Internet Bug Bounty: CVE-2023-28321: IDN wildcard match

CVE-2023-28321 is a vulnerability in curl that allowed for improper validation of certificates with host mismatch. The private wildcard matching function in curl could match IDN International Domain Name hosts incorrectly, potentially accepting patterns that should have mismatched. This issue was...

Reddit: api keys leaked

Summary: Disclosure of valid private keys may lead to unauthorized access to any systems that use them for authentication. Verify whether any keys disclosed are actually valid, and whether their disclosure within the application is appropriate Impact: Disclosure of valid private keys may lead to...

Internet Bug Bounty: CVE-2022-32215 - HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding

Original Report: https://hackerone.com/reports/1501679 Impact Depending on the specific web application, HRS can lead to cache poisoning, bypassing of security layers, stealing of credentials and so on...

U.S. Dept Of Defense: ██████████ vulnerable to CVE-2022-22954

I found that one of the targets belongs to DOD vulnerable to CVE-2022-22954 where an attacker may be able to execute any malicious code like escalating Remote code execution is also possible Technical Summary: CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspac...

U.S. Dept Of Defense: XSS DUE TO CVE-2020-3580

Hello Team, During my research, I found the following host to be vulnerable to CVE 2020-3580 which is POST BASED XSS. Vulnerable URL: https://█████/+CSCOE+/saml/sp/acs?tgname=a Impact Attackers can steal cookies and even takeover accounts and perform different malicious activities. System Hosts █...

Sifchain: Email spoofing

Email spoofing is possible To verify: visit :https://www.kitterman.com/spf/validate.html? and type your domain name to check SPF record you can see the results as: NO valid SPF record found POC: 1.visit http://emkei.cz// 2.fill the from email as [email protected] 3.to email as victim email...

h1-ctf: It's just a man on a mission

Preface --------------------- Like any other good stories, this adventure has also begun with a few long days of preparation leading up to the start of the challenge. Tools were sharpened, command lines were dusted-off and one-too-many cups of coffee were consumed. The morale was high and the...

VK.com: XSS in vk.link

XSS на vk.link...

GitHub Security Lab: Java (Maven): Actually fix the use of insecure protocol to download/upload artifacts

This bug was reported directly to GitHub Security Lab...

Mail.ru: source code leak

A fragment of source code was available for download on flash.terrhq.ru...

Souq.com: reflected xss on search bar (uae.souq.com)

the xss is executed in android phone or you can download user-agent switcher for google chrome then click Current: Android Handset to reproduce this bug as you see in pic 2.PNG steps: 1 go to http://uae.souq.com 2 put this payload on search bar : xss'+alert1+' 3the payload xss is executed 4 this...

Internet Bug Bounty: CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()

CVE-2024-42005: Potential SQL injection in QuerySet.values and valueslist A vulnerability was discovered in Django where the QuerySet.values and valueslist methods on models with a JSONField were subject to SQL injection in column aliases via a crafted JSON object key as a passed argument...

Internet Bug Bounty: Permissions policies can be bypassed via Module._load and require.extensions (High) (CVE-2023-30587)

A vulnerability in the experimental permissions policy mechanism in Node.js was reported. The use of Module.load could bypass the policy and require unauthorized modules. This affected all active release lines. The vulnerability was reported by a researcher and fixed by the Node.js security team...

Nextcloud: Missing brute force protection for passwords of password protected share links

A missing brute force protection vulnerability was found in the password protection feature of shared files, allowing an attacker to bypass the password protection of the shared files due to the lack of rate limit. This could lead to unauthorized access to protected files...

Internet Bug Bounty: Leak of sensitive values to Airflow rendered template

I’m just getting started with Airflow, but seem to have got into a situation where sensitive values e.g. connection passwords end up in my task’s rendered template. Here’s how my DAG starts, having set up a connection called “secret” with a password specified: t1 = BashOperator...

Reddit: sensitive data exposure

Summary: A Password hash entry was found in /etc/passwd. This is a major vulnerability since /etc/passwd is a world-readable file by default. Once the password hash is found, an attacker may extract the password using a program like crack. Impact: it is high impact vulnerability .once hacker foun...

Rocket.Chat: Rocket.Chat Server RCE

Vulnerability description not provided...

U.S. Dept Of Defense: Reflected XSS - https://███

Greetings, I just found an XSS vulnerability on a page of one of your websites URL : https://████=%22%3E%3Cscript%3Ealert1%3C/script%3E https://███="alert1 By the way, could you look at my "duplicated" report when it is not? I don't mean any disrespect, but this is not the same page. thank you -...

GitHub Security Lab: [Java]: CWE-502 Add UnsafeDeserialization sinks

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java] CWE-094: Query to detect Groovy Code Injections

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: porcupiney.hairs : Java/Android - Insecure Loading of a Dex File

This bug was reported directly to GitHub Security Lab...

Algolia: PHP-FPM status page disclosure

A page leaking debug information was publicly accessible...

Logitech: Moderator user has access to owner's support portal and tickets

Summary: Hi there, In https://streamlabs.com, there's a function where users can share his account to other users to manage their dashboard via following link. https://streamlabs.com/dashboard/settings/shared-access. In shared-access setting, user can invite other user with two roles Moderator an...

VK.com: Обход приватности у фотографий/документов

Просмотр некоторых фотографий и документов через вики-страницы. Интересный баг в wiki-страницах позволял достать почти любую приватную фотографию и любой приватный документ...

New Relic: "Basic user" which can only access a limited subset of the platform can access certain pages which are restricted to the user by the account owner.

@jhimansh described an issue where forced browsing could be used to visit restricted pages as an unprivileged user. As our web application is shipped as client side JavaScript, there is no way to prevent viewing all pages within that code. However, checks are done server-side to ensure that...

Topcoder: CSRF on https://apps.topcoder.com/wiki/users/editmyprofile.action

Summary: Hi : There is a CSRF on changing user details. Steps To Reproduce: There is no CSRF token or anything like that on https://apps.topcoder.com/wiki/users/editmyprofile.action . I added the poc html file below. When someone opens this html file, or we can add it into our website, victim's...

Stripo Inc: Clickjacking on my.stripo.email for MailChimp credentials

Clickjacking is a malicious hacking technique where attackers can acquire sensitive data. Through simple social engineering techniques these links can be sent out to unsuspecting customers to steal their credentials or perform actions on their accounts. For this example I saw that where I goto...

Imgur: De-anonymization Attack: Cross Site Information Leakage

Dear Imgur Security Team, We are researchers at the IMDEA Software Institute in Madrid, Spain. We have been working on analyzing Cross-Site Browser Leaks xsleaks and building a tool for finding instances of it on target web sites. Recently we tested imgur.com and discovered a flaw that can affect...

QIWI: какой-то исходный код в корне сайта

Можно было просматривать часть исходных файлов хоста. Нашел этот файл, в нем PHP код. adminer.php.swp F607459 https://shop.tochka.com/%2eadminer%2ephp%2eswp...

PortSwigger Web Security: Clicking "http://burp" hyperlink on FireFox CA Installation guide redirects to "burp.com" (unclaimed website).

Executive Summary --------------------------------------------------- I was in the process of installing Burp suite community edition on my recent machine where I believe I stumbled across a potential open redirect issue on the CA certificate installation website. This is a security concern due t...

U.S. Dept Of Defense: Root Remote Code Execution on https://███

Summary: Atlassian Crowd is a centralized identity management application that allows companies to "Manage users from multiple directories - Active Directory, LDAP, OpenLDAP or Microsoft Azure AD - and control application authentication permissions in one single location." A DOD installation is...

Imgur: Stored XSS on imgur profile

Hello, I submitted a report on imgur, but the staff marked it as duplicate. 482841 I reviewed the report of the first submitted report. 381553 We are on the same situation and his case is already fixed because I tried visiting his site too which is https://12test.imgur.com/ and even redoing his...

RATELIMITED: HTTP PUT method enabled

Hi security team, Summary: It is possible to upload files to the server using the PUT method Steps To Reproduce: I used the following request: PUT /emitrani.txt HTTP/1.1 Host: ratelimited.me Content-Length: 10 Connection: close Now a file exists at https://ratelimited.me/emitrani.txt with content...

Chaturbate: [chaturbate.com] - CSRF Vulnerability on image upload

Summary Hi guys, One of the features available to a Chaturbate user is the ability to upload images into photo sets. The upload functionality does not use any CSRF tokens, allowing attackers to perform CSRF attacks and upload images to a user's profile without the user's consent. Steps To...

Node.js third-party modules: `sshpk` is vulnerable to ReDoS when parsing crafted invalid public keys

I would like to report a ReDoS in sshpk It allows to cause Denial of Service by trying to parse a crafted public key. Module module name: sshpk version: 1.13.1 npm page: https://www.npmjs.com/package/sshpk Module Description Parse, convert, fingerprint and use SSH keys both public and private in...

Node.js third-party modules: [mcstatic] Path Traversal allows to read content of arbitrary files

Hi Guys, There is Path Traversal in mcstatic module. It allows to read content of arbitrary files on the remote server. Module mcstatic This is a general file server made by nodejs. It will be easy for you to access the files on the server through the browser. https://www.npmjs.com/package/mcstat...

Pornhub: Reflected XSS in login redirection module

The researcher discovered an XSS in the redirect parameter of the front controller which executes upon redirection...

LocalTapiola: SQL Injection on /webApp/omatalousuk (viestinta.lahitapiola.fi)

I would like to report a SQL Injection vulnerability on viestinta.lahitapiola.fi Vulnerable Request: GET /webApp/omatalousuk?email=aaaaa HTTP/1.1 Host: viestinta.lahitapiola.fi User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.12; rv:49.0 Gecko/20100101 Firefox/49.0 Accept: text/html, /; q=0.0...

Imgur: XSS via React element spoofing

Hello, I noticed an XSS on imgur. Proof of concept: visit the URL http://imgur.com/vidgif/ticket/aaaaaaaa?errorpropsdangerouslySetInnerHTMLhtml=%3Cimg%20src=a%20onerror=%22alert%27XSS%20on%20%27%2bdocument.domain%22%3E&errorisReactElement=true&errortype=body It's not the simplest case as it...

Snapchat: Subdomain takeover in http://support.scan.me pointing to Zendesk (a Snapchat acquisition)

harrymg helped us identify an issue in which support.scan.me's CNAME was pointing to scan.zendesk.com. Normally there would be a Zendesk instance there, but in this case, the Zendesk instance was no longer in use. As such, harrymg was able to "claim" scan.zendesk.com from Zendesk. As such, any...

Internet Bug Bounty: Adobe Flash Player Out-of-Bound Access Vulnerability

I. Summary Adobe Flash Player is prone to a vulnerability which leads to Out-of-Bound memory access memory via carefully crafted regular expression. An attacker can exploit this issue to defeat ASLR protection or even execute arbitrary code in the context of affected application Internet Explorer...

Internet Bug Bounty: mod_lua: Crash in websockets PING handling

A stack recursion crash in the modlua module was found. A Lua script executing the r:wsupgrade function could crash the process if a malicious client sent a carefully crafted PING request. This issue affected releases 2.4.7 through 2.4.12 inclusive...

curl: libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms

Summary: libcurl omits the IPv6 zoneid component from multiple security-sensitive host identity decisions even though the connection layer still routes by zoneid. As a result, two distinct scoped/link-local destinations such as fe80::X%zoneA and fe80::X%zoneB are treated as the same host by...

PortSwigger Web Security: [portswigger.net] Path Traversal al /cms/audioitems

Vulnerability description not provided...

Ruby: DoS in bigdecimal's sqrt function due to miscalculation of loop iterations

Vulnerability description not provided...

pixiv: Stealing Users OAuth authorization code via redirect_uri

A path traversal vulnerability in the OAuth redirecturi parameter allowed attackers to redirect authenticated users to their product page with their OAuth credentials, potentially leading to account takeover. This could occur due to the leakage of the user's authorization code via the query strin...

curl: CVE-2023-23914: curl HSTS ignored on multiple requests

A vulnerability was found in curl tool's HSTS feature, where it failed to work correctly when multiple requests were made within a single invocation, resulting in requests being performed over insecure channels, potentially leading to loss of confidentiality and integrity...

Internet Bug Bounty: CVE-2022-32206: HTTP compression denial of service

curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited...

MTN Group: firebase credentials leaks @ https://mtnhottseat.mtn.com.gh

Hello. I found firebase credentials leaks at https://mtnhottseat.mtn.com.gh. Steps To Reproduce: Visit https://mtnhottseat.mtn.com.gh Right click view source code. Supporting Material/References: // Your web app's Firebase configuration // For Firebase JS SDK v7.20.0 and later, measurementId is...

Brave Software: Information disclosure

Vulnerability tested on:- Brave 1.29.81 Chromium: 93.0.4577.82 Official Build 64-bit Vulnerability description:- For security measures and for privacy purposes, Brave has the ability to open a normal tab of the Brave when we navigate to: chrome://wallet, chrome://history etc. due to the reason th...