Wordpress sec i found as it is posible to takeover this domain http://code.wordpress.net when you navigate it you will get this error msg: Warning! Domain mapping upgrade for this domain not found. Please log in and go to the Domains Upgrades page of your blog to use this domain. $ host...
Ruby: Open aws s3 bucket s3://rubyci
Hello team, Description: Ruby amazon aws bucket https://rubyci.s3.amazonaws.com is open with read only privilege which allows any authenticated aws user to read private files. PFA screenshot. Thanks, Sandeep...
Mixmax: Possible Subdomain Takeover
None of the weakness categories really fit this so I apologize for that. The subdomain sales.mixmax.com points to 151.101.16.229, a webflow.io proxy server. Because it 404s, this leads me to believe that a subdomain takeover is possible through the webflow service as whatever this is pointing to ...
HackerOne: Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session
Hi guys , I have found a way to use the open redirect vulnerability that zendesk refused to fix and we discussed it in 101146 to bypass intristial redirect. in 101146 , @bencode said : I tend to agree with Zendesk, we don't really see any security issues with it. We use our interstitial to warn t...
Mail.ru: touch.afisha.mail.ru: XSS
Там весь хост дыряв. Отстреливает тут: alert1ff243" class="portal-footerlink"ÐÐ¾Ð»Ð½Ð°Ñ Ð²ÐµÑÑÐ¸Ñ | ÐÐ»Ð°Ð²Ð½Ð°Ñ | ÐÑе пÑоекÑÑ GET /?page=dab52"alert1ff243 HTTP/1.1 Host: touch.afisha.mail.ru Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT...
U.S. Dept Of Defense: Leaks of username and password leads to CVE-2018-18862 exploitation
A set of credentials for a BMC Remedy ITSM system were publicly exposed and leaked, allowing an attacker to access the system with the rights of these users. The vulnerability, CVE-2018-18862, was exploited through incorrect access control, potentially allowing the attacker to list roles and...
Internet Bug Bounty: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields
A vulnerability was discovered in the HTTP request parsing of Node.js version 18.7.0 that allowed header fields to be incorrectly handled without carriage return line feed termination, enabling potential HTTP request smuggling...
UPchieve: Authentication Bypass - Email Verification code bypass in account registration process.
Hi Team, I was able to bypass Email Verification code in account registration process. Summary : Authentication Bypass is a dangerous vulnerability, which is found in Web-Applications. An Attackers can bypass the control mechanisms which are used by the underlying web application like Email...
Fastify: Open redirect in fastify-static via mishandled user's input when attempt to redirect
Summary: When fastify-static is mounted at root and the register option redirect: true, the following 2 lines cause open redirect bug: https://github.com/fastify/fastify-static/blob/master/index.jsL156-L157. A remote attackers can redirect users to arbitrary web sites via a double forward slash:...
curl: CVE-2021-22945: UAF and double-free in MQTT sending
Vulnerability Description libcurl version 7.77.0 has a Use-After-Free and a Double-Free in lib/mqtt.c in the function mqttdoing on lines 556 - 563: c ifmq-nsend / send the remainder of an outgoing packet / char ptr = mq-sendleftovers; result = mqttsenddata, mq-sendleftovers, mq-nsend; freeptr;...
New Relic: HTML Injection In Email In one.newrelic.com
Hi, There's a HTML injection vulnerability present inside emails sent from Newrelic when the name on the organization inviting user contains HTML. The html is stored in the backend database and when emails are sent invitation, the HTML is sent along with the rest of the email. Steps to reproduce:...