15700 matches found
RATELIMITED: Information Disclosure on https://theendlessweb.com/
Dear Team, I have found an Information Disclosure Vulnerabilities at https://theendlessweb.com/ Step to Reproduce: Step 1: https://theendlessweb.com/vendor/composer/installed.json Let me know if you need any additional information. Regards, Dhamu. Impact This file expose sensitive information tha...
Internet Bug Bounty: Exim off-by-one RCE vulnerability
Hi, I found an off-by-one in Exim MTA utility function. It was reported to exim and official patch has been released, assigned CVE-2018-6789. This bug affects all versions of exim. This bug is simple, but can be leverage to gain remote code execution, using skillful heap exploitation. Details are...
Ubiquiti Inc.: HTML Injection on airlink.ubnt.com
Hi I found an html injection vulnerability on airlink.ubnt.com Steps to reproduce: First go to: https://airlink.ubnt.com//ptp Next go on Save Simulation button and as simulation name put: "HTMLINJECTIONHERE and save it Now go on Open Simulation button and you will see html being executed : Your...
Internet Bug Bounty: Rails ActionView sanitize helper bypass leading to XSS using SVG tag.
Loofah versions between 2.1.0 and 2.19.1 were vulnerable to a cross-site scripting XSS attack via the image/svg+xml media type in data URIs. This allowed an attacker to bypass HTML sanitization and execute malicious code. The vulnerability was mitigated by upgrading to Loofah version 2.19.1 or...
Affirm: Subdomain takeover of www█████████.affirm.com
Summary Hi there, assuming you want this report as your policy mentions Affirm resources with third-parties, but the scope was a little unclear. Regardless, www█████.affirm.com points to an AWS S3 bucket affirm-prod-www-cms█████████ that no longer exists. I was able to take control of this bucket...
Sifchain: Information disclosure on Sifchain
Summary: Hello Team, I have found user/admin usernames disclosed. Using REST API, we can see all the WordPress users/authors with some of their information. such as id, name, login name, etc. and employees of Sifchain without authentication on https://sifchain.finance/ Steps To Reproduce: You can...
Ruby: Path traversal in Tempfile on windows OS due to unsanitized backslashes
Hi team, Summary We've noticed that both arguments basename and ext of Tempfile on Windows are vulnerable to a path traversal which could allow unintentional file creating in arbitrary writable directories. Tempfile often has a user control either by basename or ext or both. PoC irbmain:029:0...
Nextcloud: No rate limiting for confirmation email lead to huge Mass mailings
Issue Description No rate limit means their is no mechanism to protect against the requests you made in a short frame of time. If the repetition doesn't give any error after 50, 100, 1000 repetitions then their will be no rate limit set. vulnerable has registred in 297359 774050 922470 URL Effect...
GitLab: Adding everyone to the repo due to the lack of rate limit
Summary Since there is no rate limit in the inviting users to the repository section, it is possible to add all users on gitlab to a repository. Steps to reproduce Step-by-step guide to reproduce the issue, including: 1. Create a repository 2. go to the project members section 3. choose a random...
Mail.ru: This Github Repository Seems Leaking "nino.samokat.ru" Source Code
nino.samokat.ru promo site source code was leaked on github.com...
Nextcloud: Stored XSS in collabora via user name
Affected: collabora and nextcloud Ubuntu 18.04.5 LTS Nextcloud 19.0.1 snap version collabora CODE The name of the user is displayed when him joins to edit the document allowing the attacker trigger xss. Impact Set the name of the attacker account to Create a new document → share the document with...
Automattic: [tumblr.com] 69< Firefox Only XSS Reflected
Description : Hello, i have found a XSS Reflected in https://www.tumblr.com/abuse/start?prefill= But the XSS only works in versions of firefox that are below 70. Because its been blocked by CSP, but the version below 69 of firefox is vulnerable. Here's a great article about this subject...
U.S. Dept Of Defense: Subdomain takeover of ████
Summary: I was able to claim the subdomain: ████ using Microsoft Azure CDN profiles Description: Impact Platforms Affected: Subdomain Azure CDN Step-by-step Reproduction Instructions 1. Using dig, I was able to determine that the subdomain '███████' was vulnerable to takeover. The record showed...
U.S. Dept Of Defense: Full Account Take-Over of ████████ Members via IDOR
Summary https://███████ is a Social Network Site belonging to US DoD. Membership is open to anyone, I have found a method to fully take-over any members' account by exploiting an IDOR bug in the ██████████ end-point. By changing the following values in the POST request to the affected end-point:...
Node.js third-party modules: Server Side Request Forgery in Uppy npm module
Hi Team, While we were testing our security engine at Shieldfy https://shieldfy.io, We found a server side request forgery SSRF vulnerability in Uppy npm package. It allows hacker to easily extract inside information from the server or take control of internal services. Module module name: Uppy...
Semrush: Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/image
@zcashi found vulnerability in My Reports Tool. You can read the full write-up here: How I earned 500$ by uploading a file: write-up of one of my first bug bounty...
HackerOne: Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent
An Insecure Direct Object Reference IDOR vulnerability allow the reporter, external users, and collaborators to mark sent swag that was awarded to the reporter as unsent. This may result in swag being sent multiple times. Proof of concept Follow the steps below to reproduce the vulnerability. sig...
Node.js third-party modules: [jsreport] Remote Code Execution
I would like to report Remote Code Execution in jsreport It allows running js files remotely on a vulnerable server. Module module name: jsreport version: 2.5.0 npm page: https://www.npmjs.com/package/jsreport Module Description jsreport is a reporting server which lets developers define reports...
h1-5411-CTF: h1-5411-CTF report: LFI / Deserialization / XXE vulnerability,
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: h1-5411-ctf write-up The CTF...
WakaTime: Impersonation of Wakatime user using Invitation functionality.
Hi wakatime team, I have found a vulnerability in your leaderboard invitation functionality which can be used to trick the victims on the name of wakatime. Anyone can sign up with any email id and use the leadersboard invitation to invite anyone. This loophole can be leveraged for impersonation o...
Uber: SQL Injection on sctrack.email.uber.com.cn
Hi, Uber Security team I just traveled to China, when I call Uber in China. I received an advertisement mail from Uber and I found the unsubscribe link is different from the original unsubscribe link, and there is a SQL Injection under the unsubscribe link. You can see where to find the unsubscri...
X (Formerly Twitter): DOM based cookie bomb
Hi, I would like to report an issue that allows attackers to plant a "cookie bomb" on a victim's browser, so that the victim will be unable to access any Twitter services. PoC 1. Go to http://innerht.ml/pocs/twitter-dom-based-cookie-bomb/ 2. Click on the "DoS" link 3. Wait for a moment 4. Now...
Internet Bug Bounty: moderate: mod_deflate denial of service
A resource consumption flaw was found in moddeflate. If request body decompression was configured using the "DEFLATE" input filter, a remote attacker could cause the server to consume significant memory and/or CPU resources. The use of request body decompression is not a common configuration...
Internet Bug Bounty: JWT audience claim is not verified
An improper authorization vulnerability existed in all versions of Argo CD starting with v1.8.2, allowing the API to accept certain invalid tokens due to the lack of validation of the audience claim in signed tokens. This could allow an attacker to use a stolen token intended for a different...
curl: CVE-2023-23916: HTTP multi-header compression denial of service
An HTTP multi-header compression denial of service vulnerability was discovered that allowed an attacker to send an HTTP response with many occurrences of Transfer-Encoding and/or Content-Encoding headers, consuming all available memory and causing a denial of service. The vulnerability was patch...
Acronis: mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040
Hello Acronis team, Please run curl -ksL -m5 -o /dev/null -I -w "%httpcode" "https://mail.acronis.com/autodiscover/autodiscover.json?Email=autodiscover/[email protected]&Protocol=ActiveSync" curl -ksL -m5...
Courier: Rate limit function bypass can leads to occur huge critical problem into website.
Hello team, I have found a technique that can easily bypass rate limit system of website and with this bug we attacker can easily attack into login panel, Sent unlimited number of huge notification to victim, bypass OTP codes and takeover accounts etc. Basically i have added a header...
PortSwigger Web Security: HTML Injection in Swing can disclose netNTLM hash or cause DoS
The vulnerability is like a SSRF but on the client side, where an attacker can force an unsolicited hidden request made by Burp Suite when the victim performs some actions. During normal browsing to a website through Burp Suite Pro or Community, if the website makes a request with HTML code in a...
Node.js: DNS Max Responses for DOS
See Github my issue: https://github.com/nodejs/node/issues/36063 When i try to fetch the A Dns records of following domain: ticbrasil.com.br I dont get any response. I think thats the case because there are over 1300 responses. Version: v12.18.4, v14.15.0 Platform: 64-bit Windows 10 Pro &...
Yelp: X-Forward-For Header allows to bypass access restrictions
Summary: If the "X-Forward-For: 127.0.0.1" header is used, it allows to bypass restrictions of the web application and access endpoints that are restricted otherwise. This allows for example to access the "Business Owner App backend API". The responding server thinks, he is accessed by an interna...
Mail.ru: Reflected XSS on https://e.mail.ru/compose/ via Body parameter
Reflected XSS in e.mail.ru via GET parameter for mailto handler...
Mail.ru: Broken twitter link hijacking at https://games.mail.ru/pc/search/
Link on https://games.mail.ru/pc/search/ page was pointing to invalid twitter account...
GitHub Security Lab: [Java] CWE-295 - Incorrect Hostname Verification - MitM
This bug was reported directly to GitHub Security Lab...
Engel & Völkers Technology GmbH: [service.engelvoelkers.com] XSS in /video/id
Summary: The YouTube video page at https://service.engelvoelkers.com/video/id/ is vulnerable to reflected XSS attacks. Description: A dynamic part of the URL is printed to the page without proper encoding, causing a reflected XSS vulnerability. Steps to reproduce Visit the following link:...
HackerOne: Reflected XSS on www.hackerone.com and resources.hackerone.com
Good day : I hope your doing as well as can be during these difficult times. I have found xss at 2 endpoints: https://www.hackerone.com/resources/ and https://resources.hackerone.com The payloads that work are here:...
Stripo Inc: Blind SSRF while Creating Templates
Blind SSRF While Creating Email Templates...
Revive Adserver: Authentication Bypass by abusing Insecure crypto tokens in /lib/OA/Dal/PasswordRecovery.php:
Hi, This is a fun bug I came across while doing a pentest for a client, after going through Revive Advserver's code for a few hours, I found this authentication bypass. This vulnerability seem to affect all versions, including the latest one, I was sent by one of your developers to report it here...
Shopify: Stored - XSS
Hello Security Team, I have Found Stored XSS Vulnerability POC : Step1: Go to https://app.oberlo.com/suppliers Step2: Click on any product you will be redirected to URL as i have given for example...
Tor: Email Spoofing Possible on torproject.org Email Domain
Summary: Due to a missing SPF and DMARC record it is possible to spoof emails from torproject.org. This could potentially be used to trick employees or users via phishing emails. Description: Mail servers rely on both SPF and DMARC to properly deal with email spoofing. SPF shows what servers are...
Node.js third-party modules: Code Injection Vulnerability in zombie Package
I would like to report a code injection vulnerability in zombie. It allows crawled websites to access privileged APIs such as the file system or child process. Module module name: zombie version: 6.1.2 npm page: https://www.npmjs.com/package/zombie Module Description Insanely fast, headless...
Ruby on Rails: http_basic_authenticate_with is suseptible to timing attacks.
Timing attack vulnerability in basic authentication in Action Controller. There is a timing attack vulnerability in the basic authentication support in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2015-7576. Versions Affected: All. Not affected: None. Fixed...
curl: Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.
Vulnerability description not provided...
U.S. Dept Of Defense: HAProxy stats panel exposed externally
An exposed web panel for HAProxy running on a system allowed external access to the statistics page at port 1024, potentially exposing sensitive information...
Internet Bug Bounty: DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
A vulnerability in Node.js allowed an attacker-controlled DNS server to bypass DNS rebinding protection by resolving hosts in the .local domain. This allowed an attacker to gain access to the Node.js debugger, potentially resulting in remote code execution. The vulnerability affected all versions...
Internet Bug Bounty: CVE-2022-32208: FTP-KRB bad message verification
When curl does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. Impact Loss of integrity of FTP-KRB transfers...
Internet Bug Bounty: CVE-2022-32206: HTTP compression denial of service
curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited...
GitHub Security Lab: Java: Unsafe deserialization with Jackson
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Python] CWE-090: LDAP Injection
This bug was reported directly to GitHub Security Lab...