GitHub Security Lab: [C#]: HttpOnly and Secure Cookies for .NET Core and .NET

This bug was reported directly to GitHub Security Lab...

Sifchain: ETHEREUM_PRIVATE_KEY leaked via github

ETHEREUMPRIVATEKEY It is used to sign Ethereum transactions on the Blockchain. Steps To Reproduce: Open this url https://github.com/Sifchain/sifnode/blob/f96727748e1f44926d3bd72b1021f6c2461dee17/test/integration/start-integration-env.sh POC - screenshot attached Impact It shouldn’t be publicly...

GitHub Security Lab: [Python] CWE-090: LDAP Injection

This bug was reported directly to GitHub Security Lab...

Node.js: DNS Max Responses for DOS

See Github my issue: https://github.com/nodejs/node/issues/36063 When i try to fetch the A Dns records of following domain: ticbrasil.com.br I dont get any response. I think thats the case because there are over 1300 responses. Version: v12.18.4, v14.15.0 Platform: 64-bit Windows 10 Pro &...

Nextcloud: No rate limiting for confirmation email lead to huge Mass mailings

Issue Description No rate limit means their is no mechanism to protect against the requests you made in a short frame of time. If the repetition doesn't give any error after 50, 100, 1000 repetitions then their will be no rate limit set. vulnerable has registred in 297359 774050 922470 URL Effect...

GitLab: Adding everyone to the repo due to the lack of rate limit

Summary Since there is no rate limit in the inviting users to the repository section, it is possible to add all users on gitlab to a repository. Steps to reproduce Step-by-step guide to reproduce the issue, including: 1. Create a repository 2. go to the project members section 3. choose a random...

Endless Group: XSS on https://fax.pbx.itsendless.org/ (CVE-2017-18024)

Summary: Hello Endless Hosting, I found an XSS on https://fax.pbx.itsendless.org/ . This domain running an AvantFax software 3.3.6 However, the exploit of CVE-2017-18024 for version 3.3.3 is working on that version. Here is the exploit code of CVE-2017-18024 history.pushState'', '', '/'...

Nextcloud: Email Spoofing

An SPF/DMARC record is a type of Domain Name Service DNS record that identifies which mail servers are permitted to send email on behalf of your domain. The purpose of an SPF/DMARC record is to prevent spammers from sending messages on the behalf of your organization. Remediation: Create a SPF...

Phabricator: Markdown parsing issue enables insertion of malicious tags

mongoose By exploiting the URL markdown an attacker is able to add tags to an anchor-element. This is less impactfull since the default csp policy blocks inline javascript execution, but an attacker could deface individual pages, bypass the rel="norefferrer" tag to perform tab nabbing or perform...

Rocket.Chat: XSS (leads to arbitrary file read in Rocket.Chat-Desktop)

Description: Rocket.Chat allows administrative users to customize the home body. Since tags are removed, I think that running scripts should not be allowed. However, event handlers are not removed, allowing you to inject your own scripts. Releases Affected: Rocket.Chat-Desktop-Client: v2.15.5...

LocalTapiola: Internal IP Address Disclosure at https://www.lahitapiolarahoitus.fi/wp-json/wp/v2/pages

Basic report information Summary: Hello, i found an internal ip address at https://www.lahitapiolarahoitus.fi/wp-json/wp/v2/pages. Description: While digging the path in /wp-json/ directory, i found this url : https://www.lahitapiolarahoitus.fi/wp-json/wp/v2/pages and when i request this using Bu...

X (Formerly Twitter): POODLE SSLv3 bug on multiple twitter smtp servers (mx3.twitter.com,199.59.148.204,199.16.156.108 and 199.59.148.204)

Summary: POODLE SSLv3 bug on multiple twitter smtp servers Description: CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle...

Gratipay: HTTP trace method is enabled on gip.rocks

Hello, HTTP TRACE method is enabled on your server which should not be enabled. It can lead to cross site tracing ! Cross site tracing: https://www.owasp.org/index.php/CrossSiteTracing curl -X TRACE http://gip.rocks/ -vv Hostname was NOT found in DNS cache Trying 184.73.218.93... Connected to...

Bumble: Получение оригинала скрытого изображения

Здравствуйте! В вашем сервисе есть фотографии сильно низкого качества, чтобы было невозможно разобрать кто на нем изображен. например разделе "Кому вы нравитесь?" Наше способ получить оригинал. Берем адрес скрытой картинки:...

Gratipay: PHP 5.4.45 is Outdated and Full of Preformance Interupting Arbitrary Code Execution Bugs

Your PHP version is affected by quite a few remote arbitrary code execution, remote file renaming, and remote file rewriting bugs that require no authentication and can cause big problems, from performance interruptions and messing with server files to DoS attacks. These are not related to any...

curl: Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.

Vulnerability description not provided...

U.S. Dept Of Defense: AEM misconfiguration leads to Information disclosure

Sensitive information was disclosed due to a misconfiguration in AEM, allowing access to internal usernames and webroot directories by appending /.1.json to certain URLs. This could lead to unauthorized access, social engineering attacks, and reputation damage...

Sifchain: Cross Origin Resource Sharing Misconfiguration | Lead to sensitive information.

hii team, i found a cors bug in your https://sifchain.finance/ website . Steps To Reproduce: 1. goto https://sifchain.finance/ website and enter email and click signup. 2. intercept via burp ,you will get a request . send to repeater. 3.change the request as POST /==wp-json== HTTP/2 Host:...

GitHub Security Lab: Java: Query for detecting unsafe deserialization with Spring exporters

This bug was reported directly to GitHub Security Lab...

HackerOne: Second-order SOQL injection through email and campaign name parameter in Salesforce lead submission

The HackerOne directory contains profiles of bug bounty and vulnerability disclosure programs that aren't managed on HackerOne. These profiles can be claimed by the organization that manages it. As part of this flow, they will need to enter an email address to confirm that affiliation with the...

Courier: Bypass Too Many Requests Sign Up

Courier makes a rate limit check before allowing a user to register; this rate limit check can be bypassed and a user account can be created by sending a request directly to the AWS Cognito API – which is not rate limited...

lemlist: app.lemlist.com : Admin Panel Access

hi team, Steps To Reproduce: While doing some analyse for javascript files in app.lemlist.com i found interesting endpoints . is the admin panal and is not protected , any normal user can access the panel . Steps To Reproduce: Add details for how we can reproduce the issue 1. Log into your accoun...

Genasys Technologies: Login Bypass to OTP Enumeration

Summary: If an attacker gets access to the victim's username or know the email used for logging in to the application.He can bypass the login by enumeration og One Time Password. Steps To Reproduce: 1.Go to https://staging.genasystech.co.uk/d2c/ 2.Create an account ,Enter the relevant pin for...

HackerOne: Private program disclosure via `vpn_suspended` GraphQL query

Summary: vpnsuspended of Team object got exposed Description: An attacker can get vpnsuspended value of any program including external program which also have private program eg. █████ and external program which does not have private program What an attacker can do with this ? If an external...

Liberapay: Private target account appears in search results

Summary At policy page, there are special tailor account, highly confidential & secret ! F600997 - Hide this profile from search results on Liberapay - Prevent this profile from being listed on Liberapay - Target account hackerone-target-team Description In this exploit, I found Privacy setting...

curl: SSRF via maliciously crafted URL due to host confusion

Summary: Curl is vulnerable to SSRF due to improperly parsing the host component of the URL compared to other URL parsers and the URL living standard. POC curl -sD - -o /dev/null "http://google.com:80\@yahoo.com/" Curl makes a request to yahoo.com instead of google.com. Supporting...

Node.js third-party modules: [jsreport] Remote Code Execution

I would like to report Remote Code Execution in jsreport It allows running js files remotely on a vulnerable server. Module module name: jsreport version: 2.5.0 npm page: https://www.npmjs.com/package/jsreport Module Description jsreport is a reporting server which lets developers define reports...

Uber: Full Path and internal information disclosure+ SQLNet.log file disclose internal network information

The site at lab.usuppliers.uber.com was intended only for authenticated users, but certain internal pages did not enforce an authentication requirement. The log file at /OAHTML/bin/sqlnet.log disclosed internal Uber IP addresses, hostnames, and one internal username. Thanks again for this report...

HackerOne: DOM Based XSS in www.hackerone.com via PostMessage

Summary: The Marketo contact form available on the www.hackerone.com website is affected by a cross-site scripting vulnerability, caused by an insecure 'message' event listener installed on the page. Whilst this could allow an attacker to execute JavaScript in the context of the www.hackerone.com...

Mail.ru: XSS account.mail.ru in state JSON script

Domain, site, application -- account.mail.ru Testing environment -- Chrome Steps to reproduce -- Login and open...

Deriv.com: login to any user's cashier account and full account information disclosure

Hi , I have found an issue allowing an attacker to login to any user's cashier account and view sensitive user information by just knowing the user account ID. Steps to reproduce: 1. open 2 browsers and create 2 accounts , login with each account on a browser. 2. let's call account 1 , the victim...

Square: Blind SQL injection in www.bookfresh.com

The resource at /reservations doesn't properly sanitise the "client" variable before putting it into a MySQL statement. This results in a Blind SQL Injection vulnerability. We can demonstrate the vulnerability by making the SQL server wait for a while before responding. PoC wait a while:...

U.S. Dept Of Defense: Reflected XSS via Keycloak on ███ [CVE-2021-20323]

The Keycloak 8.0 and prior versions contained a cross-site scripting vulnerability. An attacker could have executed arbitrary script by inserting a malicious payload in the path of a POST request to the /auth/realms/master/clients-registrations/openid-connect endpoint. This allowed the server to...

Sixt GmbH & Co. Autovermietung KG BBP: Cross domain token leakage via Referer header

Summary: The password reset link of user account on critical sixt+ domain/product can be obtained using the page https://www.sixt.com/php/profile/loginorpasswordforgotten. This page requires email address and surname/lastname of the user to send password reset link on email. This link contains th...

GitHub Security Lab: [Java] CWE-755: Query to detect Local Android DoS caused by NFE

This bug was reported directly to GitHub Security Lab...

Palo Alto Software: IDOR on update user preferences

Summary: Team member with role USER can change data of any user in the team, or steal his cookies, or steal the account of victim via forget password function. Steps To Reproduce: 1. Login in as user1 the user with role admin and invite user2 set his role to user. 2. Login in as user2, open Mail...

Bumble: Bruteforce password recovery code

Summary It's possible to bruteforce recovery code from SMS as iOS application doesn't have limits for incorrect inputs. I have tried 50+ different combinations until I reached code from SMS. Steps To Reproduce 1. Click "Use another option" on application startup view 1. Enter your phone number 1...

HackerOne: Any user with access to program can resume and suspend HackerOne Gateway

An Insecure Direct Object Reference IDOR vulnerability is present in the UpdateGatewayProgramStateMutation that'd allow an attacker to suspend and resume the HackerOne Gateway feature for any program the user has access to. This includes any private programs that use the Gateway product and have ...

Shopify: Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission

Technical Background ===================== Shopify Apps need an access token to work with the data of a store. Is very important to keep this token in a secure place. Quoting the Shopify Blog: ... this is like a password into this shop, so you’ll want to store this token in a very safe place...

Internet Bug Bounty: Heap Buffer Overflow (READ: 1786) in exif_iif_add_value

The exifreaddata function is prone to an out of bounds read while processing crafted JPG data. This was discovered using AFL. It can be reproduced as follows: USEZENDALLOC=0 php -r...

Phabricator: Hyper Link Injection In email and Space Characters Allowed at Password Field.

Hello mongoose , I found that when you put email and password for signup, you can use space characters for the password which shouldn't be allowed. I also found that you can use hyperlink in First Name Field at next step when you are entering your personal information here and when you will get t...

curl: CVE-2023-38545: socks5 heap buffer overflow

Vulnerability description not provided...

Fastly VDP: Cache purge requests are not authenticated

Vulnerability description not provided...

Nextcloud: Default Nextcloud allows http federated shares

userA on serverA runs on http only 2. userA sends a federated share to userB on serverB 3. userB is a normal user so he has no clue that there is no secure transport used and accepts the share 4. all the data written to and read from is now no longer protected by TLS Impact While maybe a bit far...

HackerOne: Dangling cloud instance at vpn.inverselink.com

Summary: vpn.inverselink.com points to 54.202.130.246, which is currently serving a TLS certificate for Workday, Inc. This seems to indicate that the subdomain is no longer controlled by HackerOne. Optional: Supporting Material/References Screenshots % dig vpn.inverselink.com +short 54.202.130.24...

VK.com: Reflected XSS в /video

XSS в поиске по видеозаписям. xss в параметрах date, len, order при поиске видеозаписи с указанием параметров...

Stripo Inc: SSRF external interaction

hi team, i found ssrf external interaction on your website which is https://my.stripo.email/cabinet//login?guid=&tn=&locale=en on chatbox description:- the attacker might cause the server to make connection back to it self or to other web services within the organization infrastructure or to...

U.S. Dept Of Defense: [SQLI ]Time Bassed Injection at ██████████ via referer header

Hi the ████ was vulnerable to time bassed injection via referer header steps 1- copy the request to your burp suite : GET /DNCdb.php?alert= HTTP/1.1 Host: ███████ User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:81.0 Gecko/20100101 Firefox/81.0 Accept:...

Shipt: bypass the [OKTA] login redirect can lead to disclosing limited-information about the sub-domain at [ shiptsec.com ]

A security researcher identified limited and non-sensitive information disclosure for one of our public-facing tools that is used by internal users. While the risk was very low and nothing was directly exploitable, we went ahead and made the quick change to mitigate this behavior. We made the...

h1-ctf: [H1-2006 2020] CTF Writeup

Summary: Multiple Vulnerabilities leading to full account takeover and access to restricted functions 1. Information Disclosure 2. Login 2FA Bypass 3. SSRF 4. Hardcoded validation 5. Sensitive information disclosure 6. Privilege Escalation 7. Payments 2FA Bypass through SSRF Steps To Reproduce: 0...