15405 matches found
IBM: Subdomain Takeover Affecting at vex.weather.com
Vulnerability description not provided...
curl: CVE-2022-43552: HTTP Proxy deny use-after-free
Issues reported by Trail of Bits. This is either one or two issues. Summary: ./src/curl 0 -x0:80 telnet:/j-uj-u//0 -m 01 ./src/curl 0 -x0:80 smb:/j-uj-u//0 -m 01 Both command line ends up having libcurl access and use already freed heap-memory. For read and write. Steps To Reproduce: See above, r...
Reddit: IDOR allows an attacker to modify the links of any user
Hi team! I found an IDOR which allows to modify the links of any user. Users can put their custom links or social media links on their profile, ex: F1855366 To reproduce this: - Replicate the following request by replacing it with your own authentication headers: You must also put in the body of...
Internet Bug Bounty: CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGs
In Apache Airflow, prior to version 2.2.4, In DAG script of airflow , there is two command injection vulnerability RCE in the some scripts, which an attacker can execute arbitrary commands on the system. The impact is even greater when airflow is configured for unauthenticated access. These two...
XVIDEOS: No-Rate limit of current password on delete account endpoint(https://www.xvideos.com/account/close)
Hi Team!!! This Attack happen when victim login in other device and forget to logout ,Then attacker can delete it's account by brute force the current password because current password has no-rate limit. After guessing current password attacker can easily delete the victim account. Steps To...
HackerOne: Information disclosure - Feedback is accessible on Public profile even after 'disallowed' at https://hackerone.com/settings/feedback
Summary: Hi team, I noticed one possible information disclosure scenario related to My Feedback managed at https://hackerone.com/settings/feedback Description: In current scenario even after uncheck the option "Show this blurb on my profile" I can access the feedback using one one requestPOST...
Nextcloud: HEIC image preview can be used to invoke Imagick
The HEIC image preview provider calls into Imagick at https://github.com/nextcloud/server/blob/5d097ddb4b99673f57b8c085dedd93880ee2539d/lib/private/Preview/HEIC.phpL98-L109. This is bad as Imagick processes all kind of image types. One can use this for example to exfiltrate arbitrary files by...
Acronis: No Rate Limit On Forgot Password Page
Summary A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame, HTTP-Servers can respond with status code 429: To...
curl: Proxy-Authorization header carried to a new host on a redirect
hi cURL team I am not entirely sure this is an issue, please feel free to close of it isn't. I noticed that when making an HTTP GET request with Proxy-Authorization header, together with the "-L" flag to follow redirects curl -H "Authorization-Proxy: Basic xxx==" http://host:8000 -L If the remote...
GitHub Security Lab: Java : add fastjson detection. Improve RemoteFlowSource class, support SpringMvc
This bug was reported directly to GitHub Security Lab...
Automattic: SQL Injection Union Based
Summary: Hello, I have found a SQL Injection Union Based on https://intensedebate.com/commenthistory/$YourSiteId The $YourSiteId into the url is vulnerable to SQL Injection. Steps to reproduce 1. Logging into https://intensedebate.com 2. After create your own site on...
Shopify: XSS stored in the Shopify Email app
step: 1、install app Shopify Email F1076928 2、Click General under Settings 3、Change phone number to 1234567" F1076939 4、Open shopify email app and create an email 5、Show phone number F1076940 6、watch the vedio poc for more information Impact store xss...
Node.js third-party modules: Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDN
I would like to report possible cache poisoning in Fastify It allows an attacker to perform an cache poisoning when Fastify is used in combination with a http cache / CDN. Module module name: Fastify version: 3.x npm page: https://www.npmjs.com/package/fastify Module Description Fast and low...
Stripo Inc: weak password poilicy in signup password leak to account takeover
Summary: add summary of the vulnerability i create account with weak password Steps To Reproduce: add details for how we can reproduce the issue 1.i create account with weak password qwerty123 2- account create done without validation 3- it should have protected users from attack and have policy...
Bitwarden: Rate limits too low for email 2FA
NO RATE LIMIT ON 2FA CAN LEAD TO ACCOUNT COMPROMISE! 1. Create account on vault.bitwarden.com if you don't have. 2.Setup 2FA via email 3.Logout and log in again. This time along with password you have to fill the 2fa code which is sent to the email. 4.Type Any Random number, intercept request wit...
Brave Software: Arbitrary file download due to bad handling of Redirects in WebTorrent
Summary: Previously I reported 963155 how an attacker can trick user into downloading malicious files using ".save torrent" feature, In this report I am going to reproduce the same behavior but by abusing a different feature. Description While I was testing webtorrent on brave I noticed that...
U.S. Dept Of Defense: Reflected XSS on ███████
Summary: Reflected Cross site Scripting XSS on████leaving.html?url=%22%3E%3Cscript%3Ealertdocument.domain%3C/script%3E Steps To Reproduce: 1. Navigate to███leaving.html?url= 2. Enter a crafted XSS payload like "alert"xss by nagli" 3. Alert will pop :- █████████ How can the system be exploited wit...
Phabricator: Edit Policy restriction does not prevent comments.
Change the edit policy of a Maniphest Task - Attempt to comment on the the task with a user who doesn't have access Impact Given a few users I spoke to believe restricting the edit policy blocks comments, This allows an underpriveleged user to gain access to carry out a restrcited action. Mongoos...
U.S. Dept Of Defense: Reflected XSS and HTML Injectionon a DoD website
Summary: I found Xss and Html injection vulnerabilities on one of the DoD websites Description: When doing the Xss tests I used this payload: alert "XSS" and when running I noticed that the server returned a 403 Forbidden error, but it was easy to do a bypass I just modified the javascript tags i...
Open-Xchange: Buffer overread in parse_angle_addr called from message_address_parse_path
Call messageaddressparsepathpooldatastackcreate, data0, size0, &addr2; with input 0x3c,0x40,0x5b,0x40,0x40,0x28, ie parser.data == '@' if parsedomainlistctx 0 && ctx-parser.data == ':' ctx-parser.data++; - else if parsingpath && ctx-parser.data != ':' + else if parsingpath && ctx-parser.data...
Visma Public: Open Redirection In connect.identity.stagaws.visma.com
The researcher found an open redirection in one of the parameters. This can be used to trick a user to a fake website asking for credentials, and trick the user to give out credentials...
GitLab: Email notification about login email changed is not received when using verified linked email address
Summary In https://gitlab.com/profile, user can update the email id to use for login to gitlab account using field "Email". Usually, when this login email id is updated, there will be 2 email sent on previous email Id with subjects as. Email 1 - Email Changed:- This tell that login email has been...
Kubernetes: Route53 Subdomain Takeover on test-cncf-aws.canary.k8s.io
Summary: I discovered that it was possible to takeover test-cncf-aws.canary.k8s.io by assigning a zone to that name with one of the following nameservers in Route53: test-cncf-aws.canary.k8s.io. 3600 IN NS ns-265.awsdns-33.com. test-cncf-aws.canary.k8s.io. 3600 IN NS ns-687.awsdns-21.net...
Stripo Inc: No Rate Limiting on /reset-password-request/ endpoint
Hi there ! I noticed when we hit the /reset-password-request/ endpoint too many times via some proxy for e.g:- Burp there is no rate limit on that endpoint and you can spam the email with 100's of requests and resend even more password reset emails to the users as there is no rate limiting on tha...
U.S. Dept Of Defense: Remote Code Execution (RCE) in a DoD website
SUMMARY: ==================== This report describes a vulnerability similar to that described in my other reports 329376, 329397, 329399 The DoD https://████/psc/EXPROD/ Web System uses the Oracle PeopleSoft platform which is vulnerable to Remote Code Execution RCE and Denial of Service Attacks D...
GitLab: Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hook
The secret token field of a webhook is vulnerable to a new line injection, allowing an attacker to inject non-HTTP commands in a TCP stream. When a GitLab instance is configured with an external Redis instance, e.g. on 127.0.0.1:6379, it may result in arbitrary code execution on a Sidekiq worker ...
X (Formerly Twitter): XXE on sms-be-vip.twitter.com in SXMP Processor
Hi team, What type of issue are you reporting? Does it align to a CWE or OWASP issue? I've identified an XXE vulnerability in the cloudhopper sxmp servlet on sms-be-vip.twitter.com which discloses local files to an external attacker and allows web requests to be sent. This aligns to...
Pornhub: I am because bug
I'm because I hacker found bug because I report this bug I want to report a bug and because want some $$$$ so please because you are telling me how much you pay money so I give you bug. Me because very poor :' want money because father :' F181917 Thank you wish you because pay lots $$$$$$$$...
Weblate: Open SMTP port can let anyone send email from mail.chihar.com
An open SMTP port 587 can let anyone connect and send emails impersonating someone in your the company if he could enumerate the email addresses. POC - 1. I performed an nmap scan and was able to find an open port 587 for SMTP 2. I did a netcat connection to it and was able to run commands such a...
Nextcloud: HTTP-Basic Authentication on logs.nextcloud.com
Greetings, While visiting https://logs.nextcloud.com/ , I noticed that this server use HTTP-Basic Authentication. F152730 POC : ------ GET https://logs.nextcloud.com/ HTTP/1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:50.0 Gecko/20100101 Firefox/50.0 Accept:...
X (Formerly Twitter): Html Injection and Possible XSS in sms-be-vip.twitter.com
Hi, I would like to report HTML Injection and possible cross site scripting XSS vulnerability in sms-be-vip.twitter.com Overview The sms-be-vip.twitter.com 404 error page appears to be vulnerable to XSS and HTML Injection as it doesn't encode the HTML tags in the path name such as...
Uber: Enumerating userIDs with phone numbers
Fyi, this is my second account since the other one r0t is limited to 4 reports and they are all in triage. So about this issue, when a user is on a trip and invites other users to split the fare, the server responds with info about his number, like: Name, UserID and his picture, and info about th...
Zaption: Open redirect filter bypass
Hi , An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it. its possible to bypass your redirect filter using :...
curl: CVE-2024-11053: netrc + redirect credential leak
CVE-2024-11053 was a logic flaw in Curl that resulted in a credential leak during redirects. The issue was caused by the way Curl processed netrc credentials when performing redirects. Under certain conditions, the redirect passed along credentials specified for the original host to the redirecti...
U.S. Dept Of Defense: Information Disclosure FrontPage Configuration Information
An information disclosure vulnerability was discovered in the Microsoft FrontPage configuration of a subdomain. This vulnerability allowed an attacker to view the version number and scripting paths of Sharepoint using Firefox...
Liberapay: Password Reset Token Leak Via Referrer
Vulnerability description not provided...
FetLife: fetlife.com/signup_step_profile expose access_token of mapbox.com
Vulnerability description not provided...
U.S. Dept Of Defense: Reflected xss on https://█████████
The website was vulnerable to a reflected XSS attack due to a flaw in the check that verifies the validity of the redirect URL. Attackers could exploit this vulnerability to execute malicious scripts on the victim's browser, leading to potential account takeover, phishing, and other malicious...
curl: CVE-2022-27779: cookie for trailing dot TLD
Summary: In CVE-2014-3620 curl prevents cookies from being set for Top Level Domains TLDs. According to the advisory, curl's "cookie parser has no Public Suffix awareness", but it will "reject TLDs from being allowed". However, a cookie can still be set for a TLD + trailing dot. A trailing dot...
Acronis: IDOR vulnerability (Price manipulation)
Target: acronis.cz Step to Reproduce 1.Go to acronis.cz 2.buy any product in this case i am going to buy this https://www.acronis.cz/produkt/acronis-cyber-protect-home-office/ for test 3.fill up details 4.go to burpsuite turn on intercept 5.click on buy now 6.check request in intercept change pri...
UPchieve: Business logic error
Hi UPCHIEVE SECURITY TEAM I'm Anto Vulnerability : Business logic error There is no password verification while changing a password. Steps to Reproduce : 1. Go to https://hackers.upchieve.org/resetpassword. 2. Click the change password. 3. If your old password was ex: hacker and in new password...
Basecamp: Login session not expire
@blackbibin reported that after signing in, you could go back in the browser and the login info would still be populated. We've ensured the login page is reloaded in this case...
U.S. Dept Of Defense: [CVE-2021-29156 on ForgeRock OpenAm] LDAP Injection in Webfinger Protocol!
Description: https://████████ is vulnerable to CVE-2021-29156. References https://nvd.nist.gov/vuln/detail/CVE-2021-29156 https://portswigger.net/research/hidden-oauth-attack-vectors...
GitLab: Stored DOM XSS via Mermaid chart
Prologue Gitlab supports Mermaid as part of GFM to allow users to generate diagrams and flowcharts from text. In version 8.6.0, Mermaid added a support of directives to add more control over stylesthemes applied to the diagrams. You can read more about how this works here:...
Revive Adserver: Reflected XSS on /admin/userlog-index.php
I found a reflected XSS attack on /admin/userlog-index.php. Revive-Adserver version is revive-adserver-5.1.0. - Go to...
CS Money: Able to upload backgrounds before entering 2FA
Summary: Hi Team, I am able to see and use uploaded backgrounds and able to upload new ones without proper authentication of 2FA. I hope you remember this report 993786. Steps To Reproduce: 1. Login with a steam account and enable 2FA. 1. Now logout your account. Clear all the cookies. 1. Now aga...
Stripo Inc: Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo
Summary: Can you imagine discovering an API key disclosure vulnerability in a disclosed API key disclosure report? The same thing is what I came across while going through the disclosed reports at Stripo Inc. Plus, the disclosed API key isn't even revoked, and therefore I am still able to use the...
Internet Bug Bounty: Some build dependencies are downloaded over an insecure channel (without subsequent integrity checks)
Summary: Build jobs mingw64 | openssl-1.1.1d and mingw32 | openssl-1.0.2u download dependencies from build.openvpn.net and www.oberhumer.comover an insecure channel http, not https and do not check their integrity in any way. This opens the door to person-in-the-middle attacks, whereby an attacke...
Basecamp: Possible DOM XSS on app.hey.com
Summary: Hello Team, While testing it was observed that on https://app.hey.com/, on Search box there is a possibility of XSS. Although the payload is reflected in the DOM but the CSP blocks the execution of the script, the XSS can happen if the CSP is somehow bypassed. The Subject parameter is...