HackerOne: Race condition in joining CTF group

Summary: A race condition in https://ctf.hacker101.com/group/join allows a user to join the same CTF group multiple times. The user will show up in the group member list multiple times, and affect the group statistics. Description: Interestingly a race condition in this feature was reported in...

U.S. Dept Of Defense: Sensitive information on ██████████

Hi team, i found a sensitive file hosted on '████' that i think must be not public accessible due to the wording "████████" Vulnerable Endpoint: https://██████ █████████ Regards Impact Sensitive information pubblicy accessible System Hosts ██████████ Affected Products and Versions CVE Numbers Ste...

GitHub Security Lab: [Java]: CWE-502 Add UnsafeDeserialization sinks

This bug was reported directly to GitHub Security Lab...

Ruby: 'net/http': HTTP Header Injection in the set_content_type method

The set\content\type's parameter is not filtered to prevent the injection from altering the entire request. The vulnerable code: ruby def setcontenttypetype, params = @header'content-type' = type + params.map|k,v|"; k=v".join'' end PoC 1. ruby require 'net/http' uri = URI'http://127.0.0.1:8080' r...

GitHub Security Lab: porcupiney.hairs : Java/Android - Insecure Loading of a Dex File

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java] CWE-759: Query to detect password hash without a salt

This bug was reported directly to GitHub Security Lab...

HackerOne: HackerOne Jira integration plugin Leaked JWT to unauthorized jira users

Summary: HackerOne provides an application tool HackerOne for Jira, an application that allows programs to track security issues through a jira instance. After testing the integration feature in the application, it was found that the application leads to the leakage of the JWT to unauthorized...

VK.com: Обход приватности у фотографий/документов

Просмотр некоторых фотографий и документов через вики-страницы. Интересный баг в wiki-страницах позволял достать почти любую приватную фотографию и любой приватный документ...

Mail.ru: Improper Restriction of Excessive Authentication Attempts at https://top.mail.ru/edit? for site counter (Rate Limit bypass via IP Rotation)

Password at top.mail.ru counters was not sufficiently protected against bruteforce...

CS Money: Blind XSS on image upload

Summary: - The CSRF vulnerability make a request for support.cs.money/uploadfile; This uploadfile does not have csrf token/ origin/ reference verification! - The XSS allows to execute JS. The payload of the XSS stay in the param 'filename' of the CSRF request. Steps To Reproduce: XSS - use a prox...

GitHub Security Lab: Golang : Improvements to Golang SSRF query

This bug was reported directly to GitHub Security Lab...

TikTok: Open Redirect Vulnerability on TikTok Ads Portal

An Open Redirect vulnerability was found that could expose the user session cookie potentially allowing an attacker to obtain access to an account on the TikTok ads portal...

Mail.ru: [capsula.mail.ru] overriding order info

IDOR vulnerability in order editing functionality of capsula.mail.ru allowed to override the incomplete unsubmitted order saved for later...

Mail.ru: vk.com profile page takeover on https://cabinet.am.ru/

Description Hi team, While exploring https://cabinet.am.ru/ domain I found this site points to some social media accounts, One of them was a vk.com profile as https://vk.com/amrusocial but when I opened that link it showed me a 404 error so I successfully could register an account on vk.com and...

Nord Security: Password Reset Link not expiring after changing the email Leads To Account Takeover

The researcher has identified an issue in our password reset workflow where the password reset URL was not expiring correctly after the user has requested a password change 1 Go to this website : https://ucp.nordvpn.com/lost-password 2 Enter your main account [email protected] 3 Go to [email protected]...

Razer: Reflected XSS at http://promotion.molthailand.com/index.php via promotion_id parameter

The tester discovered a reflected XSS vulnerability on https://easytopup.in.th related to a URL parameter. This issue affected the Firefox browser. Razer thanks the tester for the report and the clear proof of concept...

Mail.ru: OOB XXE

Limited XXE on XML request processing led to blind SSRF possibility OOB XXE on one of Ext. B Mail.ru domains, which could be exploited as blind SSRF...

Mail.ru: PHP-FPM Status Page

PHP-FPM status page was available at guild.live.ro.gmru.net...

Zomato: [www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive information

Summary: Cross Origin Resource Sharing Misconfiguration | Lead to sensitive information. Description: An HTML5 cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy ...

Hanno's projects: blind sql injection

Summary: There exists a possibility that your Serendipity installation is vulnerable to a blind sql injection. Description: By sending specially crafted SQL commands to /plugin/tag/ and timing how long it takes for the server to respond, it is quite possible that the blog backend is interepreting...

Ed: DOM XSS in edoverflow.com/tools/respond due to unsafe usage of the innerHTML property.

Hi, There's a DOM XSS vulnerability on edoverflow.com. This cannot be exploited without user-interaction so I had to make a clickjacking PoC to trick the user in triggering the payload her/himself. Reproduction Steps 1. Open the attached HTML document in FireFox. 2. Drag Frog 1 to the other two...

Node.js third-party modules: `sshpk` is vulnerable to ReDoS when parsing crafted invalid public keys

I would like to report a ReDoS in sshpk It allows to cause Denial of Service by trying to parse a crafted public key. Module module name: sshpk version: 1.13.1 npm page: https://www.npmjs.com/package/sshpk Module Description Parse, convert, fingerprint and use SSH keys both public and private in...

Node.js third-party modules: Prototype pollution attack (merge-objects)

As discussed in 309391, here's the separate report for each of the library. This one is the information for the merge-objects library. Module: merge-object Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part ...

Internet Bug Bounty: Potential infinite loop in gdImageCreateFromGifCtx!

Description ----- It is easy to trigger in web application if the web use GD as its image library. For example, It can be triggered if a website resize the user-uploaded GIF, and ALL PHP version are affected! Original bug report ----- - https://bugs.php.net/bug.php?id=75571 Note ----- -...

Ubiquiti Inc.: Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.com

The researcher found a Local File inclusion vulnerability, this could be exploited by using Twig templates available on the system. This vulnerability only have the potential to affect dev-ucrm-billing-demo.ubnt.com, although is limited by the restricted environment docker with don't allow any...

Valve: MySQL username and password leaked in developer.valvesoftware.com via source code dislosure

Hey there it looks like you are relying on a script that cleans up your backup process on developer.valvesoftware.com: /scripts/finalcleanup.sh: Remove files post cleanup rm -r $SITEPATH/data rm $SITEPATH/.sql rm $SITEPATH/.sql.gz rm $SITEPATH/.tgz rm $SITEPATH/.tar.gz rm $SITEPATH/.log rm -r...

WordPress: Information / sensitive data disclosure on some endpoints

Hello team! While doing a preliminary recon on .wordpress.org I've come across a few sensitive files that should not be facing the public web; I'll leave you a list organized by criticality and some proof. High priority .travis.yml configuration file with credentials php maintenance/install.php...

Zomato: Amazon S3 bucket misconfiguration (share)

Hi, Description I have discovered one of your Amazon S3 bucket and tested it via the AWS command line tool on Linux. It looks like permissions are not well configured and allow dangerous actions to everyone. The vulnerable bucket is: zomato-share PoC: aws s3 ls s3://zomato-share aws s3 cp test...

Nextcloud: Calendar and addressbook names disclosed (NC-SA-2017-012)

Calendar and addressbook names disclosed NC-SA-2017-012 Risk level: Low CVSS v3 Base Score: 3.5 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CWE: Information Exposure Through Directory Listing CWE-548 Description A logical error caused disclosure of calendar and addressbook names to other logged-in users...

Boozt Fashion AB: Host header poisoning leads to account password reset links hijacking

Hi, Issue Summary : While conducting my regular testing I discovered that the mobile version of boozt.com application relies on the host header when constructing password reset links emailed to the user. Thus, an attacker can inject a arbitrary host header which leads to password reset leakage...

Internet Bug Bounty: Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash

The Node.js HTTP/2 server was affected by a vulnerability that caused it to crash instantly after receiving a small number of HTTP/2 frames. The issue was caused by a race condition that occurred when the Http2Session destructor was triggered while header frames were still being processed, leavin...

Internet Bug Bounty: CVE-2024-2379: QUIC certificate check bypass with wolfSSL

CVE-2024-2379 was a vulnerability in libcurl's QUIC implementation where certificate verification was skipped under certain conditions when using the wolfSSL library. The vulnerability was caused by an error path that accidentally returned success when encountering unknown or unsupported ciphers ...

Publitas: CVE-2018-6389 exploitation - using scripts loader

An unauthenticated denial of service vulnerability in WordPress was discovered, tracked as CVE-2018-6389. By requesting a large number of JavaScript files through the load-scripts.php endpoint, an attacker could consume excessive resources on the server. This vulnerability could allow denial of...

WakaTime: Waketime Payment Gateway Vulnerability

Vulnerability description not provided...

Top Echelon Software: Wordpress Users Disclosure (/wp-json/wp/v2/users/)

Hello Team @topechelonsoftware Information: Using REST API, we can see all the WordPress users/author with some of their information. Step To Reproduce: You can get user info by entering below url in your browser: https://www.topechelon.com/wp-json/wp/v2/users/ ███████ Impact Authors : LTR ,...

Internet Bug Bounty: Rack CVE-2022-30122: Denial of Service Vulnerability in Rack Multipart Parsing

ReDoS in Rack::Multipart::BROKENQUOTED and Rack::Multipart::BROKENUNQUOTED. https://groups.google.com/g/ruby-security-ann/c/L2Axto442qk Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service...

EXNESS: Verification process done using different documents without corresponding to user information / User information can be changed after verification

A business logic flaw in the Exness trading platform allowed a verified user to change their profile information Name, DoB, and Address after identity verification. Additionally, a user could verify their account with official documents that did not correspond to their provided information. This...

FetLife: Able to access private picture/video/writing when requesting for their JSON response

Description Endpoint https://fetlife.com/users/user-id/pictures/pic-id has 2 types of responses, HTML and JSON. The type of response depends on Accept header of request it get. If request contains Accept: application/json, then it will return JSON response. Other than that, it returns HTML...

GitHub Security Lab: [Python] CWE-522: Insecure LDAP Authentication

This bug was reported directly to GitHub Security Lab...

U.S. Dept Of Defense: Sensitive information on '████████'

Hi team, i found a sensitive file hosted on '█████████' that i think must be not public accessible due to the wording "███████" Vulnerable Endpoint: https://█████████/████████ ██████████ Impact Sensitive information pubblicy accessible System Hosts ████████ Affected Products and Versions CVE...

U.S. Dept Of Defense: CVE-2019-3403 on https://████/rest/api/2/user/picker?query=

Description: The endpoint at https://████████/rest/api/2/user/picker?query= Suffers from CVE-2019-3403 Due to old version of jira. F125281 References https://nvd.nist.gov/vuln/detail/CVE-2019-3403 @naglinagli Impact The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from...

U.S. Dept Of Defense: Reflected XSS on https://█████████html?url

Vulnerable Website URL or Application: https://███████html?url=javascript:alert"nagli" Description of Security Issue: please limit to one site/app per submission Reflected XSS due to no input validation █████████ Remediation Sanitize the input on the that parameter Best Regards nagli Impact...

GoCD: XSS In https://docs.gocd.org/current/

Searches on docs.gocd.org were subject to a client-side XSS issue...

Stripo Inc: No rate limiting for subscribe email + lead to Cross origin misconfiguration

Summary: I found bypass no rate limiting using Access-Control-Allow-Origin: and look the response as 200 vulnerable No rate limit means their is no mechanism to protect against the requests you made in a short frame of time. If the repetition doesn't give any error after 50, 100, 1000 repetitions...

Visma Public: Bypassing Business ID/VAT # validation during registration to create accounts with duplicate Business ID/VAT #

The security researcher was able to bypass the Business ID/VAT validation that is required during registration. By doing this he was able to create accounts with duplicate Business ID/VAT...

Node.js third-party modules: [keyd] Prototype pollution

I would like to report a prototype pollution vulnerability in keyd module. It allows an attacker to inject properties on Object.prototype. Module module name: keyd version: 1.3.4 npm page: https://www.npmjs.com/package/keyd Module Description A small library for using and manipulating key paths i...

Shopify: Takeover an account that doesn't have a Shopify ID and more

Details The https://pos-channel.shopifycloud.com/graphql-proxy/admin can be exploited to update a staff member email without any email confirmation. Using the partner dashboard, we've the ability to create a store that doesn't have a Shopify ID account on https://accounts.shopify.com. By using...

Node.js third-party modules: [logkitty] RCE via insecure command formatting

I would like to report a RCE issue in the logkitty module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: logkitty version: 0.7.0 npm page: https://www.npmjs.com/package/logkitty Module Description Display pretty Android and iOS logs without Android...

GitHub Security Lab: Java (Maven): Actually fix the use of insecure protocol to download/upload artifacts

This bug was reported directly to GitHub Security Lab...

Nextcloud: SSRF on local storage of iOS mobile

The tester uploaded the text file, containing "test ssrf" message, in order to proof SSRF attack. 2. Next, the tester uploaded the common file and then manipulate the content and extension file to html format in order to find the application path: 3. The tester access that file and found the...