Internet Bug Bounty: Improper handling of Chunked data request in sapi_apache2.c leads to Reflected XSS

Hey, Chunked requests can trigger xss and html injection at any end point because the APRBRIGADEINSERTTAILbrigade, bucket is getting destroyed by other handlers. Affected versions: Any OS: Any https://bugs.php.net/bug.php?id=76 Prashanths-MacBook-Pro: prashanthvarma$ nc localhost 80 POST /lol.php...

HackerOne: Invitation token leaks to https://bat.bing.com

Summary Invitation page contains iframes that points to https://b5s.hackerone-ext-content.com/!/invitations/ and https://a4l.hackerone-ext-content.com/!/invitations/. A GET request to these endpoints executes a script that points to https://bat.bing.com/bat.js. The corresponding request to bing...

CodeIgniter: Link sanitation bypass in xss_clean()

Hi there, While researching a website that uses your framework xssclean function to sanitize user's input in comments, I was able to bypass it and could trigger XSS payloads using javascript links in allowed tags such as anchors. This could be achieved by using the new HTML5 standard entities suc...

CS Money: Authentication Bypass to (CVE-2023-2982)

An authentication bypass vulnerability was discovered in an older version of the WordPress plugin WordPress Social Login and Register Discord, Google, Twitter, LinkedIn...

inDrive: the domain is truck-admin.eu-east-1.indriverapp.com and Enter the management system of the blasting mobile phone verification code

Vulnerability description not provided...

inDrive: inDriver Job - Admin Approval Bypass

A vulnerability was discovered in the "inDriver Job" application that allowed an attacker to bypass the admin approval process for publishing job offers. This vulnerability enabled the attacker to publish arbitrary content without undergoing the necessary moderation step...

Expedia Group Bug Bounty: Open Redirect in Logout & Login

An open redirect vulnerability was discovered in the logout and login functionality of Expedia's website. An attacker could exploit this vulnerability by manipulating the "rurl" parameter in the logout URL to redirect users to a malicious website, potentially leading to phishing or social...

GitHub Security Lab: [Python]: Add SqlAlchemy support for SQL injection query

This bug was reported directly to GitHub Security Lab...

Informatica: loing in to marketplace panel on enablement.informatica.com

hello dear support I have found the issue and you can log in in to panel with any password and username F1163976 url: https://enablement.informatica.com/marketplace/ F1163979 Impact Can gain access to admin panel...

Khan Academy: Login page vulnerable to bruteforce attacks via rate limiting bypass

SUMMARY This report consists of two vulnerabilities. 1st vulnerability: I found out that there is a rate limiting in place after 25 failed attempts. Now that is good, but when i use other email address to bruteforce, The rate limit didnt preserve to the new email. This may looks like a minor issu...

Brave Software: Brave Browser potentially logs the last time a Tor window was used

Summary: A vulnerability in the Brave Browser allows an attacker to view the last time a Tor session was used in incognito mode. A local, on-disk attacker could read the Brave Browser's "Local State" json file and identify the last time a Tor session was used, affecting the confidentiality of a...

GitHub Security Lab: LDAP injection vulnerability in Java

This bug was reported directly to GitHub Security Lab...

WordPress: CSRF on comment post

Hi Wordpress, I just found an CSRF on comment post. It allow attacker make victim comments on a post. Steps To Reproduce: Attacker send to victim a link with content below: history.pushState'', '', '/' Video poc: F891759 Impact Attacker make victim comments on a post...

curl: Partial password leak over DNS on HTTP redirect

Summary: From version 7.62 curl and curllib leaks part of user credentials in the plain text DNS request. This happens if the server makes redirect, both 301 and 302 to a relative path eg header 'Location: /login'. It is NOT an issue in case of absolute redirection eg header 'Location:...

BTFS: frame injection on bittorrent.com

Hi team, headers.php is injectable. you can see on IE browsers. FULL URL : https://www.bittorrent.com/scripts/site/headers.php?=1586521900793&callback=%3ciframe%20src%3d%22http%3a%2f%2fgoogle.com%2f%3f%22%3e%3c%2fiframe%3e Impact fix them...

Monero: Exploiting Network and Timing Side-Channels to Break Monero Receiver Anonymity

Summary: We present various examples of side-channel leakage in the communication between a Monero wallet and P2P node. Communication patterns and timing leak whether the wallet is the payee of a transaction that is sent into the transaction pool or mined in a block—thereby breaking transaction...

Uber: Arbitrary File Reading on Uber SSL VPN

The hacker has found a series of 0 day related to Pulse Secure SSL VPN...

Uber: Reflected XSS on multiple uberinternal.com domains

The base parameter of /oidauth/prompt on multiple uberinternal.com subdomains was not sanitized before being reflected into the page body, making it vulnerable to reflected XSS. Additionally, these pages were affected by a clickjacking vulnerability that made exploitation easier, since a click wa...

Gratipay: clickjacking on https://gratipay.com/on/npm/[text]

hi team .. i found clickjacking URL on https://gratipay.com/on/npm/here this clickjacking must be 3 characturs and must be 5 number this entered endpoint of URL .. please fixed soon https://gratipay.com/on/npm/text step respond 1- go to https://gratipay.com/on/npm/text 2 - check name or number...

arxius: another local file disclosure via ffmpeg

Summary The fix for https://hackerone.com/reports/242831 can be easily bypassed. It looks like you've banned file:// substring, which is not enough. Repro steps 1. Download genavi.py attached and run the script like this: python3 genavi.py /etc/passwd mustsandboxffmpeg.avi.mp4. 2. Visit...

Internet Bug Bounty: Roundcube virtualmin privilege escalation (CVE-2017-8114)

Description Password plugin in its virtualmin driver allows to an attacker, that has a valid username/password to login in his web panel, to execute malicious inputs. This could allow to an attacker to reset victim's password and in some scenarios getting a system shell. CVE CVE-2017-8114 Details...

Ubiquiti Inc.: HTML Injection on airlink.ubnt.com

Hi I found an html injection vulnerability on airlink.ubnt.com Steps to reproduce: First go to: https://airlink.ubnt.com//ptp Next go on Save Simulation button and as simulation name put: "HTMLINJECTIONHERE and save it Now go on Open Simulation button and you will see html being executed : Your...

ExpressionEngine: Type Juggling -> PHP Object Injection -> SQL Injection Chain

Justin Kennedy identified a Type Juggling vulnerability in ExpressionEngine that allowed access to unserialize using user supplied data, ultimately achieving SQL Injection. The full details of this vulnerability can be found here:...

X (Formerly Twitter): HTTP Response Splitting (CRLF injection) in report_story

Hi, I would like to report a HTTP Response Splitting vulnerability in https://twitter.com/i/safety/reportstory that allows attackers to inject arbitrary headers and contents in the response. PoC:...

BugPoC: LFI from bypassing image parser and faking HEAD response with redirection

Summary: add summary of the vulnerability By specially crafted request, a fake python3 http server and exploit.py we can read any files from the server Supporting Material/References: list any additional material e.g. screenshots, logs, etc. Bugpoc id: bp-HdMxEwwr bp-HdMxEwwr Bugpoc pass:...

Open-Xchange: Recursor accepts unsigned, empty NXDOMAINs in secure zones

Hi! This is a slightly edited version of the email I sent to the project's security contacts on 2020-04-21. Open-Xchange confirmed it and asked me to resubmit it here. --- Subject: Recursor may be accepting unsigned, empty NXDOMAINs in secure zones I can easily reproduce this against Cloudflare's...

PayPal: Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password

A bug was identified whereby sensitive, unique tokens were being leaked in a JS file used by the recaptcha implementation. In certain cases, a user must solve a CAPTCHA challenge after authenticating. When the security challenge is completed, the authentication request is replayed to log in. The...

U.S. Dept Of Defense: [Urgent] Critical Vulnerability [RCE] on ███ vulnerable to Remote Code Execution by exploiting MS15-034, CVE-2015-1635

@ashutosh7 found a ███████ server in Shodan, vulnerable to MS15-034, confirmed using Metasploit. Thanks for participating in the DoD VDP. Found a ████ server in shodan, vulnerable to MS15-034. confirmed using Metasploit. will add the link for the writeup...

HackerOne: Self DOM-Based XSS in www.hackerone.com

Summary: There is a 'self' DOM-based cross-site scripting vulnerability in the contact form available on the www.hackerone.com website. This could allow an attacker to perform cross-site scripting, or other client-side attacks, against users of the application. However, the risk presented by this...

New Relic: Insecure Infrastructure Integrations YML Loading leads to Windows Privilege Escalation

After installing the Windows Infrastructure client as discussed in https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/installation/install-infrastructure-windows-server I noticed that integration yml config files are not only loaded from the folder within Program Files, but al...

Open-Xchange: [XSS] content_disposition=inline in files

Hi. No filter for application/ when contentdisposition=inline PoC: - 1. Auth https://sandbox.open-xchange.com/ajax/share/021f28560fbe7d5b21f28d3fbe7d42379932c8eb965ee141/1/8/NTc/NTcvMzQ4 2. XSS...

Trello: Unpatched (https://hackerone.com/reports/221928)- Unviladate File Upload to XSS on trello-attachment Bucket

Report no: https://hackerone.com/reports/221928 is unpatched. Poc: https://trello-attachments.s3.amazonaws.com/59663070a9025afc4b32c7c6/596641e05abfc29b1bd67ff8/9c5258c6acf27ffdf5e80d5bfabbb83b/lol.svg XSS Link...

Internet Bug Bounty: PHP INI Parsing Stack Buffer Overflow Vulnerability

Description: A stack buffer overflow exists in the latest stable release of PHP-7.1.5 and PHP-5.6.30 in PHP INI parsing API, which may accept network / local filesystem input. On malformed inputs, a stack buffer overflow in zendinidoop could write 1-byte off a fixed size stack buffer. On...

U.S. Dept Of Defense: Path traversal on ████████

Summary: The web application hosted on the "█████████" domain is affected by a path traversal vulnerability that could permit to an attacker to include arbirtary files that are outside of the restricted directory. Description: The affected handler is the "/html/js/editor/editor.jsp". This handler...

HackerOne: PNG compression DoS

ztxt: http://www.libpng.org/pub/png/spec/1.1/PNG-Chunks.htmlC.zTXt "zTXT Documentation" tech: http://www.zlib.net/zlibtech.html "zlib technical details" zlibvuln1: http://www.kb.cert.org/vuls/id/680620 zlibvuln2: http://www.kb.cert.org/vuls/id/238678 PNG compression DoS ---------------------...

HackerOne: GIF flooding

Current limits --------------------- Image size: 1 MB Image dimensions: 2048x2048px File types: jpg/png/gif Another image hack --------------------- A GIF composed of 40k 1x1 images made Paperclip freeze until timeout. As attachments I sent the file composed of 40k images, and a screenshot of the...

inDrive: SSRF in https://couriers.indrive.com/api/file-storage

A server side request forgery vulnerability was present in the url parameter of the https://couriers.indrive.com/api/file-storage endpoint, allowing arbitrary external websites to be requested and their content returned in responses...

curl: CVE-2022-27774: Credential leak on redirect

Summary: Curl can be coaxed to leak user credentials to third-party host by issuing HTTP redirect to ftp:// URL. Steps To Reproduce: 1. Configure for example Apache2 on firstsite.tld to perform redirect with modrewrite: RewriteCond %HTTPUSERAGENT "^curl/" RewriteRule ^/redirectpoc...

Krisp: Visibility Robots.txt file

Issue detail:- The web server contains a robots.txt file. Issue background:- The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site that robots are allowed, or not allowed, to crawl and index. The presence of the...

Fastify: Open redirect in fastify-static via mishandled user's input when attempt to redirect

Summary: When fastify-static is mounted at root and the register option redirect: true, the following 2 lines cause open redirect bug: https://github.com/fastify/fastify-static/blob/master/index.jsL156-L157. A remote attackers can redirect users to arbitrary web sites via a double forward slash:...

QIWI: gifts.flocktory.com/phpmyadmin is vulnerable csrf

Summary: Hello Team, I found that the PHPMyAdmin login panel is publicly accessible on https://gifts.flocktory.com and it is using the 4.6.6 version of PHPMyAdmin, which is vulnerable to several CVEs...

Endless Group: CVE-2020-14179 on https://jira.theendlessweb.com/secure/QueryComponent!Default.jspa leads to information disclosure

Hello theendlessweb team, Summary: the Jira instance on jira.theendlessweb.com is vulnerable to CVE-2020-14179 which allows remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability F1029731 Steps To Reproduce: Navigate to...

Mail.ru: Broken twitter link hijacking at https://games.mail.ru/pc/search/

Link on https://games.mail.ru/pc/search/ page was pointing to invalid twitter account...

Automattic: [tumblr.com] 69< Firefox Only XSS Reflected

Description : Hello, i have found a XSS Reflected in https://www.tumblr.com/abuse/start?prefill= But the XSS only works in versions of firefox that are below 70. Because its been blocked by CSP, but the version below 69 of firefox is vulnerable. Here's a great article about this subject...

Snapchat: Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.io

Researcher found valid jFrog credentials which were committed to a public Github repository of a Snap employee. This allowed access to internal Snap libraries/artifacts along with the ability to push updates to existing artifacts as well...

Stripo Inc: Blind SSRF while Creating Templates

Blind SSRF While Creating Email Templates...

Starbucks: Account take over of 'light' starbuckscardb2b users

This issue was found on https://www.starbuckscardb2b.com, this website belongs to starbucks and its is a critical vulnerability so I am reporting this. Issue: An attacker can takeover the account of the victim by creating a new account by using victim's who is already registered email address...

Zomato: [www.zomato.com] IDOR - Gold Subscription Details, Able to view "Membership ID" and "Validity Details" of other Users

Hello Zomato, The following URL : https://www.zomato.com/gold/payment-success?subscriptionid=██████████&userid=█████████ is vulnerable to IDOR in subscriptionid field. Anyone can get Subscription Start & End Date and Plan Duration of a Membership ID just by changing the subscriptionid parameter...

Starbucks: Time-based Blind SQLi on news.starbucks.com

Hi, I just found that the post parameter "groupid" for a particularly crafted http request is being vulnerable to injection due to missing parameter sanitization. PoC: POST / HTTP/1.1 Host: news.starbucks.com Connection: close Content-Length: 81 Cache-Control: max-age=0 Origin:...

Pornhub: Reflected cross-site scripting (XSS) vulnerability in pornhub.com allows attackers to inject arbitrary web script or HTML.

The researcher discovered a reflected cross-site scripting vulnerability on the users' page. Short Description --- I managed to bypass the fix to ZephrFish's report by encoding the = symbol %3D. Therefore, pornhub.com was still vulnerable to reflected XSS, a form of client-side code injection...