15580 matches found
Endless Group: Lets Encrypt Certificates affected by CAA Rechecking Incident
Summary: Lets encrypt released a statement regarding 3 million certificates being revoked due to a issue in the CA signing process, Looking at your subdomains it appears that you are affected by this incident. When the revoking occurs the certificates the certificates are no longer valid. This ma...
Node.js third-party modules: [utils-extend] Prototype pollution
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report prototype poluti...
Shopify: Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation
Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation Summary This report is based on the scenario that email confirmation has been bypassed already, like shown in 791775. What happened in 791775 was, I was too excited and didn't take a step...
Starbucks: Account take over of 'light' starbuckscardb2b users
This issue was found on https://www.starbuckscardb2b.com, this website belongs to starbucks and its is a critical vulnerability so I am reporting this. Issue: An attacker can takeover the account of the victim by creating a new account by using victim's who is already registered email address...
PayPal: Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password
A bug was identified whereby sensitive, unique tokens were being leaked in a JS file used by the recaptcha implementation. In certain cases, a user must solve a CAPTCHA challenge after authenticating. When the security challenge is completed, the authentication request is replayed to log in. The...
Mail.ru: [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious File
Combination of improper access control and unrestricted files upload in non-production service led to RCE possibility...
U.S. Dept Of Defense: [Urgent] Critical Vulnerability [RCE] on ███ vulnerable to Remote Code Execution by exploiting MS15-034, CVE-2015-1635
@ashutosh7 found a ███████ server in Shodan, vulnerable to MS15-034, confirmed using Metasploit. Thanks for participating in the DoD VDP. Found a ████ server in shodan, vulnerable to MS15-034. confirmed using Metasploit. will add the link for the writeup...
Trello: Unpatched (https://hackerone.com/reports/221928)- Unviladate File Upload to XSS on trello-attachment Bucket
Report no: https://hackerone.com/reports/221928 is unpatched. Poc: https://trello-attachments.s3.amazonaws.com/59663070a9025afc4b32c7c6/596641e05abfc29b1bd67ff8/9c5258c6acf27ffdf5e80d5bfabbb83b/lol.svg XSS Link...
Pornhub: Reflected cross-site scripting (XSS) vulnerability in pornhub.com allows attackers to inject arbitrary web script or HTML.
The researcher discovered a reflected cross-site scripting vulnerability on the users' page. Short Description --- I managed to bypass the fix to ZephrFish's report by encoding the = symbol %3D. Therefore, pornhub.com was still vulnerable to reflected XSS, a form of client-side code injection...
CodeIgniter: Link sanitation bypass in xss_clean()
Hi there, While researching a website that uses your framework xssclean function to sanitize user's input in comments, I was able to bypass it and could trigger XSS payloads using javascript links in allowed tags such as anchors. This could be achieved by using the new HTML5 standard entities suc...
X (Formerly Twitter): HTTP Response Splitting (CRLF injection) in report_story
Hi, I would like to report a HTTP Response Splitting vulnerability in https://twitter.com/i/safety/reportstory that allows attackers to inject arbitrary headers and contents in the response. PoC:...
HackerOne: Business Logic error leads to bypass 2FA requirement
Vulnerability description not provided...
Internet Bug Bounty: CVE-2023-25692: Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service and Remote Command Execution
An improper input validation vulnerability was discovered in the Apache Airflow Google Provider, affecting versions before 8.10.0. Attackers could modify existing connection configuration information to execute malicious commands or create arbitrary files, leading to denial of service...
Glassdoor: Web Cache Poisoning leads to XSS and DoS
@nokline and @bombon were able to utilize URL parser confusion in combination with reflected XSS under https://glassdoor.com/Job/ and https://glassdoor.com/mz-survey/interview/collectQuestionsinput.htm/ by caching XSS payloads via cookie and header params into a stored XSS for URLs /Award/ and...
U.S. Dept Of Defense: SSRF due to CVE-2021-27905 in www.████████
Apache Solr is vulnerable to SSRF using the parameter "masterUrl". This issue is registered as CVE-2021-27905. Impact A successful SSRF attack can often result in unauthorized actions or access to data within the organization, either in the vulnerable application itself or on other back-end syste...
h1-ctf: First CTF ever!
Pretext Started looking into hacking this autumn and then found out HackerOne was doing a Christmas themed CTF. Further investigation showed that the deplorable Grinch might be up to no good again - Christmas is in danger! TLDR Lots of hacking took place, the Grinch was stopped, Christmas saved a...
U.S. Dept Of Defense: Unauthenticated Arbitrary File Deletion ("CVE-2020-3187") in ████████
Description: A vulnerability in the interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files. Vulnerable...
Shopify: Password protection can be removed for newly created development store
Details Per https://help.shopify.com/en/partners/dashboard/managing-stores/development-storesthe-development-store-password-page, it states that the password can only be removed once the store has been transferred or switch to a paid plan. You can remove the password page only after you transfer...
Courier: Bypass Too Many Requests Sign Up
Courier makes a rate limit check before allowing a user to register; this rate limit check can be bypassed and a user account can be created by sending a request directly to the AWS Cognito API – which is not rate limited...
Snapchat: Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.io
Researcher found valid jFrog credentials which were committed to a public Github repository of a Snap employee. This allowed access to internal Snap libraries/artifacts along with the ability to push updates to existing artifacts as well...
Open-Xchange: Recursor accepts unsigned, empty NXDOMAINs in secure zones
Hi! This is a slightly edited version of the email I sent to the project's security contacts on 2020-04-21. Open-Xchange confirmed it and asked me to resubmit it here. --- Subject: Recursor may be accepting unsigned, empty NXDOMAINs in secure zones I can easily reproduce this against Cloudflare's...
Node.js third-party modules: Server Side Request Forgery in Uppy npm module
Hi Team, While we were testing our security engine at Shieldfy https://shieldfy.io, We found a server side request forgery SSRF vulnerability in Uppy npm package. It allows hacker to easily extract inside information from the server or take control of internal services. Module module name: Uppy...
Monero: Exploiting Network and Timing Side-Channels to Break Monero Receiver Anonymity
Summary: We present various examples of side-channel leakage in the communication between a Monero wallet and P2P node. Communication patterns and timing leak whether the wallet is the payee of a transaction that is sent into the transaction pool or mined in a block—thereby breaking transaction...
Mail.ru: Disable 2FA via CSRF (Leads to 2FA Bypass)
CSRF vulnerability in pandao.ru allowed to disable 2FA. pandao.ru belongs to extended scope...
Zomato: [www.zomato.com] IDOR - Gold Subscription Details, Able to view "Membership ID" and "Validity Details" of other Users
Hello Zomato, The following URL : https://www.zomato.com/gold/payment-success?subscriptionid=██████████&userid=█████████ is vulnerable to IDOR in subscriptionid field. Anyone can get Subscription Start & End Date and Plan Duration of a Membership ID just by changing the subscriptionid parameter...
Internet Bug Bounty: Exim off-by-one RCE vulnerability
Hi, I found an off-by-one in Exim MTA utility function. It was reported to exim and official patch has been released, assigned CVE-2018-6789. This bug affects all versions of exim. This bug is simple, but can be leverage to gain remote code execution, using skillful heap exploitation. Details are...
Ubiquiti Inc.: HTML Injection on airlink.ubnt.com
Hi I found an html injection vulnerability on airlink.ubnt.com Steps to reproduce: First go to: https://airlink.ubnt.com//ptp Next go on Save Simulation button and as simulation name put: "HTMLINJECTIONHERE and save it Now go on Open Simulation button and you will see html being executed : Your...
HackerOne: Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP
Hi, I just discovered that there's a scenario where the Marketo Forms solution being used on www.hackerone.com can actually be abused, using a few fun techniques, to trigger an XSS in the Cross-Origin-iframe being used by Marketo. This results in eavesdropping of the data being sent in the...
Starbucks: Time-based Blind SQLi on news.starbucks.com
Hi, I just found that the post parameter "groupid" for a particularly crafted http request is being vulnerable to injection due to missing parameter sanitization. PoC: POST / HTTP/1.1 Host: news.starbucks.com Connection: close Content-Length: 81 Cache-Control: max-age=0 Origin:...
U.S. Dept Of Defense: Out-of-date Version (Apache)
URL https://████████/ Identified Version 2.2.15 contains 4 important and 10 other vulnerabilities Latest Version 2.2.31 Vulnerability Database Result is based on 27.10.2016 vulnerability database content. Vulnerability Details Link identified you are using an out-of-date version of Apache. Impact...
Lichess: Improper Authentication Throttling Allows Attacker-Controlled Account Lockouts
The application lacks sufficient safeguards in its authentication throttling logic. It permits arbitrary users to trigger lockouts on any account by submitting multiple failed login attempts using a known or guessed username. Because the system does not verify the request origin or impose...
TikTok: bypass two-factor authentication in Android apps and web
A vulnerability was found where a random timeout issue on a Two-Step Verification endpoint could have resulted in a potential bypass of authentication if multiple incorrect attempts were entered in quick succession. It was found that this vulnerability required access to the user's email/password...
UPchieve: Authentication Bypass - Email Verification code bypass in account registration process.
Hi Team, I was able to bypass Email Verification code in account registration process. Summary : Authentication Bypass is a dangerous vulnerability, which is found in Web-Applications. An Attackers can bypass the control mechanisms which are used by the underlying web application like Email...
Affirm: Subdomain takeover of www█████████.affirm.com
Summary Hi there, assuming you want this report as your policy mentions Affirm resources with third-parties, but the scope was a little unclear. Regardless, www█████.affirm.com points to an AWS S3 bucket affirm-prod-www-cms█████████ that no longer exists. I was able to take control of this bucket...
Zivver: ADB Backup is enabled within AndroidManifest
In this report, it was highlighted that the ADB backup feature enabled in the Android application could be used by an attacker with physical access to the victim's device to 'migrate' data from app storage on the phone and later possibly extract secrets from that backup. For this attack to succee...
Doppler VDP: No rate limit into email change leads to email notification boombing to its victim.
hello team, I have tested your application and found no any rate limit into password changing mechanism which allow attacker to send unlimited number of email notification to his victim, Basically in every part of your application has implemented rate limit block system but email changing area do...
Courier: Rate limit function bypass can leads to occur huge critical problem into website.
Hello team, I have found a technique that can easily bypass rate limit system of website and with this bug we attacker can easily attack into login panel, Sent unlimited number of huge notification to victim, bypass OTP codes and takeover accounts etc. Basically i have added a header...
Nextcloud: Denial of Service when entring an Array in email at seetings
in settings https://demo2.nextcloud.com/index.php/settings/users/TweLbFT93aqRnEfF/settings when you submit the request with email value Array the server return 500 Internal Server Error Poc video: F954435 Impact denial a service attack on the server. This may lead to the website becoming slow or...
Automattic: [tumblr.com] 69< Firefox Only XSS Reflected
Description : Hello, i have found a XSS Reflected in https://www.tumblr.com/abuse/start?prefill= But the XSS only works in versions of firefox that are below 70. Because its been blocked by CSP, but the version below 69 of firefox is vulnerable. Here's a great article about this subject...
U.S. Dept Of Defense: Subdomain takeover of ████
Summary: I was able to claim the subdomain: ████ using Microsoft Azure CDN profiles Description: Impact Platforms Affected: Subdomain Azure CDN Step-by-step Reproduction Instructions 1. Using dig, I was able to determine that the subdomain '███████' was vulnerable to takeover. The record showed...
HackerOne: Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent
An Insecure Direct Object Reference IDOR vulnerability allow the reporter, external users, and collaborators to mark sent swag that was awarded to the reporter as unsent. This may result in swag being sent multiple times. Proof of concept Follow the steps below to reproduce the vulnerability. sig...
curl: SSRF via maliciously crafted URL due to host confusion
Summary: Curl is vulnerable to SSRF due to improperly parsing the host component of the URL compared to other URL parsers and the URL living standard. POC curl -sD - -o /dev/null "http://google.com:80\@yahoo.com/" Curl makes a request to yahoo.com instead of google.com. Supporting...
Shopify: Stored - XSS
Hello Security Team, I have Found Stored XSS Vulnerability POC : Step1: Go to https://app.oberlo.com/suppliers Step2: Click on any product you will be redirected to URL as i have given for example...
RATELIMITED: Information Disclosure on https://theendlessweb.com/
Dear Team, I have found an Information Disclosure Vulnerabilities at https://theendlessweb.com/ Step to Reproduce: Step 1: https://theendlessweb.com/vendor/composer/installed.json Let me know if you need any additional information. Regards, Dhamu. Impact This file expose sensitive information tha...
HackerOne: CSV Injection with the CVS export feature
The "Download as a CSV" feature of HackerOne does not properly "escape" fields. This allows an adversary to turn a field into active content so when a response team download the csv and opens it, the active content gets executed. Here is more information about this issue:...
Nextcloud: No password length restriction in reset password endpoint
There was no password length restriction in the reset password endpoint of the Nextcloud platform, which could allow an attacker to perform a denial of service attack by entering a large number of characters as a password. The vulnerability has been mitigated by restricting users to use less than...
Acronis: mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040
Hello Acronis team, Please run curl -ksL -m5 -o /dev/null -I -w "%httpcode" "https://mail.acronis.com/autodiscover/autodiscover.json?Email=autodiscover/[email protected]&Protocol=ActiveSync" curl -ksL -m5...
Internet Bug Bounty: DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
A vulnerability in Node.js allowed an attacker-controlled DNS server to bypass DNS rebinding protection by resolving hosts in the .local domain. This allowed an attacker to gain access to the Node.js debugger, potentially resulting in remote code execution. The vulnerability affected all versions...
Krisp: Visibility Robots.txt file
Issue detail:- The web server contains a robots.txt file. Issue background:- The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site that robots are allowed, or not allowed, to crawl and index. The presence of the...