15525 matches found
Starbucks: Reflected XSS in openapi.starbucks.com /searchasyoutype/v1/search?x-api-key=
Hi Starbucks team, While testing i founded Reflected XSS in openapi.starbucks.com that can also lead to Open redirect Vulnerable link ========== https://openapi.starbucks.com/searchasyoutype/v1/search?x-api-key=██████&query=coffe&partnerid=████:vwt2u5wngbk&siteBaseUrl= Vulnerable parameter...
Shopify: HTTP-Response-Splitting on v.shopify.com
I discovered a HTTP-Response-Splitting issue on v.shopify.com Steps to reproduce: Call the following URL in any browser and catch the response e.g. with burp...
Deriv.com: login to any user's cashier account and full account information disclosure
Hi , I have found an issue allowing an attacker to login to any user's cashier account and view sensitive user information by just knowing the user account ID. Steps to reproduce: 1. open 2 browsers and create 2 accounts , login with each account on a browser. 2. let's call account 1 , the victim...
Internet Bug Bounty: out of bounds read crashes php-cgi
I found and disclosed CVE-2014-9427 to the PHP dev team on 17 December 2014 https://bugs.php.net/bug.php?id=68618 and a patch was committed on 30 December 2014 http://git.php.net/?p=php-src.git;a=commit;h=f9ad3086693fce680fbe246e4a45aa92edd2ac35 and the flaw is now fixed. Details of the flaw:...
Internet Bug Bounty: CVE-2023-27535: FTP too eager connection reuse
A vulnerability was found in libcurl versions 7.13.0 to 7.88.1 that allowed the reuse of previously created FTP connections even when one or more options had been changed, leading to the second transfer being done with wrong credentials. This was due to several FTP settings being left out from th...
curl: CVE-2022-43551: Another HSTS bypass via IDN
Summary: I found an issue similar to CVE-2022-42916 again. Since the phenomenon is the same, I will describe the same as last time. HSTS checks are bypassed if any character in the IDN convertNameprep to a '.' for example"。"UTF-8:E38082. I think there are other characters that become ".UTF-8:2E" ...
curl: CVE-2022-27781: CERTINFO never-ending busy-loop
Summary: Curl is prone to a DoS attack in case the NSS TLS library is used and the CERTINFO option is enabled. Using maliciously crafted certificates on a server, an attacker can make curl run into an endless loop when connecting to the server. The bug is located in the following code segment...
Sifchain: A password in plain text in conf file
I found a password in plain text in \sifnode-develop\ui\e2e\config.js in the source code. password: "coolguy21" Impact I don't know actually how does this affects but passwords in plaintexts are always dangerous...
h1-ctf: H1 Hackyholidays CTF - The Grinch was defeated
The following writeup will underline all the steps and tools used to solve the 12 challenges of the H1 Holidays CTF. The theme of the competition was the Grinch. How it is possible to read from the competition blog post https://www.hackerone.com/blog/12-days-hacky-holidays-ctf , the goal was to...
VK.com: Reflected XSS в /video
XSS в поиске по видеозаписям. xss в параметрах date, len, order при поиске видеозаписи с указанием параметров...
Stripo Inc: Public and secret api key leaked in JavaScript source
Summary: Summary the vulnerabilities I am surfing on the stripo website. I found a sensitive data including authentication key written in public accessible javascript file. URL Vulnerability https://staging.empleio.stripo.email/main.c1965c58f39a0f4aadc3.js Steps To Reproduce: Open...
CS Money: Internal Path Disclosure
Hello Team, I would like to report internal path disclosure in response. I was trying for Stored XSS but got no luck in that process. I observed the responses, one of the responses showing file path with 500 Internal Server Error. Steps To Reproduce: 1. Go to cs.money and sign in through steam...
Rocket.Chat: XSS leads to RCE on the RocketChat desktop client.
Summary: It is possible to call electron.shell.openExternal from javascript inside a server webview. Description: The document onclick handler allows executing electron.shell.openExternal by crafting an attacker-controlled link and dispatching a click event on it after overwriting Regex.test...
Palo Alto Software: IDOR on update user preferences
Summary: Team member with role USER can change data of any user in the team, or steal his cookies, or steal the account of victim via forget password function. Steps To Reproduce: 1. Login in as user1 the user with role admin and invite user2 set his role to user. 2. Login in as user2, open Mail...
Shopify: Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission
Technical Background ===================== Shopify Apps need an access token to work with the data of a store. Is very important to keep this token in a secure place. Quoting the Shopify Blog: ... this is like a password into this shop, so you’ll want to store this token in a very safe place...
Semmle: Worker container escape lead to arbitrary file reading in host machine [again]
Summary: After a successful build, LGTM allow user to view the file list. By default, only source code files and build config files are reserved lgtm.yml and .lgtm.yml. If there are both files in folder, LGTM will process lgtm.yml file and skip .lgtm.yml, but it still keeps both of files in...
Revive Adserver: Authentication Bypass by abusing Insecure crypto tokens in /lib/OA/Dal/PasswordRecovery.php:
Hi, This is a fun bug I came across while doing a pentest for a client, after going through Revive Advserver's code for a few hours, I found this authentication bypass. This vulnerability seem to affect all versions, including the latest one, I was sent by one of your developers to report it here...
StopTheHacker: Wordpress flashmediaelement.swf XSS on stopthehacker.com
Hi, It appears that the domain stopthehacker.com has an XSS vulnerability, specifically in flashmediaelement.swf. PoC: https://www.stopthehacker.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertPoC%20PoC%20PoC Please see the attached screen shot for the alert box...
Internet Bug Bounty: moderate: mod_deflate denial of service
A resource consumption flaw was found in moddeflate. If request body decompression was configured using the "DEFLATE" input filter, a remote attacker could cause the server to consume significant memory and/or CPU resources. The use of request body decompression is not a common configuration...
Internet Bug Bounty: PHP openssl_x509_parse() Memory Corruption Vulnerability
Overview: Quote from http://www.php.net "PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML." The PHP function opensslx509parse uses a helper function called asn1timetotimet to convert timestamps from ASN1 string...
curl: CVE-2024-2398: HTTP/2 push headers memory-leak
CVE-2024-2398 was a memory-leak vulnerability in the HTTP/2 push headers implementation of libcurl. For each incoming PUSHPROMISE header, a new string was allocated and stored in an array. When the number of headers exceeded a threshold, libcurl freed the array but forgot to free the individual...
HackerOne: LLM01: Invisible Prompt Injection
The report described a vulnerability in Hai's system involving invisible prompt injection via Unicode tag characters. The vulnerability allowed the submission of a test report with a fake report containing hidden characters, which could be used to inject prompts into the system's responses. The...
EXNESS: Unrestricted Access to Celery Flower Instance
The publicly accessible Celery Flower instance allowed unrestricted access, exposing sensitive information, and the ability to manipulate tasks...
Internet Bug Bounty: JWT audience claim is not verified
An improper authorization vulnerability existed in all versions of Argo CD starting with v1.8.2, allowing the API to accept certain invalid tokens due to the lack of validation of the audience claim in signed tokens. This could allow an attacker to use a stolen token intended for a different...
Internet Bug Bounty: CVE-2022-21831: Possible code injection vulnerability in Rails / Active Storage
Original report: https://hackerone.com/reports/1154034 Rails advisory: https://discuss.rubyonrails.org/t/cve-2022-21831-possible-code-injection-vulnerability-in-rails-active-storage/80199 Blogpost:...
Acronis: No Rate Limit On Forgot Password Page
Summary A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame, HTTP-Servers can respond with status code 429: To...
Shipt: bypass the [OKTA] login redirect can lead to disclosing limited-information about the sub-domain at [ shiptsec.com ]
A security researcher identified limited and non-sensitive information disclosure for one of our public-facing tools that is used by internal users. While the risk was very low and nothing was directly exploitable, we went ahead and made the quick change to mitigate this behavior. We made the...
InnoGames: Impersonation and ticket id enumeration on support.innogames.com
A missing check for authorization made it possible to answer tickets owned by other users in their own name...
Mail.ru: [my.games] Stored XSS via untrusted bucket
Domain, site, application -- https://my.games/ Details -- If you check page source of https://my.games, you can notice that site gets static files scripts, styles, images using following URL declaration: https://my.games/hotbox/mygames/frontend/v3-6-13/img/share/main.png mygames here is a name of...
Mail.ru: Stored xss on https://go.mail.ru/
Reflected XSS via GET parameter in go.mail.ru...
8x8: (Critical) Remote Code Execution Through Old TinyMCE upload bypass
A third party marketing site utilized an outdated version of TinyMCE that was vulnerable to CVE-2011-4906...
Bumble: Reflected XSS
The researcher has found an XSS when sending messages through our service...
curl: Race condition with CURL_LOCK_DATA_CONNECT can cause connections to be used at the same time
Summary: We've seen race conditions when using CURLLOCKDATACONNECT in libcurl where sometimes two different threads using two different easy handles ends up sharing the same connection pointer at the same time. This causes UAFs and double frees when both threads are freeing items on the same...
Node.js third-party modules: [tree-kill] RCE via insecure command concatenation (only Windows)
I would like to report a RCE issue in the tree-kill module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: tree-kill version: 1.2.1 npm page: https://www.npmjs.com/package/tree-kill Module Description Kill all processes in the process tree, including t...
GitLab: Gitlab.com is vulnerable to reverse tabnabbing.
Dear GitLab bug bounty team, Summary --- Gitlab.com is vulnerable to reverse tabnabbing, since you use target="blank" on links in the Environments section. F166659 Why does this vulnerability exist? --- The following link is vulnerable to reverse tabnabbing, because it uses target="blank": This...
drchrono: Stored XSS via AngularJS Injection
Hi All, I've found a stored XSS vulnerability via an Angular Template Injection in the messages referral address field. Description After visiting https://1337test.drchrono.com/messages/referrals/contacts/, you can enter new contact information. In the field for the address, if enter 55, when the...
ReddAPI: Browser cross-site scripting filter misconfiguration
Issue detail :- No X-XSS-Protection header was set in the response. This means that the browser uses default behaviour that detection of a cross-site scripting attack never prevents rendering. Remediation detail The following header should be set: X-XSS-Protection: 1; mode=block Issue background ...
OkCupid: https://www.okcupid.com/hidden-users CSRF vulnerability.
Hi, The html code below : Will make it possible to hide an user.. You can patch this by supplying a CSRF token : Best regards, Olivier Beg...
Rocket.Chat: Unauthenticated file deletion via deleteFileMessage DDP method allows permanent destruction of any uploaded file
Vulnerability description not provided...
Monero: A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue.
The pending block queue in the Monero cryptocurrency protocol could be remotely filled to an extremely high size, up to approximately 54 GB, with blocks that would never leave the queue. This was possible due to lax rules in the synchronization code that allowed the queue size limit to be bypasse...
Internet Bug Bounty: important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
The Apache HTTP Server was found to have a vulnerability in modrewrite where improper escaping of output allowed attackers to map URLs to filesystem locations that were permitted to be served by the server but were not intentionally/directly reachable by any URL. This resulted in potential code...
U.S. Dept Of Defense: Out-Of-Bounds Memory Read on ███
Vulnerability description not provided...
Teleport: SSRF in region parameter that leads to AWS Teleport role AWS account takeover
You have an Integration page in Teleport where one of the options is AWS OIDC which will allow people in Teleport to add resources fluently without actually having initial access to these resources or installing any agents on them. You will need to have connected and ready OIDC integration with A...
U.S. Dept Of Defense: Default Credentials on Kinetic Core System Console - https://█████/kinetic/app/
Weak default credentials of "admin/admin" were discovered on the Kinetic Core System Console application, potentially allowing attackers to identify underlying technologies and access sensitive information such as server logs and user data. The vulnerability was present in version 2.1.0-SNAPSHOT...
Shopify: Shop App - Attacker is able to intercept authorization code during authentication (OAuth) and is able to get access to Microsoft Outlook email account
A vulnerability was discovered in the Shop App's Microsoft Outlook OAuth flow, where a malicious app could intercept the authorization code during authentication due to the use of deep links. This could allow an attacker to gain access to the victim's emails. The issue was mitigated by implementi...
Internet Bug Bounty: Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag
It seems to be a problem caused by a difference between the nokogiri java implementation and the ruby implementation. jruby9.3.3.0 nokogiri java, use Rails::Html::SafeListSanitizer.new.sanitize, allow select/style tag code tags = %wselect style puts...
Ruby: Path traversal in Tempfile on windows OS due to unsanitized backslashes
Hi team, Summary We've noticed that both arguments basename and ext of Tempfile on Windows are vulnerable to a path traversal which could allow unintentional file creating in arbitrary writable directories. Tempfile often has a user control either by basename or ext or both. PoC irbmain:029:0...
WHO COVID-19 Mobile App: Internal API endpoint is accesible for everyone
Summary: It looks like the endpoint /internal/cron/refreshCaseStats as configured in cron.yaml https://github.com/WorldHealthOrganization/app/blob/master/server/appengine/src/main/webapp/WEB-INF/cron.yamlL3 is accesible for everyone. Since it is configured as a cronjob to run every 5 minutes and...
Equifax-vdp: Open SonarQube instance leaking internal source code
Summary I came across an open SonarQube instance which can be found here: http://34.238.92.229:9000/ In this, there are 10 projects with a total of around 100k lines of code To identify the owner, I went to the Issues tab and expanded the list of authors. There were 29 people there, and many of...