Smule: stored xss in https://www.smule.com

hi team , I found a stored xss in www.smule.com Summary: add summary of the vulnerability The most damaging type of XSS is Stored XSS Persistent XSS. An attacker uses Stored XSS to inject malicious content referred to as the payload, most often JavaScript code, into the target application. If the...

Mail.ru: RCE on shared.mail.ru due to "widget" plugin

Confluence widget connector vulnerable to CVE-2019-3396 was available on shared.mail.ru...

U.S. Dept Of Defense: SOAP WSDL Parser SQL Code Execution

Summary: SOAP WSDL Parser SQL Code Execution Description: It was possible to parse WSDL resources and read all functions from the SOAP Admin Panel, therefor i was able to repeat the sql query with a tampered request with my own custom SQL command. i was able to extract all the database names for...

Homebrew: [https://jenkins.brew.sh] Jenkins in Debug Mode with Stack Traces Enabled

The consultant identified that the affected host is running an instance of Jenkins in debug mode, as a result stack traces are enabled. The affected URL below displays a full strack trace from Jenkins: Affected URL: - https://jenkins.brew.sh/adjuncts/3a890183/ Recommendation Disable stack traces...

Vimeo: CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`.

Hello, This time I found a IDORInsecure Direct Object Reference vulnerability. It allows an attacker to get unauthorized access to Videos of Channel whose privacy is set to Only moderators and people I choose without being a member. In simple words, we can access videos of private channel without...

Coinbase: Improper Validation of the Referrer header leading to Open URL Redirection

Using a proxy tool such as Burp, set the Target as https://coinbase.com. Then, send the following request: GET /cdn-cgi/l/chkjschl HTTP/1.1 Host: coinbase.com Referer: http://attacker.com Content-Length: 2 Notice the attacker's domain in the Referrer header. This value is not being validated on t...

curl: CVE-2026-4873: connection reuse ignores TLS requirement

A vulnerability was discovered in libcurl's connection reuse for cleartext-upgrade mail protocols. The vulnerability was that the later transfer's CURLOPTUSESSL option was not properly included if a plaintext connection was already open and reusable. This affected the smtp://, pop3://, and imap:/...

Nextcloud: Valid share tokens allow to access tempory upload files of share owner

A vulnerability was discovered that allowed access to temporary upload files of a share owner using valid share tokens...

Internet Bug Bounty: CVE-2023-23914: HSTS ignored on multiple requests

Multiple requests made using curl's HSTS functionality ignored the HTTPS protocol and used an insecure clear-text HTTP step instead. This was due to the state not being properly carried on, allowing the bypass of intended security controls. The vulnerability was assigned CVE-2023-23914 and had a...

U.S. Dept Of Defense: critical information disclosure

Description: hey all , I have found critical information through this endpoint ████ on ███████ DB credentials such as DBNAME,DBUSER,DBPASSWORD,DBHOST, etc.. Impact full access control on DB service on website System Hosts ███ Affected Products and Versions CVE Numbers Steps to Reproduce Go to...

Glassdoor: Reflected XSS at https://www.glassdoor.com/ via the 'numSuggestions' parameter

Hi there, I have found the xss vulnerability at: https://www.glassdoor.com/ via parameter: numSuggestions Summary: Affected Parameter: numSuggestions Browsers tested: Firefox, Chrome, Edge latest version Steps To Reproduce: Go to:...

Nextcloud: WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (UNAUTHORIZED)

because in the burp suite, the build request is complicated, I only use curl 1. Create file index.html and index.php Index.html : Hello world Index.php : 2. Once created enter into .zip COMPRESS 3. LETS UPLOAD CURL : curl site.com/index.php/wp-json/articulate/v1/upload-data -F "name=NAMAFILE" -F...

Chaturbate: Internal loop going to infinite for cb.setTimeout(func, msecs) for broadcast app.

Hi There, I am not sure about that this is vulnerability for @chaturbate or not but in my seeing i thought it can be vulnerable and attacker can use this vulnerability for exploitation on @chaturbate website with normal user so finally i decide to report. As i was just playing with Broadcast app...

Nextcloud: OAuth2 Access Token and App Password Security Vulnerability

The OAuth2 endpoint of the Nextcloud server was not following RFC6749. The server did not perform required verification of provided data. And the server did not properly rotate and expire access tokens. In case of a compromised OAuth client this could lead to unauthorized access. After working...

Semrush: Reflected XSS using Header Injection

Host : www.semrush.com Path : /billing-admin/profile/subscription/?l=de Payload : c5obc'+alert1+'p7yd5 Steps to reproduce : Request Header : GET /billing-admin/profile/subscription/?l=de HTTP/1.1 Host: www.semrush.com Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0;...

Automattic: [app.simplenote.com] Stored XSS via Markdown SVG filter bypass

Hi, A carefully crafted injection used against the Markdown input parser can be leveraged to store and execute arbitrary JavaScript in the app.simplenote.com context. Proof of concept Before proceeding to reproduce this vulnerability, please log in to app.simplenote.com and create a new note with...

Ruby: Open aws s3 bucket s3://rubyci

Hello team, Description: Ruby amazon aws bucket https://rubyci.s3.amazonaws.com is open with read only privilege which allows any authenticated aws user to read private files. PFA screenshot. Thanks, Sandeep...

curl: MQTT: Missing upper bound on incoming Remaining Length allows server-controlled long wait

Curl's MQTT implementation accepts any valid Remaining Length advertised by the server without an explicit upper bound beyond the MQTT spec maximum of 268,435,455 bytes. A malicious server can send a PUBLISH packet claiming this maximum size but provide only minimal payload, causing curl to wait...

Mars: [XSS] Reflected XSS via POST request in (███████)

A reflected Cross-Site Scripting XSS vulnerability was identified in the celular parameter of a POST request to the homepage of a Mars-owned website. The vulnerability was classified as medium severity with a CVSS score of 6.2. The application failed to properly sanitize user input before renderi...

U.S. Dept Of Defense: Reflected XSS via Keycloak on ███ [CVE-2021-20323]

The Keycloak 8.0 and prior versions contained a cross-site scripting vulnerability. An attacker could have executed arbitrary script by inserting a malicious payload in the path of a POST request to the /auth/realms/master/clients-registrations/openid-connect endpoint. This allowed the server to...

Snapchat: Delete anyone's content spotlight remotely.

A vulnerability was discovered in Snapchat's Spotlight feature that allowed anyone to delete another user's content remotely. By intercepting and modifying the delete request, an attacker could replace the ID parameter with that of another user's video, resulting in the deletion of their content...

GitHub Security Lab: Java: Static initialization vector

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java] CWE-927: Sensitive broadcast

This bug was reported directly to GitHub Security Lab...

BugPoC: Reading arbitrary files via running arbitrary python code

Summary: Reading arbitrary files via running arbitrary python code Steps To Reproduce: 1. Go to Python POC and execute arbitrary code to read arbitrary files Recording: F976069 I have stopped testing further. Users can run arbitrary python code. Please do let me know If anything is unclear. Impac...

Solana BBP: i don't the important and it's impact . the affected asset: https://github.com/solana-labs/solana/blob/master/.buildkite/env/secrets.ejson

Summary: add summary of the vulnerability Steps To Reproduce: add details for how we can reproduce the issue 1.i have browsed this source code of github: https://github.com/solana-labs/solana/tree/master/sdk 2. i have browsed the files and i found the file which called buildkite/env/secrets.ejson...

Automattic: Denial-of- service By Cache Poisoning The Cross-Origin Resource Sharing Misconfiguration Allow Origin Header

Summery: The wp-json implementation on some WordPress websites I've tested is vulnerable to Denial-of-service where by an attacker can provide an arbitrary origin header in the request, which is then echoed back in the response via the Access-Control-Allow-Origin header, which is cached and serve...

X (Formerly Twitter): Periscope-all Firebase database takeover

Hello, I found one public Firebase database of periscope.tv and I can able to insert data to this database and i only used it once for the testing purposes, so other database queries also possible. Please follow the below link to check the inserted test data. Periscope-all Firebase URL :-...

X (Formerly Twitter): Periscope android app deeplink leads to CSRF in follow action

Hello Twitter Team Summary This issue is mainly in the Periscope Android app against CSRF follow action using deeplink. Description In normal Periscope Website, when we share a follow link like www.pscp.tv//follow, we get a response whether to follow a person or not, giving us an option, means CS...

Node.js third-party modules: XSS in express-useragent through HTTP User-Agent

Hello, I would like to report an XSS in express-useragent module due a lack of validating User-Agent header. Please note I already created an Github issue and asked for CVE CVE-2018-9863. I did not know about Node.js third-party modules on hackerone. Description express-useragent is simple...

WordPress: code.wordpress.net subdomain Takeover

Hy Wordpress sec i found as it is posible to takeover this domain http://code.wordpress.net when you navigate it you will get this error msg: Warning! Domain mapping upgrade for this domain not found. Please log in and go to the Domains Upgrades page of your blog to use this domain. $ host...

Mixmax: Possible Subdomain Takeover

None of the weakness categories really fit this so I apologize for that. The subdomain sales.mixmax.com points to 151.101.16.229, a webflow.io proxy server. Because it 404s, this leads me to believe that a subdomain takeover is possible through the webflow service as whatever this is pointing to ...

HackerOne: Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session

Hi guys , I have found a way to use the open redirect vulnerability that zendesk refused to fix and we discussed it in 101146 to bypass intristial redirect. in 101146 , @bencode said : I tend to agree with Zendesk, we don't really see any security issues with it. We use our interstitial to warn t...

Mail.ru: touch.afisha.mail.ru: XSS

Там весь хост дыряв. Отстреливает тут: alert1ff243" class="portal-footerlink"Полная версия | Главная | Все проекты GET /?page=dab52"alert1ff243 HTTP/1.1 Host: touch.afisha.mail.ru Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT...

Internet Bug Bounty: CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash example

airflow-2.3.3/airflow/exampledags/examplebashoperator.py has a command injection vulnerability. I can control the runid in the following codeexamplebashoperator.py,So I can inject custom commands. alsorunthis = BashOperator taskid='alsorunthis', bashcommand='echo "runid= runid | dagrun= dagrun "'...

GitHub Security Lab: [Python] CWE-287: LDAP Improper Authentication

This bug was reported directly to GitHub Security Lab...

UPchieve: url redirection

Summary: the following url is vulnerable to redirect https://app.upchieve.org Steps To Reproduce: when you add @evil.com the user will be directed to evil.com https://[email protected] Impact Users could get redirected to malicious domain...

New Relic: HTML Injection In Email In one.newrelic.com

Hi, There's a HTML injection vulnerability present inside emails sent from Newrelic when the name on the organization inviting user contains HTML. The html is stored in the backend database and when emails are sent invitation, the HTML is sent along with the rest of the email. Steps to reproduce:...

Node.js: Child process environment injection via prototype pollution

Summary: prototype pollution causes polluted system environment for child processes. Description: This can be used to inject arbitrary --require flags to node.js child processes or in the case of current node.js versions it can be used to inject arbitrary JavaScript to child processes. In practic...

h1-ctf: [h1-415 2020] My writeup on how to retrieve the special secret document

Summary: An attacker without any privilege is able to retrieve the special secret document, hosted on the https://h1-415.h1ctf.com website. To do so, multiple steps are required : 1. The authentication must be bypassed to have a licensed account; 2. The support team portal is vulnerable to a blin...

curl: Windows Privilege Escalation: Malicious OpenSSL Engine

Summary: The curl windows binaries are built with OpenSSL libraries and have an insecure path for the OPENSSLDIR build parameter. This path is set to c:\usr\local\ssl. When curl is executed it attempts to load openssl.cnf from this path. By default on windows, low privileged users have the...

X (Formerly Twitter): Changing email address on Twitter for Android unsets "Protect your Tweets"

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: Verifying email address on...

Ed: Session Cookie Without Secure Flag,

Assigned to:-ED Assigned by:- Kirtikumar Anandrao Ramchandani Assigned on:- 25/04/2018 Bug overview:- Session Cookie without secure flag. Cookie Name:- gitlabsession Description:-Risk description: Since the Secure flag is not set on the cookie, the browser will send it over an unencrypted channel...

TikTok: Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/upload

Vulnerability description not provided...

Node.js: Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: "rejectUnauthorized: false"...

BTFS: misconfigured CORS let to HPP and SOP bypass

Hello team, I found a bug on your website that let me bypass the SOP policy. Hope you fix it, everything is in the video https://www.youtube.com/watch?v=PYsU350S-s4 Impact The attacker my direct a victim to a phishing page of www.bitterrent.com/login and he/she will be convince to enter their ema...

Open-Xchange: Buffer over-reads in i_stream_zlib_read

This can be reproduced by a sample program using libcompression int mainint argc, char argv const unsigned char datadec; sizet sizedec; const uint8t data = argv1; sizet size = strlendata; struct istream testinput = testistreamcreatedatadata, size; const struct compressionhandler handler =...

Visma Bug Bounty Program: SSRF in img export

The researcher has found a SSRF vulnerability in the application's image export functionality. The app would take all the html as input and generate an image based on that. By manipulating the html code and adding a src tag, it was possible to trigger a SSRF...

Razer: Accessible Druid Monitor console on https://api.pay-staging.razer.com/

The tester discovered a monitoring application was available on a remotely accessible administrative console in the Razer Pay staging environment, which could have been used to leverage information that could have compromised the server. The Razer Pay team removed this and other similar servers...

Valve: [Half-Life 1] Malformed map name leads to memory corruption and code execution

A stack overflow takes place when map names with malformed names are listed which can be used to execute arbitrary code. I made a Proof of Concept that executes gnome-calculator on Linux. This was tested on Half Life 2018-08-29 on Linux, Ubuntu 18.04. To reproduce: - Extract the attached zip-file...

Semrush: Cross-origin resource sharing

Issue:Cross-origin resource sharing: arbitrary origin trusted The application implements an HTML5 cross-origin resource sharing CORS policy for this request that allows access from any domain. The application allowed access from the requested origin https://hhgdhgjgbrg.com Since the Vary: Origin...