Nextcloud: Shared file link - password protection bypass under certain conditions

Summary An unauthenticated remote attacker can bypass password protection on certain shared file types through the file sharing app's publicpreview.php function. Vulnerable URL http://server/nextcloud/index.php/apps/filessharing/ajax/publicpreview.php?x=width&y=height&t=share ID Description...

Internet Bug Bounty: OCSP Status Request extension unbounded memory growth (CVE-2016-6304)

A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service...

X (Formerly Twitter): Stealing User emails by clickjacking cards.twitter.com/xxx/xxx

Hello In twitter you can create cards to generate leads. For example: https://twitter.com/i/cards/tfw/v1/759046372544741376?cardname=promotion&autoplaydisabled=true&earned=true&lang=en&cardheight=357 If you visit the above URL and click the button your email and username is sent to my domain. Sin...

Internet Bug Bounty: mod_proxy_fcgi buffer overflow

This issue was reported directly to the Apache team. A buffer overflow was found in modproxyfcgi. A malicious FastCGI server could send a carefully crafted response which could lead to a heap buffer overflow. http://httpd.apache.org/security/vulnerabilities24.html2.4.11-dev...

Bykea: IDOR on in-app hardcoded zombie endpoint

The researcher discovered an Insecure Direct Object Reference IDOR vulnerability in a hardcoded legacy zombie endpoint that was no longer actively used but remained accessible. By reverse engineering the Android app and reviewing the code for unused endpoints, the sensitive details related to...

Internet Bug Bounty: CVE-2024-34750 Apache Tomcat DoS vulnerability in HTTP/2 connector

CVE-2024-34750: Apache Tomcat Denial of Service Vulnerability A vulnerability was discovered in Apache Tomcat versions between 11.0.0-M1 and 11.0.0-M20, 10.1.0-M1 and 10.1.24, and 9.0.0-M1 and 9.0.89. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers...

Nextcloud: Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com

Security researchers discovered a vulnerability in the Secure Shell SSH cryptographic network protocol, known as Terrapin CVE-2023-48795. This vulnerability could have allowed an attacker to downgrade the security of the secure channel. Weak SSH algorithms were also identified on various subdomai...

Internet Bug Bounty: CVE-2023-40273: Session fixation in Apache Airflow web interface

A session fixation vulnerability was discovered in Apache Airflow web interface. This vulnerability allowed an authenticated user to continue accessing the webserver even after their password had been reset by the admin. The issue has been addressed in version 2.7.0 of Apache Airflow...

UPchieve: hackers.upchieve.org and argocd.upchieve.org is not preloaded.

POC video : IMG7790.MP4 Vulnerable URLs : https://hstspreload.org/?domain=argocd.upchieve.org and https://hstspreload.org/?domain=hackers.upchieve.org Impact Security Misconfiguration...

U.S. Dept Of Defense: Remote Code Execution via Insecure Deserialization in Telerik UI (CVE-2019-18935)

Description: https://██████/██████████/Telerik.Web.UI.WebResource.axd?type=rau is vulnerable to CVE-2017-11317 and CVE-2019-18935, allowing an attacker to upload arbitrary files and gain remote code execution on the underlying system. References...

GitHub Security Lab: ihsinme: CPP Add query for CWE-14 compiler removal of code to clear buffers.

This bug was reported directly to GitHub Security Lab...

Revive Adserver: Reflected XSS on /admin/stats.php

I found a reflected XSS attack on /admin/stats.php. Revive-Adserver version is revive-adserver-5.1.0. - Go to...

Doppler VDP: Owner can change themself for another Role Mode but application doesnot have this function.

Hello team, I have found a Privilege escalation bug in your application. Basically your website doesn't allow owner to change role mode for themself, they only can able to change role mode of another user. But i found authorization bug in your application that if we add user id of themself in...

h1-ctf: Hackyholidays [ h1-ctf] writeup [mission:- stop the grinch ]

Hello Team Description In the continuous series of 12 days, twelve flags were hidden inside Hackyholidays site - hackyholidays.h1ctf.com in which once we get all the flags, grinch can be stopped. This write-up will describe solving all the 12 days challenges. Step To Reproduce + It all started wh...

U.S. Dept Of Defense: CVE 2020 14179 on jira instance

Summary: An remote attacker can view the custom sla fields used in the jira instance and also can use the sla fields to make a jql query. Impact Information disclosure of the custom sla fields, senstive information leakage throught he jql query parameter Read more about the impact here:...

VK.com: XSS в названии звонка

XSS в сниппете звонка. Уязвимость позволяла выполнить скрипт на стороне пользователя, позвонив ему...

HackerOne: Getting New Invitations without Leaving Programs

Hello there, I hope all is well! Description When you leave the private program, you get a chance to get a new invitation. But using this vulnerability, I can get new invitations without leaving private programs. Steps: 1. Go to any private bug bounty program. 2. Click Leave Program button 3. Cli...

Shopify: Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation

Hello Shopify, I have found a bug by which I can verify any email on .myshopify.com, the bug is very strange but it works. Also I can take over the accounts but only the ones which do not have SSO. To reproduce please follow the steps exactly as I written otherwise you will not be able to reprodu...

Courier: Missing rate limit in signup Form

Hello Team , Description When signing up for an account, you enter your email. When this email is already in use, the server responds with "UserConfirmed":true,"UserSub":"ae294fff-6d55-407d-9676-1f3518029037" This in not a problem, but the fact that you could send this request unlimited times is...

Starbucks: Cross-Site Scripting (XSS) on www.starbucks.com | .co.uk login pages

Hi team, Summary: There is a cross-site scripting vulnerability on the login page of www.starbucks.com and various regions, due to improper escaping on the URL path. Description: The login page at https://www.starbucks.com/account/signin builds several links by the relative URL path. An attacker...

Internet Bug Bounty: DirectoryIterator class silently truncates after a null byte

The bug submitted at: https://bugs.php.net/bug.php?id=78863 The security advisory at: https://nvd.nist.gov/vuln/detail/CVE-2019-11045 There's an issue with SPL PHP extension on splfilesystemobjectconstruct function. When creating a new DirectoryIterator object splfilesystemobjectconstruct functio...

Mail.ru: Reflected XSS on https://go.mail.ru/search?fr=mn&q=<payload>

Reflected XSS via GET arguments in go.mail.ru...

Node.js third-party modules: Path traversal using symlink

I would like to report Path Traversal in statics-server Module module name: statics-server version: 0.0.9 npm page: https://www.npmjs.com/package/statics-server Module Description npm install statics-server -g Go to the folder you want to statics-server Run the server statics-server Module Stats...

Paragon Initiative Enterprises: Github repo's wiki publicly editable

Hello Team, Primablock Github repo's wiki page is publicly editable. This enables an attacker to edit the wiki pages of the affected repo's. Adding content that may link to malicious code libraries that would be installed and used by developers or information that may mislead users. Links:...

Internet Bug Bounty: Client DoS due to large DH parameter (CVE-2018-0732)

https://www.openssl.org/news/secadv/20180612.txt OpenSSL Security Advisory 12 June 2018 ======================================== Client DoS due to large DH parameter CVE-2018-0732 ==================================================== Severity: Low During key agreement in a TLS handshake using a DH...

Snapchat: [render.bitstrips.com] Stored XSS via an incorrect avatar property value

While modifying an avatar, an attacker has the opportunity to submit XSS payloads as its property values. The resulting png file will return a 500 error with the payload in the response body. The response has a text/html content type, which makes the XSS attack possible. PoC: 1. Go to...

U.S. Dept Of Defense: Sensitive Data Exposure via wp-config.php file

Sensitive data exposure occurred via the wp-config.php file, which contained confidential information such as MySQL and AWS credentials and various keys. The vulnerability was found on a specific endpoint, and it could potentially provide unauthorized access to sensitive information to users who ...

GlassWire: Facebook App API credentials leaked in the APK

Facebook App API credentials were leaked in the GlassWire version 1,1,26,0b F1827380 APK file, including the App ID and App Secret. This could allow an attacker to modify Facebook App settings using the leaked token...

Cloudflare Public Bug Bounty: HTTP request smuggling with Origin Rules using newlines in the host_header action parameter

The hostheader action parameter available to rulesets in the Origin Rules API lacked sufficient input validation i.e., allowing CRLF characters. Because of this, it was possible to inject arbitrary headers and, as a consequence, smuggle HTTP requests. This vulnerability enabled bypassing security...

8x8: subdomain takeover (abandoned Zendesk █.easycontactnow.com)

@bx1 reported to us an issue with a CNAME record which pointed to a subdomain outside of 8x8's control - to an abandoned Zendesk instance. We've deleted the DNS record and rectified the issue...

HackerOne: Internal Gitlab Ticket Disclosure via External Slack Channels

@noneoftheabove was able to enumerate GitLab ticket titles and descriptions by posting links in a shared Slack channel. As part of HackerOne's investigation, it was determined that the misconfiguration could also be used to obtain the contents of exceptions from HackerOne's production environment...

Homebrew: clickjacking at brew.sh

hello , While performing security testing of your website i have found the vulnerability called Clickjacking. URL is in scope and vulnerable to Clickjacking. What is Clickjacking ? Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a...

Doppler VDP: Limited access to billing dashboard by Admin and Collaborator in conflict with user role permissions.

Summary: Hello Team, The admin and collaborator roles aren't supposed to be able to have read access to the billing dashboard. However, a bug was found where both roles have limited read access to the dashboard contrary to Doppler docs. F1151905 Steps To Reproduce: 1. Log in to your...

h1-ctf: [hacky-holidays] Grinch network is down

Flag 1 As always CTF begins with a tweet: F1126838 So we are supposed to start from https://hackyholidays.h1ctf.com/ . The first flag was easy on https://hackyholidays.h1ctf.com/ I found a file named robots.txt which had the following content: User-agent: Disallow: /s3cr3t-ar3a Flag:...

Dropcontact: Dropcontact's disclosed report is exposing Private/Confidential information

Some other report was disclosed fully with confidential information !...

Open-Xchange: Panic: Input stream data unexpectedly has references

Run test suite binary on following input ./testsuite crash.txt with crash.txt file being : require "vnd.dovecot.testsuite"; require "variables"; require "editheader"; set "message" text: From: [email protected] To: [email protected] Subject: Frop! Frop! . ; testset "message" "$message"; test...

Razer: [press.razer.com] Origin IP found, Cloudflare bypassed

The tester discovered that the press.razer.com site exposed its IP which could allow bypassing of anti-DDoS mechanisms. While minor, Razer does appreciate the report and the tester bringing this to our attention...

Razer: 2FA doesn't work in "https://insider.razer.com"

Hello, I found 2FA bypass vulnerability in https://insider.razer.com and I found this feature not at all working after enabled 2FA. Please follow the below steps to reproduce the issue Steps to reproduce 1. Login to https://insider.razer.com with your credentials. 2. Next, go to Two-Step...

Internet Bug Bounty: imagecolormatch Out Of Bounds Write on Heap

The link to the PHP bug: https://bugs.php.net/bug.php?id=77270 This is possible to exploit in PHP 7.0.33 and 5.6.39. I used this vulnerability to write a local safe mode bypass exploit. It is possible to write up to 1200 bytes over the boundaries of a buffer allocated in the imagecolormatch...

DuckDuckGo: SSRF on duckduckgo.com/iu/

Normally, a call to https://duckduckgo.com/iu contains a query parameter u with some path using the domain yimg.com. This call will succeed in most cases. F337121 And if we change that path to something like https://google.com it's rejected. F337118 However, it appears that the check that ensures...

Coinbase: Captcha Bypass in Coinbase SignUp Form

Vulnerability description: The g-recaptcha-response is not validated on the server-side when submitting a Signup form to the endpoint. Any or no value can be provided for this header Step to reproduce: 1. https://www.coinbase.com/signup 2. Fill the input field and Validate the captcha. 3. Trun on...

WakaTime: Missing Account Deletion Notification

Currently, there is no email notification sent out when the account was deleted. I understand it asks for the password to delete but when an attacker somehow get's the credentials, he can only 'read' users data without alarming the user. It would stop him if he knows the user would come to know...

WakaTime: Session Not Expired On Logout

Hi Wakatime Security Team, There is a session management vulnerability in your website. i.e. user's session is not expiring immediately after the logout. You can get more information of the vulnerability here -...

ok.ru: [insideok.ru] Database Dump

http://insideok.ru/db.sql Внутри - учётки админов на 2016 год. -- Хост: localhost -- Время создания: Сен 03 2016 г., 12:00 -- Версия сервера: 5.5.47-cll-lve -- Версия PHP: 5.4.45 Структура таблицы users CREATE TABLE IF NOT EXISTS users id int11 unsigned NOT NULL, █████ ███████ ███████ ██████████...

HackerOne: Null byte injection

Hi , I would like to report an issue that I have noticed in https://hackerone.com/users/signin?invitationtoken= . I am not sure if this is a valid security issue , but I have decided to report it anyway and see what you guys think. Details: - When you go to...

Uzbey: CMS Information Disclosure

Hi, I noticed that the CHANGELOG.txt disclose Drupal vesion. It might help an attacker to perform information gathering and help an attacker to find the vulnerabilties from the version. PoC: https://staging.uzbey.com/CHANGELOG.txt...

Internet Bug Bounty: important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)

The Apache HTTP Server on Windows contained a SSRF vulnerability CVE-2024-38472 that allowed potential leakage of NTLM hashes to a malicious server. The vulnerability was reported through the official Apache HTTP Server security email on April 1, 2024 and was fixed in version 2.4.60 released on...

Internet Bug Bounty: CVE-2023-27533: TELNET option IAC injection

A vulnerability CVE-2023-27533 was found in curl versions 7.7 to 7.88.1 that allowed users to pass on user name and "telnet options" for server negotiation without proper input scrubbing, potentially allowing for the injection of unintended TELNET commands to the telnet connection. The severity o...

Sorare: Mystery with a leaked token and Reusability of email confirmation link leading to Account Takeover

A vulnerability was discovered where leaked email confirmation links could be reused to gain access to a user's account without requiring a password. This was possible by modifying the token parameter in the URL of the expired confirmation link. An attacker who gains access to such a leaked link...

Judge.me : Stored XSS in Email Templates via link

Summary: Stored cross-site scripting also known as second-order or persistent XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. FYI: I Install judge.me in Shopify E-Commerce Steps To Reproduce: 1. Go to...