VK.com: Reflected XSS в /video

XSS в поиске по видеозаписям. xss в параметрах date, len, order при поиске видеозаписи с указанием параметров...

U.S. Dept Of Defense: [SQLI ]Time Bassed Injection at ██████████ via referer header

Hi the ████ was vulnerable to time bassed injection via referer header steps 1- copy the request to your burp suite : GET /DNCdb.php?alert= HTTP/1.1 Host: ███████ User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:81.0 Gecko/20100101 Firefox/81.0 Accept:...

Shipt: bypass the [OKTA] login redirect can lead to disclosing limited-information about the sub-domain at [ shiptsec.com ]

A security researcher identified limited and non-sensitive information disclosure for one of our public-facing tools that is used by internal users. While the risk was very low and nothing was directly exploitable, we went ahead and made the quick change to mitigate this behavior. We made the...

h1-ctf: [H1-2006 2020] CTF Writeup

Summary: Multiple Vulnerabilities leading to full account takeover and access to restricted functions 1. Information Disclosure 2. Login 2FA Bypass 3. SSRF 4. Hardcoded validation 5. Sensitive information disclosure 6. Privilege Escalation 7. Payments 2FA Bypass through SSRF Steps To Reproduce: 0...

h1-ctf: [H1-2006 2020] CTF Writeup

Just submitting Flag for now, Will soon submit Writeup : Impact Flag: ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$...

Mail.ru: XSS at go.mail.ru

DOM-based self XSS in go.mail.ru social search functionality...

Nord Security: Unauthorized User Can Delete Any User Account

DESCRIPTION: Your help desk allows creating tickets by email. Which means the user can send an email to the NordVPN support email to a add a new ticket to his activities. So when you send an email to [email protected] from your email address, this ticket will be created on the account that you...

PayPal: Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password

A bug was identified whereby sensitive, unique tokens were being leaked in a JS file used by the recaptcha implementation. In certain cases, a user must solve a CAPTCHA challenge after authenticating. When the security challenge is completed, the authentication request is replayed to log in. The...

Bumble: Reflected XSS

The researcher has found an XSS when sending messages through our service...

Semmle: Worker container escape lead to arbitrary file reading in host machine [again]

Summary: After a successful build, LGTM allow user to view the file list. By default, only source code files and build config files are reserved lgtm.yml and .lgtm.yml. If there are both files in folder, LGTM will process lgtm.yml file and skip .lgtm.yml, but it still keeps both of files in...

ReddAPI: Browser cross-site scripting filter misconfiguration

Issue detail :- No X-XSS-Protection header was set in the response. This means that the browser uses default behaviour that detection of a cross-site scripting attack never prevents rendering. Remediation detail The following header should be set: X-XSS-Protection: 1; mode=block Issue background ...

Internet Bug Bounty: CVE-2022-23520: Incomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations)

The following is from: https://hackerone.com/reports/1654310 While building a PoC for CVE-2022-32209, I noticed that I could not fix my vulnerable application by updating https://github.com/rails/rails-html-sanitizer from 1.4.2 to 1.4.3 even though the Hackerone report about this vulnerability...

curl: CVE-2022-43551: Another HSTS bypass via IDN

Summary: I found an issue similar to CVE-2022-42916 again. Since the phenomenon is the same, I will describe the same as last time. HSTS checks are bypassed if any character in the IDN convertNameprep to a '.' for example"。"UTF-8:E38082. I think there are other characters that become ".UTF-8:2E" ...

Internet Bug Bounty: DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)

A vulnerability in Node.js allowed an attacker-controlled DNS server to bypass DNS rebinding protection by resolving hosts in the .local domain. This allowed an attacker to gain access to the Node.js debugger, potentially resulting in remote code execution. The vulnerability affected all versions...

8x8: DNS Misconfiguration (Subdomain Takeover) - █████████.8x8.com

@melbadry9 reported to us an issue with an A record which pointed to subdomains outside of 8x8's control. This was caused due to a misconfiguration in a script, together with changes in AWS' DNS resolution behaviour. The issue has been rectified...

PortSwigger Web Security: HTML Injection in Swing can disclose netNTLM hash or cause DoS

The vulnerability is like a SSRF but on the client side, where an attacker can force an unsolicited hidden request made by Burp Suite when the victim performs some actions. During normal browsing to a website through Burp Suite Pro or Community, if the website makes a request with HTML code in a...

Stripo Inc: Public and secret api key leaked in JavaScript source

Summary: Summary the vulnerabilities I am surfing on the stripo website. I found a sensitive data including authentication key written in public accessible javascript file. URL Vulnerability https://staging.empleio.stripo.email/main.c1965c58f39a0f4aadc3.js Steps To Reproduce: Open...

Mail.ru: [my.games] Stored XSS via untrusted bucket

Domain, site, application -- https://my.games/ Details -- If you check page source of https://my.games, you can notice that site gets static files scripts, styles, images using following URL declaration: https://my.games/hotbox/mygames/frontend/v3-6-13/img/share/main.png mygames here is a name of...

PlayStation: Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' Application

Summary The PlayStation Now application version 11.0.2 is vulnerable to remote code execution RCE. Any website loaded in any browser on the same machine can run arbitrary code on the machine through a vulnerable websocket connection. 1. The local websocket server at localhost:1235 does not check...

Mail.ru: Stored xss on https://go.mail.ru/

Reflected XSS via GET parameter in go.mail.ru...

GitHub Security Lab: CodeQL query for finding ReDoS and Regex Injection vulnerabilities in Java

This bug was reported directly to GitHub Security Lab...

Snapchat: Stealing SSO Login Tokens (snappublisher.snapchat.com)

Description Attacker can steal SSO login tokens for snappublisher.snapchat.com by chaining different flaws in SSO and Snapchat’s Snappublisher tool. Detailed attack flow is as follows. Attack Flow 1.. Snapchat fetches a SSO LOGIN TOKEN from accounts.snapchat.com to login into different products o...

GitLab: Gitlab.com is vulnerable to reverse tabnabbing.

Dear GitLab bug bounty team, Summary --- Gitlab.com is vulnerable to reverse tabnabbing, since you use target="blank" on links in the Environments section. F166659 Why does this vulnerability exist? --- The following link is vulnerable to reverse tabnabbing, because it uses target="blank": This...

StopTheHacker: Wordpress flashmediaelement.swf XSS on stopthehacker.com

Hi, It appears that the domain stopthehacker.com has an XSS vulnerability, specifically in flashmediaelement.swf. PoC: https://www.stopthehacker.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertPoC%20PoC%20PoC Please see the attached screen shot for the alert box...

OkCupid: https://www.okcupid.com/hidden-users CSRF vulnerability.

Hi, The html code below : Will make it possible to hide an user.. You can patch this by supplying a CSRF token : Best regards, Olivier Beg...

Internet Bug Bounty: PHP openssl_x509_parse() Memory Corruption Vulnerability

Overview: Quote from http://www.php.net "PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML." The PHP function opensslx509parse uses a helper function called asn1timetotimet to convert timestamps from ASN1 string...

Lichess: Improper Authentication Throttling Allows Attacker-Controlled Account Lockouts

The application lacks sufficient safeguards in its authentication throttling logic. It permits arbitrary users to trigger lockouts on any account by submitting multiple failed login attempts using a known or guessed username. Because the system does not verify the request origin or impose...

curl: CVE-2024-2398: HTTP/2 push headers memory-leak

CVE-2024-2398 was a memory-leak vulnerability in the HTTP/2 push headers implementation of libcurl. For each incoming PUSHPROMISE header, a new string was allocated and stored in an array. When the number of headers exceeded a threshold, libcurl freed the array but forgot to free the individual...

inDrive: SSRF in https://couriers.indrive.com/api/file-storage

A server side request forgery vulnerability was present in the url parameter of the https://couriers.indrive.com/api/file-storage endpoint, allowing arbitrary external websites to be requested and their content returned in responses...

EXNESS: Unrestricted Access to Celery Flower Instance

The publicly accessible Celery Flower instance allowed unrestricted access, exposing sensitive information, and the ability to manipulate tasks...

curl: CVE-2022-35260: .netrc parser out-of-bounds access

Summary: Curl expects the .netrc file to have space characters. So if there is no space character, it will do an out-of-bounds read and a 1-byte out-of-bounds write. This can happen multiple times depending on the state of the memory. Steps To Reproduce: curl --netrc-file .netrc test.local ".netr...

Internet Bug Bounty: Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag

It seems to be a problem caused by a difference between the nokogiri java implementation and the ruby implementation. jruby9.3.3.0 nokogiri java, use Rails::Html::SafeListSanitizer.new.sanitize, allow select/style tag code tags = %wselect style puts...

U.S. Dept Of Defense: Stored XSS at https://www.█████████.mil

Summary: Stored XSS exists at https://www.██████.mil. A user can fill out the form and upload a file containing javascript code to trigger XSS. Description: Stored XSS exists at https://www.████.mil. A user can fill out the form and upload a file containing javascript code to trigger XSS. Impact ...

h1-ctf: First CTF ever!

Pretext Started looking into hacking this autumn and then found out HackerOne was doing a Christmas themed CTF. Further investigation showed that the deplorable Grinch might be up to no good again - Christmas is in danger! TLDR Lots of hacking took place, the Grinch was stopped, Christmas saved a...

WHO COVID-19 Mobile App: Internal API endpoint is accesible for everyone

Summary: It looks like the endpoint /internal/cron/refreshCaseStats as configured in cron.yaml https://github.com/WorldHealthOrganization/app/blob/master/server/appengine/src/main/webapp/WEB-INF/cron.yamlL3 is accesible for everyone. Since it is configured as a cronjob to run every 5 minutes and...

InnoGames: Impersonation and ticket id enumeration on support.innogames.com

A missing check for authorization made it possible to answer tickets owned by other users in their own name...

HackerOne: Reflected XSS on www.hackerone.com and resources.hackerone.com

Good day : I hope your doing as well as can be during these difficult times. I have found xss at 2 endpoints: https://www.hackerone.com/resources/ and https://resources.hackerone.com The payloads that work are here:...

X (Formerly Twitter): character limitation bypass can lead to DoS on Twitter App and 500 Internal Server Error

Summary: If you are creating a new moment on https://twitter.com/username/moments you get redirected to https://twitter.com/i/moments/edit/moments-id. There you can set a title, a description and also you can add, if you want, a Tweet to your Moment. The title and also the description are...

Starbucks: Blind SQL Injection on starbucks.com.gt and WAF Bypass :*

Starting with a blind SQL Injection on http://www.starbucks.com.gt/menu/beverage/detail, @d3417 was able to dump schema on several database tables. Initially closed as N/A because of our exclusion on automated tools, reopened to investigate the data reported in the tables, and because the casual...

Kaspersky: Hard Coded username and password in registry

I was using a tool called RegShot to take a snap shot of the registry before and after installation in order to see what changes were being made in the registry and I discovered hard-coded credentials I have attached the full comparison details of the registry changes but these are the lines and...

Uber: Reflected XSS on developer.uber.com via Angular template injection

developer.uber.com is vulnerable to reflected XSS via Angular template injection. The following url demonstrates the root issue using a trivial payload: https://developer.uber.com/docs/deep-linking?q=wrtz77 If you view the rendered source of the resulting page, you'll find the string 'wrtz49',...

Shopify: HTTP-Response-Splitting on v.shopify.com

I discovered a HTTP-Response-Splitting issue on v.shopify.com Steps to reproduce: Call the following URL in any browser and catch the response e.g. with burp...

Monero: A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue.

The pending block queue in the Monero cryptocurrency protocol could be remotely filled to an extremely high size, up to approximately 54 GB, with blocks that would never leave the queue. This was possible due to lax rules in the synchronization code that allowed the queue size limit to be bypasse...

Internet Bug Bounty: important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)

The Apache HTTP Server was found to have a vulnerability in modrewrite where improper escaping of output allowed attackers to map URLs to filesystem locations that were permitted to be served by the server but were not intentionally/directly reachable by any URL. This resulted in potential code...

U.S. Dept Of Defense: Out-Of-Bounds Memory Read on ███

Vulnerability description not provided...

curl: CVE-2022-32206: HTTP compression denial of service

Summary: Curl does not prevent resource consumption when processing certain header types, but keeps on allocating more and more resources until the application terminates or the system crashes, see below. The attack vectors include at least: - Sending many Transfer-Encodingwith repeated encodings...

Mail.ru: Sensitive information exposure via git commit

Token for a test ICQ bot account was leaked via git commit data for opensource Jira plugin...

Rocket.Chat: XSS leads to RCE on the RocketChat desktop client.

Summary: It is possible to call electron.shell.openExternal from javascript inside a server webview. Description: The document onclick handler allows executing electron.shell.openExternal by crafting an attacker-controlled link and dispatching a click event on it after overwriting Regex.test...

Ruby on Rails: Untrusted users able to run pending migrations in production

Untrusted users able to run pending migrations in production There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production. This vulnerability has been assigned the CVE identifier CVE-2020-XXXX...

Internet Bug Bounty: URN Request bypass ACL Checks

Summary: Attacker can bypass ACL checks gaining access to restricted HTTP servers such as those running on localhost. Attacker could also gain access to CacheManager if VIA header is turned off. Only lines with : will be readable though, and the response must be less than 4096 bytes or it'll...