Lucene search
+L
HackeroneMost viewed

15525 matches found

Hacker One
Hacker One
added 2023/01/29 9:11 a.m.113 views

U.S. Dept Of Defense: [XSS] Reflected XSS via POST request

A reflected XSS vulnerability was found on a subdomain of a website. The vulnerability was found in a POST request to a specific page, where the flddisplaytype parameter was vulnerable to XSS. Although a WAF was deployed on the endpoint to prevent such attacks, the payload was successfully...

6.3AI score
SaveExploits0
Hacker One
Hacker One
added 2022/11/07 4:45 p.m.113 views

curl: CVE-2022-43552: HTTP Proxy deny use-after-free

Issues reported by Trail of Bits. This is either one or two issues. Summary: ./src/curl 0 -x0:80 telnet:/j-uj-u//0 -m 01 ./src/curl 0 -x0:80 smb:/j-uj-u//0 -m 01 Both command line ends up having libcurl access and use already freed heap-memory. For read and write. Steps To Reproduce: See above, r...

2.6CVSS6.8AI score0.02511EPSS
SaveExploits1
Hacker One
Hacker One
added 2022/06/08 10:35 p.m.113 views

Internet Bug Bounty: Read beyond bounds in ap_strcmp_match() [zhbug_httpd_47.7]

Greetings. I have found a read-beyond-bounds attack against httpd that allows an attacker to search httpd's memory for strings matching an attacker-specified pattern 1. The attack arises from an overflow in apstrcmpmatch server/util.c. 2 The vulnerability can be reached via an LUA program that us...

6.4CVSS9.4AI score0.06457EPSS
SaveExploits0
Hacker One
Hacker One
added 2021/12/05 4:06 p.m.113 views

GitLab: Installing Gitlab runner with Docker-In-Docker allows root access

Summary Installing a Gitlab runner using official documents: https://docs.gitlab.com/ee/ci/docker/usingdockerbuild.htmluse-docker-socket-binding allows any user with access to Gitlab CI to have root access on Gitlab Runner server. Steps to reproduce Install Gitlab-runner binary using official...

0.1AI score
SaveExploits0
Hacker One
Hacker One
added 2021/09/15 12:06 a.m.113 views

GitHub Security Lab: [Java] CWE-079: Query to detect XSS with JavaServer Faces (JSF)

This bug was reported directly to GitHub Security Lab...

1.4AI score
SaveExploits0
Hacker One
Hacker One
added 2021/07/14 1:21 p.m.113 views

Nextcloud: HEIC image preview can be used to invoke Imagick

The HEIC image preview provider calls into Imagick at https://github.com/nextcloud/server/blob/5d097ddb4b99673f57b8c085dedd93880ee2539d/lib/private/Preview/HEIC.phpL98-L109. This is bad as Imagick processes all kind of image types. One can use this for example to exfiltrate arbitrary files by...

10CVSS0.9AI score0.02604EPSS
SaveExploits0
Hacker One
Hacker One
added 2021/06/20 11:10 a.m.113 views

Node.js: HTTP Request Smuggling due to accepting space before colon

Summary: The llhttp parser in the httpmodule in Node 16.3.0 accepts requests with a space SP right after the header name before the colon. This can lead to HTTP Request Smuggling HRS. Description: When Node receives the following request: GET / HTTP/1.1 Host: localhost:5000 Content-Length : 5 hel...

6.4CVSS7.7AI score0.03156EPSS
SaveExploits1
Hacker One
Hacker One
added 2021/05/04 8:21 p.m.113 views

GitHub Security Lab: ihsinme: CPP Add query for CWE-691 Insufficient Control Flow Management After Refactoring The Code

This bug was reported directly to GitHub Security Lab...

2.3AI score
SaveExploits0
Hacker One
Hacker One
added 2021/01/08 10:42 a.m.113 views

Doppler VDP: Bypass Email Verification.

steps to reproduce:- 1- sign up into doppler here https://dashboard.doppler.com/register. 2- then it will go to this page https://dashboard.doppler.com/confirm and ask you to confirm your email. 3- go to source code and search for tagsconfirmemail . 4- you will find the email Verification token...

7.3AI score
SaveExploits0
Hacker One
Hacker One
added 2020/11/03 8:22 p.m.113 views

Node.js third-party modules: Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDN

I would like to report possible cache poisoning in Fastify It allows an attacker to perform an cache poisoning when Fastify is used in combination with a http cache / CDN. Module module name: Fastify version: 3.x npm page: https://www.npmjs.com/package/fastify Module Description Fast and low...

5CVSS6.4AI score0.01726EPSS
SaveExploits0
Hacker One
Hacker One
added 2020/10/29 3:37 p.m.113 views

Shopify: [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image

Hello Shopify, when testing Shopify Ping share image function, I discovered an Amazon S3 bucket which has public access which allows an attacker to view all the image of other merchant & users. Steps To Reproduce: 1. Install Shopify Ping on your phone then enable Shopify Chat for your store. 2. G...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2020/09/23 3:49 p.m.113 views

CS Money: Bypass restrict of member subscription to use custom background in https://3d.cs.money without prime subscription

Summary: In website https://3d.cs.money you need to subscribe prime to have a custom background for skin F999661 But with this vulnerability, we can use custom background without any fee required Steps To Reproduce: add details for how we can reproduce the issue - Grab a build of skin - Save it...

SaveExploits0
Hacker One
Hacker One
added 2020/08/31 3:56 p.m.113 views

U.S. Dept Of Defense: Reflected XSS on ███████

Summary: Reflected Cross site Scripting XSS on████leaving.html?url=%22%3E%3Cscript%3Ealertdocument.domain%3C/script%3E Steps To Reproduce: 1. Navigate to███leaving.html?url= 2. Enter a crafted XSS payload like "alert"xss by nagli" 3. Alert will pop :- █████████ How can the system be exploited wit...

1.7AI score
SaveExploits0
Hacker One
Hacker One
added 2020/08/07 5:20 a.m.113 views

Shopify: Ability to publish a paid theme without purchasing it.

Hi, Description I kept looking for alternatives to my report 927567 and I found another way to publish a paid theme without having to purchase it. This time the trick is to send "ThemePublishLegacy" XHR request while the theme is being installed. Requirements 1. Google Chrome suggested because...

6.5AI score
SaveExploits0
Hacker One
Hacker One
added 2020/08/01 3:56 p.m.113 views

Dropcontact: Unrestricted File Upload on https://app.dropcontact.io/app/upload/

hi team, I found Unrestricted File Upload Vulnerabilities on https://app.dropcontact.io/app/upload/. Steps To Reproduce: 1. Create an account in https://app.dropcontact.io/app/ 1. go to https://app.dropcontact.io/app/upload/ 1. try to upload html file , you will see message only : .csv, .txt, .xl...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2020/07/16 10:46 p.m.113 views

Nord Security: Getting SmartDNS for free from - join.nordvpn.com

The reporter identified an issue within our backend system which performs validation of the active services. There was a misconfiguration related to caching and time period calculation. This lead to SmartDNS service being active for a longer period of time than it should have been, compared with...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2020/03/19 5:28 a.m.113 views

Razer: SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter.

The tester discovered a monitoring server in a Razer Gold environment was running legacy software with a SQL injection vulnerability. Razer thanks the tester for his diligence and helping keep Razer's customer data secure. A Razer Gold asset suffered from an SQL injection due to an outdated...

0.9AI score
SaveExploits0
Hacker One
Hacker One
added 2020/02/26 9:10 a.m.113 views

X (Formerly Twitter): Periscope iOS app CSRF in follow action due to deeplink

Summary This issue is mainly in the Periscope iOS app against CSRF follow action using deeplink. as the report 583987 the CSRF work on iOS app POC 1 QR code to follow periscope profile pscp://user/periscopeco/follow ███████ POC2 by kunal94 /follow"CSRF DEMO video █████████ Impact CSRF Follow...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2019/08/05 3:49 p.m.113 views

Grammarly: Previously created sessions continue being valid after MFA activation

Hi team, I found one issue related to your 2FA system on https://account.grammarly.com/security POC 1 access the same account on https://account.grammarly.com in two devices 2 on device 'A' go to https://account.grammarly.com/security complete all steps to activate the 2FA system Now the 2FA is...

1.3AI score
SaveExploits0
Hacker One
Hacker One
added 2018/02/06 4:12 p.m.113 views

Node.js third-party modules: [public] Path Traversal allows to read content of arbitrary files

Hi Guys, There is Path Traversal in public module. It allows to read content of arbitrary files on the remote server. Module public Run static file hosting server with specified public dir & port. Support a "direcotry index" like Apache httpd. https://www.npmjs.com/package/public version: 0.1.2...

5CVSS7.6AI score0.02038EPSS
SaveExploits1
Hacker One
Hacker One
added 2017/11/10 6:29 p.m.113 views

Semrush: Following links are vulnerable to clickjacking

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: The below list...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2015/11/04 11:10 a.m.113 views

Slack: File upload XSS (Java applet) on http://slackatwork.com/

The web application supports file uploads and I was able to upload a Java Applet .class/.jar file. If a web browser loads a Java applet from a trusted site, the browser provides no security warning. If an attacker can upload a CLASS/JAR file with an applet, the file is executed even if the web...

6.2AI score
SaveExploits0
Hacker One
Hacker One
added 2024/11/15 11:16 a.m.112 views

IBM: Exposed Logs and Bearer Tokens on Test Endpoint

Exposed Logs and Bearer Tokens on Test Endpoint were reported to IBM, analyzed, and have been remediated...

7.2AI score
SaveExploits0
Hacker One
Hacker One
added 2023/07/05 3:54 p.m.112 views

Node.js: process.binding() can bypass the permission model through path traversal

The use of the deprecated API process.binding allowed for bypassing the permission model in Node.js 20.x through path traversal...

7.5CVSS8.4AI score0.01743EPSS
SaveExploits1
Hacker One
Hacker One
added 2023/05/25 1:38 p.m.112 views

Node.js: HTTP Request Smuggling via Empty headers separated by CR

HTTP Request Smuggling HRS was possible in Node.js v20.2.0 due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests. The CR character without LF was sufficient to delimit HTTP header fields in the llhttp parser, which is not compliant with RFC7230...

7.5CVSS7.7AI score0.03906EPSS
SaveExploits1
Hacker One
Hacker One
added 2023/05/02 1:31 p.m.112 views

inDrive: XSS on terra-6.indriverapp.com

A Cross-Site Scripting XSS vulnerability was discovered on the terra-6.indriverapp.com domain that allowed javascript code execution in users' browsers...

6.4AI score
SaveExploits0
Hacker One
Hacker One
added 2022/10/27 3:24 p.m.112 views

Internet Bug Bounty: CVE-2022-42916: HSTS bypass via IDN

Original Report:https://hackerone.com/reports/1730660 Impact HSTS bypass...

5CVSS8.5AI score0.01809EPSS
SaveExploits0
Hacker One
Hacker One
added 2022/08/31 10:55 a.m.112 views

Internet Bug Bounty: CVE-2022-35252: control code in cookie denial of service

https://hackerone.com/reports/1613943 Impact control code in cookie denial of service...

2.6CVSS6AI score0.01947EPSS
SaveExploits1
Hacker One
Hacker One
added 2021/11/05 10:43 p.m.112 views

TikTok: IDOR the ability to view support tickets of any user on seller platform

Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially viewed support tickets on seller platform. We thank @lewaperbb for reporting this to our team...

2.7AI score
SaveExploits0
Hacker One
Hacker One
added 2021/04/14 7:20 p.m.112 views

GitHub Security Lab: [Java] CWE-1004: Query to check sensitive cookies without the HttpOnly flag set

This bug was reported directly to GitHub Security Lab...

0.1AI score
SaveExploits0
Hacker One
Hacker One
added 2021/03/25 10:43 p.m.112 views

GitHub Security Lab: Java : Add query for detecting Log Injection vulenrabilities

This bug was reported directly to GitHub Security Lab...

1.4AI score
SaveExploits0
Hacker One
Hacker One
added 2021/01/06 5:26 p.m.112 views

Logitech: Sensitive information disclosure to shared access user via streamlabs platform api

Summary: Hi there, Hope you are doing well and stay safe. Streamlab allows us to invite other users to manage our dashboard and cloudbot functions via following setting which named "Shared Access". https://streamlabs.com/dashboard/settings/shared-access If we invite other users with Moderator rol...

6.5AI score
SaveExploits0
Hacker One
Hacker One
added 2020/11/20 2:02 a.m.112 views

Automattic: Sql injection on docs.atavist.com

hello dear team I have found SQL injection on docs.atavist.com url:http://docs.atavist.com/readerapi/stories.php?limit=10&offset=20&organizationid=88822&search=0&sort= parameters: injectable search=0 Parameter: search GET Type: AND/OR time-based blind Title: MySQL = 5.0.12 AND time-based blind...

0.3AI score
SaveExploits0
Hacker One
Hacker One
added 2020/07/23 2:16 a.m.112 views

U.S. Dept Of Defense: Path traversal on https://███ allows arbitrary file read (CVE-2020-3452)

Summary: According to Cisco: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targete...

5CVSS0.7AI score0.99992EPSS
SaveExploits25
Hacker One
Hacker One
added 2019/12/24 12:03 a.m.112 views

Mapbox: Stored XSS | api.mapbox.com | IE 11 | Styles name

On December 24, 2019, user @renekroka reported a stored XSS injection vulnerability on api.mapbox.com that affected users in Internet Explorer 11. An attacker could store XSS injections on Mapbox servers, and then exploit them in IE11 due to JSON responses not including the X-Content-Type-Options...

1.5AI score
SaveExploits0
Hacker One
Hacker One
added 2018/09/27 10:16 a.m.112 views

h1-5411-CTF: h1-5411-CTF report: LFI / Deserialization / XXE vulnerability,

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: h1-5411-ctf write-up The CTF...

0.6AI score
SaveExploits0
Hacker One
Hacker One
added 2023/06/27 7:05 a.m.111 views

curl: CVE-2023-32001: fopen race condition

A race condition vulnerability existed in the fopen function of the curl library. This vulnerability allowed an attacker to exploit the race condition between the stat and fopen functions, potentially leading to unauthorized file overwrites or the theft of sensitive data such as cookies. The...

5.3AI score
SaveExploits0
Hacker One
Hacker One
added 2022/08/06 4:59 a.m.111 views

Reddit: IDOR allows an attacker to modify the links of any user

Hi team! I found an IDOR which allows to modify the links of any user. Users can put their custom links or social media links on their profile, ex: F1855366 To reproduce this: - Replicate the following request by replacing it with your own authentication headers: You must also put in the body of...

1.3AI score
SaveExploits0
Hacker One
Hacker One
added 2021/11/17 4:39 p.m.111 views

Acronis: IDOR vulnerability (Price manipulation)

Target: acronis.cz Step to Reproduce 1.Go to acronis.cz 2.buy any product in this case i am going to buy this https://www.acronis.cz/produkt/acronis-cyber-protect-home-office/ for test 3.fill up details 4.go to burpsuite turn on intercept 5.click on buy now 6.check request in intercept change pri...

0.8AI score
SaveExploits0
Hacker One
Hacker One
added 2021/11/05 11:02 a.m.111 views

XVIDEOS: No-Rate limit of current password on delete account endpoint(https://www.xvideos.com/account/close)

Hi Team!!! This Attack happen when victim login in other device and forget to logout ,Then attacker can delete it's account by brute force the current password because current password has no-rate limit. After guessing current password attacker can easily delete the victim account. Steps To...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2021/05/20 11:23 p.m.111 views

GitHub Security Lab: [Java] CWE-094: Jython code injection

This bug was reported directly to GitHub Security Lab...

1.2AI score
SaveExploits0
Hacker One
Hacker One
added 2021/02/13 3:55 p.m.111 views

Nextcloud: bypassing dashboard without account + Information disclosure trough websockets

Sumarry : I found a information disclosure for bypassing parameter url attacker can redirect to dashboard without login user/pass page and websocket can be exposed in response/dashboard. URL Effected https://support.nextcloud.com/passwordreset Steps To Reproduce: Opened directory at...

6.6AI score
SaveExploits0
Hacker One
Hacker One
added 2020/10/15 4:42 a.m.111 views

Engel & Völkers Technology GmbH: Debug information at the /sapi endpoint

Summary: Sending a GET request to www.engelvoelkers.com/sapi and the server responds with a 500 Internal Server Error which yields a stack trace. Steps To Reproduce: - Enter www.engelvoelkers.com/sapi into your web browser and you can see the stacktrace. https://bugpoc.com/pocbp-VPZDeo2Z I will...

SaveExploits0
Hacker One
Hacker One
added 2020/07/12 9:52 p.m.111 views

WordPress: Clickjacking on donation page

Description: Vulnerable URL: https://wordpressfoundation.org/donate/ Clickjacking on the vulnerable URL allows an attacker to redirect a victim to do a donation at an attacker's page. Steps To Reproduce: 1 To test whether the page is vulnerable to clickjacking or not use this code i Frame THIS PA...

0.4AI score
SaveExploits0
Hacker One
Hacker One
added 2020/06/04 3:56 p.m.112 views

Open-Xchange: null dereference in `sieve_address_do_validate` (or redundant null check)

Function sieveaddressdovalidate in file sieve-address.c does dereference errorr if address == NULL errorr = "null address"; return FALSE; and then later checks for it being NULL : if errorr != NULL errorr = strcctx.error; So either, there is a first null check missing Or the later ones are...

1.8AI score
SaveExploits0
Hacker One
Hacker One
added 2020/05/17 7:47 a.m.111 views

Topcoder: SSRF at https://cognitive.topcoder.com leads to AWS instance metadata due to vulnerable email subscription feature

Summary: Topcoder makes use of Amazons AWS in their web application environment. I noticed a feature that allows a user to subscribe and receive emails from Topcoder. This feature is vulnerable to server side request forgery since it allows a user to supply an arbitrary URL which the application...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2020/03/03 9:03 p.m.111 views

Visma Public: [IDOR]Ability to edit Description of api_key's of other users.

The reasearcher was able to change the description associated with API-keys for other users on the /api/orgID/apiKey endpoint by modifying the id of the API-key in the request...

2.9AI score
SaveExploits0
Hacker One
Hacker One
added 2019/12/04 8:44 p.m.111 views

Nord Security: No Rate Limit On Forgot Password Page Of NordVPN

Introduction A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given timeframe, HTTP-Servers can respond with status code 429...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2019/09/21 4:13 a.m.111 views

Razer: Race Condition in Oauth 2.0 flow can lead to malicious applications create multiple valid sessions

The tester discovered a flaw in the Razer ID authentication system that could allow multiple access tokens. This was a minor issue but could theoretically have led to extended access due to unexpired tokens. Razer thanks the tester for their diligence. Here is a write-up for similar bug:...

1.2AI score
SaveExploits0
Hacker One
Hacker One
added 2018/05/23 7:11 a.m.111 views

Node.js third-party modules: Samlify is vulnerable to signature wrapping

I would like to report a signature wrapping weakness in samlify It allows an attacker to modify a SAML token received from the IdP before validating it with the service provider Module module name: samlify version: 2.3.7 npm page: https://www.npmjs.com/package/samlify Module Description Highly...

6.8AI score
SaveExploits0
Total number of security vulnerabilities5000