Node.js third-party modules: [devcert] Command Injection via insecure command formatting

I would like to report a Command Injection issue in the devcert module. It allows to execute arbitrary commands on the victim's PC. Module module name: devcert version: 1.1.0 npm page: https://www.npmjs.com/package/devcert Module Description devcert - Development SSL made easy Module Stats 276,46...

GitLab: Email notification about login email changed is not received when using verified linked email address

Summary In https://gitlab.com/profile, user can update the email id to use for login to gitlab account using field "Email". Usually, when this login email id is updated, there will be 2 email sent on previous email Id with subjects as. Email 1 - Email Changed:- This tell that login email has been...

Mail.ru: [API] ICQ user's avatar can be manipulated remotely

Description: При обращении к API методу установки аватара пользователя https://ub.icq.net/files/api/v1.1/avatar/set Можно передать дополнительный GET параметр: targetSn - с установленным UIN'ом любого пользователя Тем самым можем изменить аватарку у любого пользователя Steps To Reproduce: 1...

Stripo Inc: Redirection through referer tag

Summary: I replaced the referer value https://stripo.email/de/ with www.google.com and it worked, it redirected me to google.com Steps To Reproduce: 1. Open URL https://stripo.email/de/subscribe/ 2. Intercept with BurpSuite 3. Change the parameter value of referer and insert any domain you want i...

Mail.ru: XSS via Cookie in Mail.ru

Unfiltered cookie content was used in DOM manipulation, leading to XSS possibility...

HackerOne: Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible

Summary: It appears I'm able to discover words used in limited disclosed reports, that are not publicly visible, by using the search function available from the Hactivity page. Description: Recently I was investigating a finding for another program which involved exploiting XSS ████. I wondered h...

Homebrew: Homebrew privilege escalation vulnerability

Additional symlinks/directories that were not chownd by brew services needed to be added to avoid the replacement of the opt prefix link. Homebrew has a privilege escalation vulnerability which can cause an attacker easily gain root permission...

Internet Bug Bounty: buffer overread in base64 code of the xmlrpc module

Malformed input to the xmlrpcdecode function can cause an out of bounds read in the base64 code. This is fixed in the latest updates of PHP 7.3.1 etc. Report: https://bugs.php.net/bug.php?id=77380 Impact If the attacker has access to the decoded output this may leak memory contents...

WakaTime: password token validation

Hello, when I reset password all tokens are valid can be used, should keep valid only token in the last request or you can invalidate all reset links after using one of the requests successfully. Steps: 1 go to the password reset page and request more than one request. 2 go to your email and use...

Nextcloud: Shared file link - password protection bypass under certain conditions

Summary An unauthenticated remote attacker can bypass password protection on certain shared file types through the file sharing app's publicpreview.php function. Vulnerable URL http://server/nextcloud/index.php/apps/filessharing/ajax/publicpreview.php?x=width&y=height&t=share ID Description...

Zendesk: Chat History CSV Export Excel Injection Vulnerability

I have found a vulnerability in the Chat History export function. If an attacker submits a special name containing a system command when chatting with an agent and that agent later exports the history of that chat to CSV, the resulting CSV may execute commands when opened. I have tested this usin...

Shopify: customers password hash leak!!!!

An endpoint in the Draft Order feature would return a serialized version of the Customer that contained the account password hashed and salted as well as the last password reset token when available...

ok.ru: http://217.20.144.201 privilege escalation in apache tomcat SessionEample-script

Tomcat Servlet Examples application was accessible at wmf.ok.ru which leaved ok.ru vulnerable to cookie manipulation http://lab.onsec.ru/2013/03/tomcat-servlet-examples-threats.html and whatever else vulnerability Servlet Examples might contain...

Internet Bug Bounty: mod_proxy_fcgi buffer overflow

This issue was reported directly to the Apache team. A buffer overflow was found in modproxyfcgi. A malicious FastCGI server could send a carefully crafted response which could lead to a heap buffer overflow. http://httpd.apache.org/security/vulnerabilities24.html2.4.11-dev...

Internet Bug Bounty: Same Origin Security Bypass Vulnerability

This bug was reported directly to Adobe. http://helpx.adobe.com/security/products/flash-player/apsb14-08.html...

Rocket.Chat: Unauthenticated reading of every file via livechat auth and predicting MongoDB ObjectId()

Vulnerability description not provided...

HackerOne: Improper Authentication - 2FA OTP Reusable

Vulnerability description not provided...

Internet Bug Bounty: curl cookie mixed case PSL bypass

A vulnerability in curl allowed a malicious HTTP server to set "super cookies" that bypassed the Public Suffix List check, enabling cookies to be sent to unrelated sites and domains...

Internet Bug Bounty: CVE-2023-40273: Session fixation in Apache Airflow web interface

A session fixation vulnerability was discovered in Apache Airflow web interface. This vulnerability allowed an authenticated user to continue accessing the webserver even after their password had been reset by the admin. The issue has been addressed in version 2.7.0 of Apache Airflow...

HackerOne: Support Tickets can be created on behalf of other users using spoofed email | Bypass of #2001913

A vulnerability allowed an attacker to create support tickets on behalf of other users by sending a fake email to [email protected]. This bypassed a previous fix implemented by HackerOne to prevent support tickets from being created via email...

8x8: Credential leak on GitHub: https://github.com/█/█/ (Peoplesoft CRM)

Credentials for a database associated with Peoplesoft CRM were leaked on GitHub. The leak was reported and the repository containing the credentials was taken down. The credentials were associated with a database that is no longer in use...

U.S. Dept Of Defense: Sensitive Data Exposure via wp-config.php file

Sensitive data exposure occurred via the wp-config.php file, which contained confidential information such as MySQL and AWS credentials and various keys. The vulnerability was found on a specific endpoint, and it could potentially provide unauthorized access to sensitive information to users who ...

U.S. Dept Of Defense: DoS at █████(CVE-2018-6389)

A vulnerability in WordPress allowed unauthenticated attackers to launch a denial of service attack by listing a large number of registered .js files from wp-includes/script-loader.php. The vulnerability was assigned CVE-2018-6389. Attackers could use this function to deplete server resources and...

Sorare: Mystery with a leaked token and Reusability of email confirmation link leading to Account Takeover

A vulnerability was discovered where leaked email confirmation links could be reused to gain access to a user's account without requiring a password. This was possible by modifying the token parameter in the URL of the expired confirmation link. An attacker who gains access to such a leaked link...

curl: CVE-2022-32221: POST following PUT confusion

Summary: The bug I submitted at https://github.com/curl/curl/issues/9507 can have at least a few unintended security issues: - Information Disclosure: this bug causes an HTTP PUT to occur when the user intends for an HTTP POST to occur. The user, who intended an HTTP POST, expects the POSTed...

GlassWire: Facebook App API credentials leaked in the APK

Facebook App API credentials were leaked in the GlassWire version 1,1,26,0b F1827380 APK file, including the App ID and App Secret. This could allow an attacker to modify Facebook App settings using the leaked token...

Phabricator: Possible to make restricted files public on Phabricator via Diffusion

Files on Phabricator are always viewable to a user if they are attached to an object that they can view. It seems Phabricator does check if you can view a file before allowing you to a attach it. If you don't have access to the file, it will just look like this F99999999999 in plaintext. It seems...

GitHub Security Lab: [Java]: CWE-665 Insecure environment during RMI/JMX Server initialisation - All for one bounty

This bug was reported directly to GitHub Security Lab...

Mail.ru: HTML/iframe/XSS injection on https://www.ucs.ru/online/shelter/settings/check/

Potential XSS via POST parameters in www.ucs.ru...

Courier: Missing rate limit in signup Form

Hello Team , Description When signing up for an account, you enter your email. When this email is already in use, the server responds with "UserConfirmed":true,"UserSub":"ae294fff-6d55-407d-9676-1f3518029037" This in not a problem, but the fact that you could send this request unlimited times is...

RGhost: Idor on the DELETE /comments/

Summary: Idor on /comments Steps To Reproduce: Make sure you have 2 different ID's to maintain 2 different session for ensurity 1. The request can be tamper with the ID of different comment both the functions of edit/delete can be used 2. Delete gets hampered with the Captcha which is thrown but...

Internet Bug Bounty: DirectoryIterator class silently truncates after a null byte

The bug submitted at: https://bugs.php.net/bug.php?id=78863 The security advisory at: https://nvd.nist.gov/vuln/detail/CVE-2019-11045 There's an issue with SPL PHP extension on splfilesystemobjectconstruct function. When creating a new DirectoryIterator object splfilesystemobjectconstruct functio...

Monero: Monero wallet password change is confirmed when not matching

Summary: If you change your wallet password in gui, the confirmation does not need to match the new password. Releases Affected: list each version and OS of the application affected list each version and OS of the application affected Steps To Reproduce: Open your wallet. Go to settings. Change...

Razer: AWS subdomain Takeover at estore.razersynapse.com

The tester discovered the razersynapse.com domain was vulnerable to a subdomain takeover. Although this is out of scope of our program, we appreciate the tester bringing this to our attention...

Stripo Inc: my.stripo.emai email verification bypassed and also create email templates

Summary: According to the Stripo.emai When the new user sign up Stripo.email allow to create email templates after the verification of the email of Your stripo account. Until your email get verified You are not able to create a email templates in your acc. User need to verified their email...

Razer: [razer-assets2] Listing of Amazon S3 Bucket accessible to any AWS cli

The tester determined that an S3 bucket had insecure permissions. No customer data was in danger, but thee was the potential for some Razer product collateral to be prematurely leaked, so Razer secured this bucket out of caution. Full writeup over at...

Kartpay: bypass captcha in the form forgot password

Summary: In this issue I can bypass Captcha Protection in the Forgot Password form. Browsers Verified In: firefox url: https://affiliate.kartpay.com/ url vulnerable: https://affiliate.kartpay.com/forgotpassword Steps To Reproduce: 1-Enter your email in the forgot password parameter. 2-complet...

U.S. Dept Of Defense: WebLogic Server Side Request Forgery

Universal Description Discovery and Integration UDDI application is publicly available on this WebLogic server. The SearchPublicRegistries.jsp page can be abused by unauthenticated attackers to cause the WebLogic web server to connect to an arbitrary TCP port of an arbitrary host. Responses...

HackerOne: Homograph fix Bypass

Hello Hackerone! I have possibly found a way to bypass your current Homograph Attack Fix. Lets look at two HACKERONE Redirect URL: CASE 1: https://hackerone.com/redirect?signature=829727b4188c43dcf394fd841fd19a8b7f391bd1&url=https%3A%2F%2Fwww.yelp.com%2F Got the above link generated by posting...

Internet Bug Bounty: OCSP Status Request extension unbounded memory growth (CVE-2016-6304)

A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service...

Boozt Fashion AB: Application code is not obfuscated -- OWASP M9 (2016)

Description : Boost android app is not obfuscated which lead to view the source code of the app. Impact : Attackers can steal code and reuse it or sell it to create new application or create a malicious fake application based on the initial one. POC : Step 1 : First, I did the basic reverse...

Imgur: SSRF / Local file enumeration / DoS due to improper handling of certain file formats by ffmpeg

Hello! Short description ======== https://imgur.com/vidgif/upload endpoint is vulnerable to a SSRF/LFE vulnerability which allows an attacker to craft connections originating from imgur servers to any destination on the internet and imgur internal network and disclose lists of files located on...

Imgur: Big Bug in SSL : breach compression attack (CVE-2013-3587) affect imgur.com

Hi imgur Security Team, This is an urgent issue and wish you fix it as soon as possible ... so this web application " imgur.com " " is potentially vulnerable to the BREACH attack. An attacker with the ability to: Inject partial chosen plaintext into a victim's requests Measure the size of encrypt...

Internet Bug Bounty: Null pointer dereference in phar_get_fp_offset()

https://bugs.php.net/bug.php?id=69720...

Nextcloud: Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com

Security researchers discovered a vulnerability in the Secure Shell SSH cryptographic network protocol, known as Terrapin CVE-2023-48795. This vulnerability could have allowed an attacker to downgrade the security of the secure channel. Weak SSH algorithms were also identified on various subdomai...

Teleport: Improper session management - Failure to invalidate old session after password change

Failure to Invalidate Session on Password Change Failure to invalidate a session after a password change is a vulnerability which allows an attacker to maintain access on a service. Most users have the expectation that when they reset their password, no one else can access their account. When...

Internet Bug Bounty: CVE-2023-27534: SFTP path ~ resolving discrepancy

A vulnerability was discovered in curl's SFTP implementation that allowed the tilde character to be used as a prefix in the first element of a path, resulting in the wrong path being accessed. This could be exploited to circumvent filtering or other security measures. The vulnerability was presen...

Automattic: Stored XSS on app.crowdsignal.com your-subdomain.crowdsignal.net via Thank You Header

A stored XSS vulnerability was found on app.crowdsignal.com, allowing an attacker to execute arbitrary JavaScript code on the victim's browser. The vulnerability could be triggered by editing the Thank You Header with a malicious payload and could result in the compromise of sensitive user...

Internet Bug Bounty: Read beyond bounds via ap_rwrite() [zhbug_httpd_47.2]

Greetings. I have found that aprwrite /server/protocol.c can cause a read beyond bounds with the extra data sent to an attacker. The bug is that aprwrite passes its |int nbyte| argument to bufferoutput, where bufferoutput's corresponding |len| argument isa |aprsizet|. Thus, a negative |nbyte| val...

UPchieve: CLICKJACKING LEADS TO DEACTIVATE ACCOUNT

Hello UPCHEIVE SECURITY TEAM, I'm Anto Vulnerability : Clickjacking in https://hackers.upchieve.org/profile Steps to Reproduce: 1. Create a HTML file with following code Click the place where its shows Click 1 Click 2 Click 2 2, Save and Open it on your browser the page will be appear. Impact An...