Ubiquiti Inc.: Subdomain Takeover in http://assets.goubiquiti.com/

Hi there, Its urgent issue about your subdomain http://assets.goubiquiti.com pointing to AWS S3 but no such website configuration is made. This unused subdomain can claim by anyone and fully take over it. An attacker can fully takeover this subdomain and do whatever he wants. this can cause huge...

Yahoo!: REMOTE CODE EXECUTION/LOCAL FILE INCLUSION/XSPA/SSRF, view-source:http://sb*.geo.sp1.yahoo.com/, 4/6/14, #SpringClean

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

8x8: jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`

A path traversal vulnerability was discovered in the /api/v1/uploads/analyze endpoint of the jitsi-call-analytics backend. The vulnerability allowed unauthenticated users to write files within the configured RTCSTATSDOWNLOADSPATH directory. The issue was caused by the upload handler using...

Internet Bug Bounty: important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)

The Apache HTTP Server vulnerability CVE-2024-38476 was discovered in versions 2.4.0 through 2.4.59. The vulnerability allowed the use of exploitable or malicious backend application output to run local handlers via internal redirect. Users were recommended to upgrade to version 2.4.60, which fix...

Internet Bug Bounty: Proxy-Authorization header not cleared on cross-origin redirect in undici.request

The Proxy-Authorization header was not cleared on cross-origin redirects in the Undici HTTP client library. This issue was reported and patched in later versions of Undici...

curl: CVE-2024-0853: OCSP verification bypass with TLS session reuse

A vulnerability was identified in cURL version 8.5.0 that allowed revoked certificates to be accepted when reusing a TLS session. The issue was caused by a correction that inadvertently skipped OCSP stapling verification during TLS session reuse. This allowed revoked certificates to be accepted i...

Valve: Web API key registration allows registering multiple keys by reusing `request_id`

A vulnerability was found in the Steam API key registration process that allowed multiple API keys to be registered for an account by reusing the request ID. The issue was fixed by updating the request ID after successful confirmation. Accounts with multiple keys were corrected...

Node.js: fs.openAsBlob() bypasses permission system

The fs.openAsBlob method in Node.js, when used with the --experimental-permission flag, allowed bypassing the permission system and reading files without the required permissions...

GitLab: Remote Command Execution via Github import

Summary This is very similar to https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/Remote%20Command%20Execution%20via%20Github%20import and allows arbitrary redis commands to be injected when imported a GitHub repository. When importing a GitHub repo the...

HackerOne: Race condition in joining CTF group

Summary: A race condition in https://ctf.hacker101.com/group/join allows a user to join the same CTF group multiple times. The user will show up in the group member list multiple times, and affect the group statistics. Description: Interestingly a race condition in this feature was reported in...

lemlist: Security misconfiguration

Description : When we request a magic link to login into the application, and use that same link in multiple browsers, it working there isn't any limit on use of link. Steps to reproduce : 1. go to app.lemilist.com 2. create a magic link 3. use it to login 4. now open another browser or incognito...

Basecamp: Subdomain Takeover due to ████████ NS records at us-east4.37signals.com

Description Hi! I have discovered that us-east4.37signals.com was pointing to an unclaimed ████ NS zone and I've managed to claim it in my account. POC http://nagli.us-east4.37signals.com/takeover.html F1451587 Remediation Make sure to configure the DNS records under us-east4.37signals.com Best...

Revive Adserver: Use of a Broken or Risky Cryptographic Algorithm

revive-adserver utilizes a PRNG for session-token generation, this means that an attacker could theoretically be able to generate session tokens at random and take over accounts at random. This function does not generate cryptographically secure values, and should not be used for cryptographic...

GitHub Security Lab: [GO] CWE-1004: Sensitive cookie without HttpOnly

This bug was reported directly to GitHub Security Lab...

Kubernetes: kubectl creating secrets from stringData leaves secret in plain text

Report Submission Form Summary: kubectl creating secrets from stringData leaves secret in plain text Kubernetes Version: $ kubectl version Client Version: version.InfoMajor:"1", Minor:"19", GitVersion:"v1.19.3", GitCommit:"1e11e4a2108024935ecfcb2912226cedeafd99df",GitTreeState:"clean",...

U.S. Dept Of Defense: Misconfigured AWS S3 bucket leaks senstive data such of admin, Prdouction,beta, localhost and many more directories....

Description: It has been observed that the amazon s3 bucket which i believe belongs to DoD as it contains data related to Dod prod,admin,localhost documents and all is misconfigured as a result any unauthenticated users can access it without any restrictions Step-by-step Reproduction Instructions...

Rocket.Chat: SAML authentication bypass through unauthenticated `addSamlProvider` Meteor Call

Summary: Rocket.Chat exposes an unauthenticated Meteor method addSamlProvider, which allows disabling SAML signature verification. Description: The addSamlProvider Meteor method sets a number of settings, among them a boolean flag that defaults to false: js export const addSamlService =...

Zomato: SQL Injection in www.hyperpure.com

Vulnerable Request : PUT /consumer/onboarding/saleslead/6b6a8a5a-4a74-46db-b2fe-32a46f927ecc HTTP/1.1 Host: api.hyperpure.com User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:83.0 Gecko/20100101 Firefox/83.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5...

HackerOne: Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io

@nagli found an open redirect vulnerability in a 3rd party vendor that was used by HackerOne. This system did not contain any data related to reports submitted and stored on hackerone.com. HackerOne worked with the vendor to remediate the vulnerability. The report is partially disclosed to...

Dropcontact: Registering with email [ +70 Chars ] Lead to Disclose some informations [Django Debug Mode ]

We were displaying / leaking sytems information in case of app crash...

MTN Group: SQL injection [futexpert.mtngbissau.com]

Summary: add summary of the vulnerability Steps To Reproduce: add details for how we can reproduce the issue 1. Poc Request POST /signin/ HTTP/1.1 Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Referer: https://futexpert.mtngbissau.com/ Cookie:...

Valve: Privilege Escalation vulnerability in steam's Remote Play feature leads to arbitrary kernel-mode driver installation

Tested on Windows 10 x64 On Steam starting, it will check all installed files' Integrity, and re-download the modified files. This step makes every single file in Steam installation folder is exactly its original self. Before the first time Steam stream to SteamLink Remote Play feature, it makes...

U.S. Dept Of Defense: Publicly accessible Grafana install allows pivoting to Prometheus datasource

Summary: A publicly accessible Grafana install exposes semi sensitive Dashboards. This also exposes the Prometheus proxied datasources which allow direct queries to a Prometheus instance which reveals sensitive data an opens the instance up to potential DoS via crafted requests. Description: Impa...

Nextcloud: SSRF protection bypass

CVSS ---- High 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Description ----------- The filter which protects Nextcloud from SSRF can be bypassed using IPv6/IPv4 address embedding. SSRF protection is for example used in the calendar or dav apps. Successful exploitation of the issue will allow...

Nextcloud: Bypass configured 2FA provider with another provider that can be set up at login

In Nextcloud 17 there is the possibility to set up 2FA providers at login. A missing check allows the following steps 1 Enforce 2FA for all users 2 As a user, configure a 2FA provider via settings or at login 3 Log out 4 Log in again password only 5 When prompted with the earlier set up provider,...

WordPress: Stored XSS Vulnerability

Hi there, I found a stored xss @ https://core.trac.wordpress.org/ Steps: 1. Go to https://core.trac.wordpress.org/ and login. open new private window and login with another account 2. Go to https://core.trac.wordpress.org/newticket and set a summary and description. 3. Select a Workflow Keyword a...

ownCloud: Remote Code Execution through Deserialization Attack in OwnBackup app.

I found a deserialization vulnerability in the OwnBackup app, this vulnerability allows to execute remote code in the server. An administrator user could install the vulnerable app, or take advantage of this vulnerability if the OwnBackup application is installed. Below are the steps to properly...

X (Formerly Twitter): Subdomain takeover on dev-admin.periscope.tv

Subdomain takeover on dev-admin.periscope.tv I takeover the subdomain and upload the index file : index.html Impact Subdomain takeover on dev-admin.periscope.tv Subdomain takeover on dev-admin.periscope.tv/index.html http://dev-admin.periscope.tv.s3-website-us-west-2.amazonaws.com/index.html...

Slack: Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijack

Affects: Janus DTLS certificate Description The Janus server in use by Slack is configured using a certificate and private key that were previously distributed by default. This certificate is used to authenticate the DTLS connection which is later used to exchange keys for the SRTP stream. As a...

Shopify: STAFF member with NO Explicit permissions can view `ActivityFeed` via GraphQL

Hi, This is similar to 95589. I noticed that ActivityFeeds are now being fetched by GraphQL call on Shopify. But from my testing, I noticed that STAFF member with NO EXPLICIT permissions can fetch store's activity feed by calling the vulnerable endpoint. STEPS 1.STAFF member is not assigned any...

VK.com: Определение id по номеру телефона

Недостаточность проверок в определенных запросах...

Node.js third-party modules: [simplehttpserver] Stored XSS in file names leads to malicious JavaScript code execution when directory listing is output in HTML

Hi Guys, simplehttpserver allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript. Module: 'simpehttpserver' is simple imitiation of python's SimpleHTTPServer and intended for testing, development and debugging purposes...

Node.js third-party modules: [serve] Directory index of arbitrary folder available due to lack of sanitization of %2e and %2f characters in url

Hi, This report is about Arbitrary Directory Listing vulnerability I found in serve module. Vulnerability does not allow to open arbitrary file due to send module which handles file reading and implements its own validation and protection against Path Traversal attacks. However serve handles...

Electroneum: Hackerone [Mainsite Vulnerability]

96 Hello, I was checking out the website Electroneum – Crowdfunding Token Sale – Electroneum – the mobile based cryptocurrency for any vulnerabilities through hackerone. I would like to submit a vulnerability for consideration towards a bounty. Currently you have the file...

Mavenlink: Password reset link injection allows redirect to malicious URL

@cablej found a vulnerability in our password reset functionality that allowed an attacker using an HTTP request with a modified Host header to cause a password reset link to be emailed to the target user that would navigate to the attacker's domain. Because the password reset emails are sent fro...

Internet Bug Bounty: Excessive allocation of memory in dtls1_preprocess_fragment() (CVE-2016-6308)

This issue is very similar to CVE-2016-6307. The underlying defect is different but the security analysis and impacts are the same except that it impacts DTLS. A DTLS message includes 3 bytes for its length in the header for the message. This would allow for messages up to 16Mb in length. Message...

Blockchain: HTTP Header Injection/HTTP_Response_Splitting

Submitter observed that CloudFlare-protected sites will serve content from other CloudFlare-protected sites when the "Host" HTTP request header is modified in transit. A PoC for an attacker to modify a victim user's "Host" HTTP request header could not be presented by the submitter; consequently...

Internet Bug Bounty: DoS vulnerability in mod_auth_digest CVE-2016-2161

Malicious input to modauthdigest will cause the server to crash, and each instance continues to crash even for subsequently valid requests. http://httpd.apache.org/security/vulnerabilities24.html...

QIWI: Session Cookie without HttpOnly and secure flag set

vulnerable URL:https://portal.int.qiwi.com/login.php The PHPSESSID cookie does not have the HTTPOnly flag set. When a cookie is set with the HTTPOnly flag, it instructs the browser that the cookie can only accessed by the server and not by client-side scripts. This is an important security...

X (Formerly Twitter): XSS in twitter.com/safety/unsafe_link_warning

The following page has XSS. https://twitter.com/safety/unsafelinkwarning?unsafelink=vulnerableparam Steps to reproduce: 1. Go to the following URL using IE:...

ReddAPI: No Captcha or rate limit on Login Page

Hello ReddApi Security Team, Vulnerability Detail's:- Login page can be brute forced due to lack of captcha or backoff Impact:- An attacker can bruteforce for a particular username and can get a possibly a account takeover. POC:- I have made a proof of concept video of the same:-...

Internet Bug Bounty: Handling of jar: URIs bypasses AllowScriptAccess=never

This bug was reported directly to Adobe. http://helpx.adobe.com/security/products/flash-player/apsb14-02.html...

AWS VDP: AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF

Vulnerability description not provided...

Localize: open redirected by host header

An Open Redirect vulnerability occurs when an application allows users to be redirected to an external, untrusted URL without validating the redirection target. By controlling the Host header and observing a redirection to the specified external site, you may have found an open redirect...

Internet Bug Bounty: important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)

important: Apache HTTP Server: SSRF with modrewrite in server/vhost context on Windows CVE-2024-40898 A vulnerability was reported in the Apache HTTP Server that allowed Server-Side Request Forgery SSRF in the server/vhost context on Windows systems with modrewrite enabled. This vulnerability was...

Internet Bug Bounty: moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)

moderate: Apache HTTP Server: HTTP response splitting CVE-2023-38709 Faulty input validation in the core of Apache allowed malicious or exploitable backend/content generators to split HTTP responses. This issue affected Apache HTTP Server through version 2.4.58...

Node.js: Bypass incomplete fix of CVE-2024-27980

The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arose from improper handling of batch files with all possible extensions on Windows via childprocess.spawn and childprocess.spawnSync. A malicious command line argument could have been used ...

Internet Bug Bounty: [CVE-2024-26146] Header Parsing leads to Possible Denial of Service Vulnerability

The Rack header parsing library in Ruby on Rails was found to have a potential denial of service vulnerability. The vulnerability was assigned the identifier CVE-2024-26146. It was discovered that carefully crafted headers could cause the header parsing routines to take longer than expected,...

Internet Bug Bounty: CVE-2023-47037: Airflow Broken Access Control Vulnerability

A broken access control vulnerability in Apache Airflow versions before 2.7.3 allowed authenticated users with DAG view authorization to modify some DAG run detail values when submitting notes, potentially altering details such as configuration parameters and start date...

U.S. Dept Of Defense: Docker Registry without authentication leads to docker images download

An exposed Docker Registry HTTP API allowed attackers to download Docker images and potentially access confidential source code without authentication. The vulnerability was caused by a lack of access control on the registry and could have been mitigated by implementing proper access controls or...