15581 matches found
Internet Bug Bounty: Incorrect logic in MySQL & MariaDB protocol leads to remote SSRF/Remote file read
Overview Wrong logic in realization of LOAD DATA LOCAL INFILE function leads to remote attacker can read files from server. Problem exists in many MySQL-drivers and frameworks, on many programming languages, like Python, Java, PHP etc. For exploitation this vulnerability we need to connect to our...
Nextcloud: IDOR - Disable sharing
Decription: ----- Users are shared files or folder. can disable this sharing. Detail: ------ + use request: DELETE /nextcloud/ocs/v2.php/apps/filessharing/api/v1/shares/share-id?format=json HTTP/1.1 Host: your-host User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64; rv:47.0 Gecko/20100101 Firefox/47....
Phabricator: SSRF vulnerability (access to metadata server on EC2 and OpenStack)
In bug 50537, haquaman reported a SSRF vulnerability in the meme creation section of Phabricator. Ticket T6755 was created and the HackerOne issue was closed as "Won't fix". T6755 states that "attackers can use the machine's ability to access the network, which may allow them to find services and...
Mail.ru: scfbp.tng.mail.ru: Heartbleed
MacBook-Pro-Kirill:Pentest isox$ python heartbleed.py scfbp.tng.mail.ru defribulator v1.16 A tool to test and exploit the TLS heartbeat vulnerability aka heartbleed CVE-2014-0160 Connecting to: scfbp.tng.mail.ru:443, 1 times Sending Client Hello for TLSv1.0 Received Server Hello for TLSv1.0...
Cloudflare: Apache mod_negotiation filename bruteforcing
Vulnerability description modnegotiation is an Apache module responsible for selecting the document that best matches the clients capabilities, from one of several available documents. If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error...
Node.js: HTTP Request Smuggling via Empty headers separated by CR
HTTP Request Smuggling HRS was possible in Node.js v20.2.0 due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests. The CR character without LF was sufficient to delimit HTTP header fields in the llhttp parser, which is not compliant with RFC7230...
Internet Bug Bounty: CVE-2022-28738: Double free in Regexp compilation
Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a ādouble freeā vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from...
Nextcloud: HEIC image preview can be used to invoke Imagick
The HEIC image preview provider calls into Imagick at https://github.com/nextcloud/server/blob/5d097ddb4b99673f57b8c085dedd93880ee2539d/lib/private/Preview/HEIC.phpL98-L109. This is bad as Imagick processes all kind of image types. One can use this for example to exfiltrate arbitrary files by...
GitHub Security Lab: Java: JSONP Injection
This bug was reported directly to GitHub Security Lab...
Exodus: Exposed Configuration Files at https://www.exodus.io/keybase.txt
Summary: Username, uid information is present in txt file. Steps To Reproduce: 1. Open This link https://www.exodus.io/keybase.txt 2. Search for username, uid 3. You will get some usernames with uid. Impact This information may help attacker in further attacks...
U.S. Dept Of Defense: Reflected XSS on āāāāāāā page
Summary: The page at https://āāāāā/NtMView.php is vulnerable to reflected cross-site scripting. Description: The page takes a user input in the form of a drop down list, then uses that text in the resulting page āāāāāāā . An attacker can intercept the query to the page and insert an XSS payload, ...
h1-ctf: [H1-2006 2020] Multiple vulnerabilities lead to CEO account takeover and paid bounties
Summary: 1. A publicly accessible logfile discloses a user's credentials 2. Weak 2FA implementation allows user account takeover 3. Path injection in user's cookie allows SSRF, bypassing the IP restriction to list available builds on https://software.bountypay.h1ctf.com/ 4. API token leak in...
GitHub Security Lab: Initial websocket support for Javascript (SockJS)
This bug was reported directly to GitHub Security Lab...
Mail.ru: HTTP-Response-Splitting leads to information disclosure (email, firstname, lastname) at https://tz.mail.ru
CRLF injection via GET paramaters in tz.mail.ru Clientside vulnerabilities in tz.mail.ru is not currently covered by Bug Bounty program...
Pornhub: Stored XSS (client-side, using cookie poisoning) on the pornhubpremium.com
The researcher discovered that a parameter's value was stored in a cookie and that cookie's value was echoed in certain pages. The researcher was successful in providing an XSS payload as this parameter's value and having it execute. DOM XSS through cookie. Discovered by manual inspection of JS...
Gratipay: Information Disclosure on inside.gratipay.com
Hello @gratipay, By checking request headers I've been able to identify that inside.gratipay.com is running on Server: WSGIServer/0.1 Python/2.7.11. Request: https://inside.gratipay.com/assets/inside-gratipay.svg GET /assets/inside-gratipay.svg HTTP/1.1 Host: inside.gratipay.com User-Agent:...
Internet Bug Bounty: putty pscp client-side post-auth stack buffer overwrite when processing remote file size
Not sure if this will qualify but it may impact a pretty broad audience given the fact that putty code is part of many other apps filezilla, ... and it is the defacto standalone ssh client for windows administrators besides openssh cygwin putty = 0.66; affects putty versions dating back 9 years...
Internet Bug Bounty: Use After Free Vulnerability in unserialize() with SplDoublyLinkedList
https://bugs.php.net/bug.php?id=70366...
Sandbox Escape: .NET Type Traversal Vulnerability
This issue was reported directly to Microsoft and has been resolved in MS14-009. https://technet.microsoft.com/library/security/ms14-009ID0E3PCI...
Internet Bug Bounty: CVE-2023-40195: Apache Airflow Spark Provider Deserialization Vulnerability RCE
Apache Airflow Spark Provider before 4.1.3 was affected by a deserialization vulnerability that allowed remote code execution RCE. Attackers could exploit this vulnerability by configuring a malicious Spark server address through the Airflow UI, which would then manipulate the PySpark clients...
Internet Bug Bounty: CVE-2023-28320 - siglongjmp race condition
A race condition vulnerability CVE-2023-28320 existed in libcurl's synchronous resolver, which could allow a multi-threaded application to crash or misbehave due to the use of a global buffer that was not mutex protected. The vulnerability could result in a denial of service...
Internet Bug Bounty: Controllable read beyond bounds in lua_websocket_readbytes() [zhbug_httpd_126]
Greetings. I have found a read-beyond-bounds bug in luawebsocketreadbytes that permits an attacker to exfiltrate a controllable amount of heap data if the victim site runs a suitable LUA program. The bug is due to misuse of apgetbrigade and aprbucketread. The following code from v2.4.53 assumes...
Recorded Future: Storage of old passwords in plain text format
Summary: Server response from app.recordedfuture.com has old passwords for a logged in account in plain text format. Storage of passwords in any readable format or using weak hashes put the account or system at great risk. What's interesting is how RecordedFuture store multiple passwords not just...
Palo Alto Software: DNS Miconfiguration Leads to Subdomain Takeover - max1.liveplan.com
Summary The issue happens due to using EC2 public DNS instead of using Elastic IPs as CNAME record. This report is simliar to report 1069795 Misconfiguration - DNS Records json "host": "max1.liveplan.com", "resolver": "1.0.0.1:53" , "a": "54.68.121.128" , "cname":...
h1-ctf: [h1-2006 2020] Chained vulnerabilities lead to account takeover
Summary MĆ„rten Mickos lost his account for BountyPay, the new service HackerOne is using to pay bug bounties. In this report I explain how I accessed a customer's account using a log file and bypassed its 2FA validation. I then leverage an open redirect bug to gain access to an internal server an...
Topcoder: SSRF at https://cognitive.topcoder.com leads to AWS instance metadata due to vulnerable email subscription feature
Summary: Topcoder makes use of Amazons AWS in their web application environment. I noticed a feature that allows a user to subscribe and receive emails from Topcoder. This feature is vulnerable to server side request forgery since it allows a user to supply an arbitrary URL which the application...
Automattic: Stored XSS in assets.txmblr.com
Description Hi, i would like to report a issue that i think is legitimate. to get this XSS we need to create a Post in the attacker account with a payload, after this, it's necessary that a victim reblog this post and so, enter in the edit mode of their own blog, after this the victim will see a...
Nord Security: Sensitive Information Disclosure on https://nordvpn.com/
The researcher provided us with a URL where there was a list of NordVPN accounts posted. We want to assure that our service, our users' data is still secure ā as far as our website and service are concerned. This is a global issue in cyberspace where hackers know that most users don't bother to s...
Nord Security: No Rate Limit On Forgot Password Page Of NordVPN
Introduction A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given timeframe, HTTP-Servers can respond with status code 429...
Semrush: Code injection in https://www.semrush.com
INTRODUCES: -With a direct error on the homepage, it is easy to trick the victim into accessing a fake page from the attacker STEP: Step: Send url with payload to victim:...
Mail.ru: worki.ru: SMS code bruteforce
SMS code verification process in worki.ru was not sufficiently protected against bruteforce attack Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...
OLX: SQL Injection on https://www.olx.co.id
I found the SQL Injection on the website https://www.olx.co.id Affectected URL : https://www.olx.co.id/ajax/buybundle/getbundle/ POC: 1 In this below request i got SQL injection vulnerability in location parameter post method POST /ajax/buybundle/getbundle/ HTTP/1.1 Host: www.olx.co.id User-Agent...
Semrush: User Controllable Cookie
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! User Controllable Cooki...
Phabricator: Window.opener fix bypass
Description Due to a recent reporthttps://hackerone.com/reports/306414 a fix was deployed in order to resolve the tabnabbing issue. However by using a line break the fix can be bypassed. Steps to reproduce 1 Browse to your Phabricator instance and create a new document. 2 Now paste in the followi...
Inflection: XST(Cross Site Tracing)
Researcher reported that OPTIONS and TRACE HTTP methods are enabled. HTTP configuration best practices are not currently in scope for our HackerOne program, so we closed the report. Researcher requested that we disclose it...
X (Formerly Twitter): XXE on sms-be-vip.twitter.com in SXMP Processor
Hi team, What type of issue are you reporting? Does it align to a CWE or OWASP issue? I've identified an XXE vulnerability in the cloudhopper sxmp servlet on sms-be-vip.twitter.com which discloses local files to an external attacker and allows web requests to be sent. This aligns to...
WordPress: Clickjacking wordcamp.org
Hello Security, Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking contro...
ownCloud: Outdated Jenkins server hosted at OwnCloud.org
Summary: The target OwnCloud's server is running an outdated version of Jenkins server which is vulnerable to various attacks. Server Location: https://ci.owncloud.org Vulnerable Software: Jenkins ver. 2.27 Proof of Exploitability CVE-2016-3727 POC URL:...
Brave Software: [iOS/Android] Address Bar Spoofing Vulnerability
Hello, I am Aaditya Purani, I would like to Report Address Bar spoofing vulnerability in Brave Browser on the IOS as well as Android Platform. All the Test have been carried out against Latest Brave Browser whose versions i have mentioned in Products affected section. Summary: Brave Browser Suffe...
Snapchat: Captcha Bypass in Snapchat's Geofilter Submission Process
Hi, Overview: Snapchat provides a form in which users can submit "Geofilters". These are filters which get applied to users snaps when they are in specific geolocations. The form https://www.snapchat.com/geofilters/submit.html allows for the submission of these "Geofilters" as an anonymous user...
curl: TLS conn reuse and session cache ignore fsslctx callback and ssl_config_data flags ( incomplete fix variant of 7541ae569 )
Summary matchsslprimaryconfig in lib/vtls/vtls.c:194 and the session-cache key built by cfsslpeerkeybuild in lib/vtls/vtlsscache.c:240 both compare only struct sslprimaryconfig fields when deciding whether to reuse a TLS connection or cached session. Several fields that materially change the TLS...
Internet Bug Bounty: CVE-2024-2398: HTTP/2 push headers memory-leak
A memory leak was found in libcurl when handling HTTP/2 push headers. The vulnerability was caused by libcurl's failure to properly release the allocated memory when aborting a server push due to the maximum allowed limit being exceeded. This could lead to denial of service due to memory exhausti...
inDrive: #1 XSS on watchdocs.indriverapp.com
The security vulnerability found on watchdocs.indriverapp.com allowed for cross-site scripting XSS attacks. The vulnerability was triggered by crafting a specific URL that executed arbitrary JavaScript code when accessed by users...
Internet Bug Bounty: CVE-2022-35252: control code in cookie denial of service
https://hackerone.com/reports/1613943 Impact control code in cookie denial of service...
GitLab: Installing Gitlab runner with Docker-In-Docker allows root access
Summary Installing a Gitlab runner using official documents: https://docs.gitlab.com/ee/ci/docker/usingdockerbuild.htmluse-docker-socket-binding allows any user with access to Gitlab CI to have root access on Gitlab Runner server. Steps to reproduce Install Gitlab-runner binary using official...
Logitech: Sensitive information disclosure to shared access user via streamlabs platform api
Summary: Hi there, Hope you are doing well and stay safe. Streamlab allows us to invite other users to manage our dashboard and cloudbot functions via following setting which named "Shared Access". https://streamlabs.com/dashboard/settings/shared-access If we invite other users with Moderator rol...
h1-ctf: [hacky-holidays] Grinch network is down
Flag 1 As always CTF begins with a tweet: F1126838 So we are supposed to start from https://hackyholidays.h1ctf.com/ . The first flag was easy on https://hackyholidays.h1ctf.com/ I found a file named robots.txt which had the following content: User-agent: Disallow: /s3cr3t-ar3a Flag:...
Automattic: Sql injection on docs.atavist.com
hello dear team I have found SQL injection on docs.atavist.com url:http://docs.atavist.com/readerapi/stories.php?limit=10&offset=20&organizationid=88822&search=0&sort= parameters: injectable search=0 Parameter: search GET Type: AND/OR time-based blind Title: MySQL = 5.0.12 AND time-based blind...
HackerOne: Team object in GraphQL disclosed private_comment
Summary: Hi Team, Some privateI think part of GraphQL reveals to us Steps To Reproduce Without authorization 1. https://hackerone.com/graphql POST: "query":"query nodeid: \"gid://hackerone/SurveyRatingItem/āāāāā\" ... on...