QIWI: account takeover https://qiwi.me

It was possible to takeover user account by sending wrong code parameter in /sms/confirm request. Problem is that code didn't have relation with current user session...

X (Formerly Twitter): Verify any unused email address

Summary: Verify any unused email address in twitter account Description: After signing up on twitter it's recommended for a user to verify his/her email address to avoid spam and impersonation, I was able to verify the email without having access to the email itself. Steps To Reproduce: It's a bi...

Open-Xchange: [XSS] select/onchange in TinyMCE via set body

Hi. TinyMCE allow insert . For set this content need special link: mailto:aaa?body=. Steps: 1. Go to compose mail 2. Insert URL: mailto:aaa?body=%3Cselect%20onchange%3D%22alertdocument.cookie%22%3E%3Coption%3E2%3C%2Foption%3E%3Coption%3E2%3C%2Foption%3E%3C%2Fselect%3E 3. Save Mail 4. Open this ma...

Node.js third-party modules: Path Traversal on Resolve-Path

The author of resolve-path told me that I can submit this to here. The vulnerability already reported to the author and got a fixed! Module module name: resolve-path version: 1.3.3 npm page: https://www.npmjs.com/package/resolve-path Description Resolve a relative path against a root path with...

Nextcloud: Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11

Hi, I noticed that the redirecturi used to redirect users to any location on the page, passes in all data into a header"Location.. without any validation. The problem is that PHP current PHP-versions of Debian/Ubuntu, there seem to be a patch properly in place in other dists actually built the...

ownCloud: DROWN Attack

Hi, I want to report a drown attack in .owncloud.com. A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable serve...

Node.js: Path traversal through path stored in Uint8Array

A vulnerability was discovered in Node.js that allowed path traversal through Uint8Array objects. This vulnerability affected users using the experimental permission model in Node.js 20...

inDrive: XSS on terra-6.indriverapp.com

A Cross-Site Scripting XSS vulnerability was discovered on the terra-6.indriverapp.com domain that allowed javascript code execution in users' browsers...

Internet Bug Bounty: CVE-2022-35252: control code in cookie denial of service

https://hackerone.com/reports/1613943 Impact control code in cookie denial of service...

Recorded Future: Storage of old passwords in plain text format

Summary: Server response from app.recordedfuture.com has old passwords for a logged in account in plain text format. Storage of passwords in any readable format or using weak hashes put the account or system at great risk. What's interesting is how RecordedFuture store multiple passwords not just...

Internet Bug Bounty: The Host Authorization middleware in Action Pack is vulnerable to crafted X-Forwarded-Host values

Title: The Host Authorization middleware in Action Pack is vulnerable to crafted X-Forwarded-Host values Scope: https://github.com/rails/rails Weakness: Open Redirect Severity: Medium Link: https://hackerone.com/reports/1189310 Date: 2021-05-09 06:29:19 +0000 By: @mshtawy CVE IDs: CVE-2021-22942,...

Nextcloud: bypassing dashboard without account + Information disclosure trough websockets

Sumarry : I found a information disclosure for bypassing parameter url attacker can redirect to dashboard without login user/pass page and websocket can be exposed in response/dashboard. URL Effected https://support.nextcloud.com/passwordreset Steps To Reproduce: Opened directory at...

Shopify: [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image

Hello Shopify, when testing Shopify Ping share image function, I discovered an Amazon S3 bucket which has public access which allows an attacker to view all the image of other merchant & users. Steps To Reproduce: 1. Install Shopify Ping on your phone then enable Shopify Chat for your store. 2. G...

U.S. Dept Of Defense: Reflected XSS on ███████

Summary: Reflected Cross site Scripting XSS on████leaving.html?url=%22%3E%3Cscript%3Ealertdocument.domain%3C/script%3E Steps To Reproduce: 1. Navigate to███leaving.html?url= 2. Enter a crafted XSS payload like "alert"xss by nagli" 3. Alert will pop :- █████████ How can the system be exploited wit...

WordPress: Clickjacking on donation page

Description: Vulnerable URL: https://wordpressfoundation.org/donate/ Clickjacking on the vulnerable URL allows an attacker to redirect a victim to do a donation at an attacker's page. Steps To Reproduce: 1 To test whether the page is vulnerable to clickjacking or not use this code i Frame THIS PA...

Radancy: [mijn.werkenbijdefensie.nl] Denial of service occurs due to lack of email length confirmation

Creating an account on https://mijn.werkenbijdefensie.nl/profielaanmaken/ could be done with a very long emailaddress. A max email address length validation check has been implemented as per RFC the maximum length allowed for an email address is 255 characters. However, we don't validate email...

Razer: SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter.

The tester discovered a monitoring server in a Razer Gold environment was running legacy software with a SQL injection vulnerability. Razer thanks the tester for his diligence and helping keep Razer's customer data secure. A Razer Gold asset suffered from an SQL injection due to an outdated...

Nord Security: Reduced Payment amount while paying on Crypto Currencies

Summary: While the payment is made via Crypto Currencies on the site "https://join.nordvpn.com/order/", the amount can be reduced to 25.64 instead of the original amount, this can cause loss of revenue to the company. Even the BTC value reflects the reduced converted values, see the screenshot...

Kubernetes: Man in the middle using LoadBalancer or ExternalIPs services

I rated this vulnerability as high because trying to rate it with CVSS v3.0 Calculator gives me 9.9 which seems way too high as you do require to be able to create services in the K8S cluster. Summary: This report details 2 ways to man in the middle traffic by: a creating a LoadBalancer service a...

Mapbox: Stored XSS | api.mapbox.com | IE 11 | Styles name

On December 24, 2019, user @renekroka reported a stored XSS injection vulnerability on api.mapbox.com that affected users in Internet Explorer 11. An attacker could store XSS injections on Mapbox servers, and then exploit them in IE11 due to JSON responses not including the X-Content-Type-Options...

U.S. Dept Of Defense: [Partial] SSN & [PII] exposed through iPERMs Presentation Slide.

Hello @deptofdefense, when performing reconnaissance, I came across a presentation slide that displayed live data since the data is blocked out & is formatted with XXX-XX with the last 4 digits. The exposed data contains the following: UPC, Division/Brigade, Rank, Soldier Name, Last 4 digits of...

Grammarly: Previously created sessions continue being valid after MFA activation

Hi team, I found one issue related to your 2FA system on https://account.grammarly.com/security POC 1 access the same account on https://account.grammarly.com in two devices 2 on device 'A' go to https://account.grammarly.com/security complete all steps to activate the 2FA system Now the 2FA is...

X (Formerly Twitter): [dev.twitter.com] XSS and Open Redirect Protection Bypass

Description: Hi after I finish reading the report https://hackerone.com/reports/260744.i start to test this subdomain.i fount an interesting url https://dev.twitter.com/web/sign-inhttps://dev.twitter.com/basics/adding-international-support-to-your-apps.this url is special,my intuition tells me th...

Node.js third-party modules: [public] Path Traversal allows to read content of arbitrary files

Hi Guys, There is Path Traversal in public module. It allows to read content of arbitrary files on the remote server. Module public Run static file hosting server with specified public dir & port. Support a "direcotry index" like Apache httpd. https://www.npmjs.com/package/public version: 0.1.2...

curl: CVE-2022-43552: HTTP Proxy deny use-after-free

Issues reported by Trail of Bits. This is either one or two issues. Summary: ./src/curl 0 -x0:80 telnet:/j-uj-u//0 -m 01 ./src/curl 0 -x0:80 smb:/j-uj-u//0 -m 01 Both command line ends up having libcurl access and use already freed heap-memory. For read and write. Steps To Reproduce: See above, r...

Internet Bug Bounty: CVE-2022-27779: cookie for trailing dot TLD

Published Advisory: https://curl.se/docs/CVE-2022-27779.html Original Report: https://hackerone.com/reports/1553301 Impact This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain. ie. conduct session fixation attacks...

Internet Bug Bounty: CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGs

In Apache Airflow, prior to version 2.2.4, In DAG script of airflow , there is two command injection vulnerability RCE in the some scripts, which an attacker can execute arbitrary commands on the system. The impact is even greater when airflow is configured for unauthenticated access. These two...

TikTok: IDOR the ability to view support tickets of any user on seller platform

Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially viewed support tickets on seller platform. We thank @lewaperbb for reporting this to our team...

Shopify: Improper Input Validation on https://oberlo-image-proxy.shopifycloud.com/

The service under https://oberlo-image-proxy.shopifycloud.com/ seems to work like a image proxy through the url GET parameter and it suppose to handle only images. █████████ When other content type than an image is present the service returns a 404 error to the user. curl -si...

Node.js: HTTP Request Smuggling due to accepting space before colon

Summary: The llhttp parser in the httpmodule in Node 16.3.0 accepts requests with a space SP right after the header name before the colon. This can lead to HTTP Request Smuggling HRS. Description: When Node receives the following request: GET / HTTP/1.1 Host: localhost:5000 Content-Length : 5 hel...

GitHub Security Lab: Java : Add query for detecting Log Injection vulenrabilities

This bug was reported directly to GitHub Security Lab...

Shopify: [h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034)

Summary: Due to a missing domain format check in Shopify's wholesale functionality, it is possible to serve arbitrary content on the customer's domain through existing DNS records already configured to work with Shopify. I only tested with domains that I own but as far as I understand, this would...

h1-ctf: Hackyholidays [ h1-ctf] writeup [mission:- stop the grinch ]

Hello Team Description In the continuous series of 12 days, twelve flags were hidden inside Hackyholidays site - hackyholidays.h1ctf.com in which once we get all the flags, grinch can be stopped. This write-up will describe solving all the 12 days challenges. Step To Reproduce + It all started wh...

Node.js third-party modules: Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDN

I would like to report possible cache poisoning in Fastify It allows an attacker to perform an cache poisoning when Fastify is used in combination with a http cache / CDN. Module module name: Fastify version: 3.x npm page: https://www.npmjs.com/package/fastify Module Description Fast and low...

CS Money: Bypass restrict of member subscription to use custom background in https://3d.cs.money without prime subscription

Summary: In website https://3d.cs.money you need to subscribe prime to have a custom background for skin F999661 But with this vulnerability, we can use custom background without any fee required Steps To Reproduce: add details for how we can reproduce the issue - Grab a build of skin - Save it...

U.S. Dept Of Defense: Path traversal on https://███ allows arbitrary file read (CVE-2020-3452)

Summary: According to Cisco: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targete...

Open-Xchange: Out of memory with combination of `test_config_set` and `test_config_reload`

Running testsuite on input require "vnd.dovecot.testsuite"; require "variables"; require "editheader"; testset "message" "$message"; test "Default protected" if not exists "received" testfail "received header did not exist in the first place"; testconfigset "sieveeditheaderprotected" "Àubject...

Visma Public: [IDOR]Ability to edit Description of api_key's of other users.

The reasearcher was able to change the description associated with API-keys for other users on the /api/orgID/apiKey endpoint by modifying the id of the API-key in the request...

X (Formerly Twitter): Periscope iOS app CSRF in follow action due to deeplink

Summary This issue is mainly in the Periscope iOS app against CSRF follow action using deeplink. as the report 583987 the CSRF work on iOS app POC 1 QR code to follow periscope profile pscp://user/periscopeco/follow ███████ POC2 by kunal94 /follow"CSRF DEMO video █████████ Impact CSRF Follow...

HackerOne: Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program details

It's possible for an attacker to enumerate embedded submission form UUIDs through HackerOne's GraphQL node interface. In normal application behavior, an embedded submission form is queried through GraphQL with a UUID. These UUIDs are random and they're not susceptible to brute force attacks...

U.S. Dept Of Defense: Remote Code Execution (RCE) in a DoD website

SUMMARY: ==================== This report describes a vulnerability similar to that described in my other reports 329376, 329397, 329399 The DoD https://████/psc/EXPROD/ Web System uses the Oracle PeopleSoft platform which is vulnerable to Remote Code Execution RCE and Denial of Service Attacks D...

GSA Bounty: Subdomain Takeover due to unclaimed domain pointing to AWS

Note: I know this is on an out of scope domain, however felt it should still be raised as it was the only subdomain of data.gov to be vulnerable. Issue Details The consultant identified that subdomain https://18f.domains.api.data.gov/ is pointing to dn9rrjaiux2m0.cloudfront.net via a DNS CNAME...

Semrush: Following links are vulnerable to clickjacking

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: The below list...

Uber: DOM based XSS on

Possible Remote code execution DOM based XSS Vuln Jquery param : var strliID=jQuerylocation.attr'hash'; Target: Logged admin Go url https://drive.uber.com/melbourne/wp-admin/admin.php?page=Optionsgallerystyles" Solution : Upgrade latest version gallery plugin Your version v1.9.55 Test my localhos...

Internet Bug Bounty: BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)

For certain inputs OpenSSL's BNmodexp function which is used for RSA and Diffie Hellman can produce wrong results. The issue has been fixed by OpenSSL and rated moderate severity: https://openssl.org/news/secadv/20151203.txt A code example is here:...

Slack: File upload XSS (Java applet) on http://slackatwork.com/

The web application supports file uploads and I was able to upload a Java Applet .class/.jar file. If a web browser loads a Java applet from a trusted site, the browser provides no security warning. If an attacker can upload a CLASS/JAR file with an applet, the file is executed even if the web...

Phabricator: Bypass auth.email-domains

Email addresses are stored as VARCHAR128. However, Phabricator does not verify the length of an email address upon registration. This allows attackers to bypass the allowed email-domains defined in auth.email-domains. Exploiting this is rather straightforward: get an email address of 128 characte...

Bykea: IDOR on in-app hardcoded zombie endpoint

The researcher discovered an Insecure Direct Object Reference IDOR vulnerability in a hardcoded legacy zombie endpoint that was no longer actively used but remained accessible. By reverse engineering the Android app and reviewing the code for unused endpoints, the sensitive details related to...

Node.js: process.binding() can bypass the permission model through path traversal

The use of the deprecated API process.binding allowed for bypassing the permission model in Node.js 20.x through path traversal...

curl: CVE-2023-32001: fopen race condition

A race condition vulnerability existed in the fopen function of the curl library. This vulnerability allowed an attacker to exploit the race condition between the stat and fopen functions, potentially leading to unauthorized file overwrites or the theft of sensitive data such as cookies. The...