ownCloud: Remote Code Execution through Deserialization Attack in OwnBackup app.

I found a deserialization vulnerability in the OwnBackup app, this vulnerability allows to execute remote code in the server. An administrator user could install the vulnerable app, or take advantage of this vulnerability if the OwnBackup application is installed. Below are the steps to properly...

Mail.ru: [special.mail.ru] Information Disclosure

special.mail.ru was running misconfigured Laravel in debug mode, disclosing some sensitive information...

Valve: Vulnerability in GoldSource Engine allows to upload and run an arbitrary DLL on client

Introduction Greetings. In GoldSource Engine there is a vulnerability that allows to run an arbitrary DLL on the client, using the flaws in the file downloading system. Description Part of the problem is hidden in the CLBatchResourceRequest function. This is a client function that is responsible...

Internet Bug Bounty: Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c

This bug was reported to PHP last month and a fix was public last week:https://bugs.php.net/bug.php?id=76423 Heap OverFlow in exifthumbnailextract of exif.c This vulnerability can be triggered by exifreaddata in any 32-bit system. exif.c:2947: if ImageInfo-Thumbnail.offset +...

Mail.ru: api.icq.com / возможность смотреть аватарку и название приватного чата

It was possible to manipulate chat ID in forward message to get meta-data chat name of private group chat...

Node.js third-party modules: [serve] Directory index of arbitrary folder available due to lack of sanitization of %2e and %2f characters in url

Hi, This report is about Arbitrary Directory Listing vulnerability I found in serve module. Vulnerability does not allow to open arbitrary file due to send module which handles file reading and implements its own validation and protection against Path Traversal attacks. However serve handles...

Grab: Unrestricted access to https://██████.█████myteksi.net/

Hello again Grab Security Team ! Following my previous research, it seems that your Microservices architecture you are currently running on .█████myteksi.net is publicly exposed on another endpoint : https://█████████.█████myteksi.net. Summary: When researching and starting a new enumeration of...

Duolingo: RCE in TinyCards for Android

We found and confirmed an RCE bug in TinyCards for Android. Is it in scope, and if not how do we report this security issue to DuoLingo...

Legal Robot: Bypass email verification when register new account

Hi Legalrobot, I have found a way to ignore Activate your account in my mailbox. Here is my new acc: [email protected] and the activate link: https://app.legalrobot-uat.com/email-verify?v=1Y5wiWwcvGcxznjlUsO-TuyEZgFpVbxMmQdfpEKrVTp I never click on that link and i can still log in at...

Legal Robot: No alert in verify email address with wrong input

Hello team @legalrobot, In your verify email address sector, I got something different. in that sector if I click on "Resend verification email" option and see the request. There is a parameter named email. So when I input something in that parameter it's show me done on output. I have show all i...

X (Formerly Twitter): [dev.twitter.com] XSS and Open Redirect

Description === XSS via Request-URI which requires user interaction. The vulnerability is caused by the difference in the Request-URI processing in the Location header and in the link on the page. By creating an incorrect port in the link on the Location header, you can block the redirection for...

Legal Robot: Improper validation of parameters while creating issues

Heya LegalRobot Team, There is some Improper Access Control on the /Issues/insert endpoint, which leads to three notable vulnerabilities. ----- The first allows attackers to create public issues without undergoing review by setting state: "Open" and public: true. A sample request is given below:...

WakaTime: Login page password - guessing attack

No account lock out after a certain number of failed login attempts Steps to reproduce: navigate to https://wakatime.com/ and enter email address and false password make more than attempts and account does not get locked out After failed attempts, I was still able to login in with my password...

Rockstar Games: Login form on non-HTTPS page

Summary: ======= A page on a microsite is not fully protected by an SSL certificate. This could allow an attacker in a Man-in-the-Middle position to obtain usernames and passwords of users visiting the site. Description: ======= On the Red Dead Redemption subpage, the comments section on news...

Gratipay: Inadequate/dangerous jQuery behavior

Every text/javascript response gets executed. JQuery 1.10.2 is vulnerable and executes response received. https://assets.gratipay.com/jquery.min.js?etag=YoBy5yEtsejNrLIrIXUs2g https://github.com/jquery/jquery/issues/2432...

Nextcloud: Wordpress Version Disclosure Bug On Nextcloud

Hi @nextcloud , Description Wordpress version disclosure. Affected items https://nextcloud.com/readme.html https://nextcloud.com/wp-admin/install.php https://nextcloud.com/wp-login.php The impact of this vulnerability Possible Wordpress Version information disclosure.You are using wordpress 4.6.1...

Boozt Fashion AB: Make victim buy in attacker's account without any idea - http://www.booztlet.com/

INTRODUCTION ------------------------ During the testing of http://www.booztlet.com/ I have noticed that the account related links available from https://www.boozt.com/ are also available in http://www.booztlet.com/. This should not be the case, as this shop doesn't have a "My account" section...

New Relic: Java RMI (Remote Code Execution)

hello Guys while i was testing your site i found an interesting domain of newrelic which is pinger-master.newrelic.com and when i visit that domain it says unable to connect with the host the i quickly do nslookup and i got this results fish@punt $ nslookup pinger-master.newrelic.com Server:...

Ubiquiti Inc.: Read-Only user can execute arbitraty shell commands on AirOS

On the last version of AirOS including the 8.0 beta is possible to a read-only user to inject shell commands. Is possible to exploit the vulnerability using the following URL adjusting the airosid value to a valid session:...

HackerOne: Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc.

A stylesheet is available in a non-minified, non-compiled format. It includes sass, versioning, a source map, a style guide, comments, etc. see base64 encoded string at the very end of the document. https://hackerone.com/assets/application.css This alone is obviously not an exploit. However, it c...

Internet Bug Bounty: libcurl duphandle read out of bounds

http://curl.haxx.se/docs/adv20141105.html...

Anghami: [CRITICAL] Login To Any Account Linked With Google+ With Email Only

Hello, This is CRITICAL .. I Can Login To Any Account Linked With Google+ With Email Only And Without Password!! PoC: html And To Make This PoC Work .. You Have To Follow The Same Bypass in My Previous Report 86428. If Your Page URL is http://localhost/login.html Make IT Look Like...

Internet Bug Bounty: Multiple Use After Free Vulnerabilites in unserialize()

https://bugs.php.net/bug.php?id=70166 https://bugs.php.net/bug.php?id=70168 https://bugs.php.net/bug.php?id=70169...

Internet Bug Bounty: PHP yaml_parse/yaml_parse_file/yaml_parse_url Double Free

https://bugs.php.net/bug.php?id=69616 Description: ------------ The yaml parsing functions suffers from an exploitable double free caused by the error path for the phpvarunserialize call on line 797 of pecl/fileformats/yaml.git/parse.c: if ISNOTIMPLICITANDTAGISevent, YAMLPHPTAG const unsigned cha...

Internet Bug Bounty: rsync hash collisions may allow an attacker to corrupt or modify files

The rsync algorithm synchronizes remote files in 3 steps: - The receiver divides the basis file into 700-byte blocks, performing two checksums on each block a rolling checksum based on Addler32 and an md5 sum - The sender then scans it's version of the file byte-by-byte looking for matches agains...

Yahoo!: Local File Include on marketing-dam.yahoo.com

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program. Local File Includ...

Phabricator: Login CSRF using Twitter OAuth

This bug is related to bug report 774 Log in a user to another account by @dawidczagan as this bug also allows a user to be logged in as the attacker. The main reason is that no state is maintained in the authentication flow. Although the Twitter flow still uses OAuth 1.0A, which has no state...

curl: curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/Tor

Summary: When using curl with a SOCKS5 proxy e.g. Tor on 127.0.0.1:9050, glibc getaddrinfo performs direct UDP connect probes to the target’s IP:443. These syscalls bypass the proxy and expose the user’s route to the destination, breaking anonymity expectations. The IPs I got in my case:...

Reddit: Infromation Disclosure To Use of Hard-coded Cryptographic Key

Vulnerability description not provided...

Internet Bug Bounty: curl cookie mixed case PSL bypass

A vulnerability in curl allowed a malicious HTTP server to set "super cookies" that bypassed the Public Suffix List check, enabling cookies to be sent to unrelated sites and domains...

U.S. Dept Of Defense: XSS in Cisco Endpoint

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software were found that could allow cross-site scripting attacks against a user of the affected device's web services interface. By exploiting...

Nextcloud: Delete external storage of any user

An external storage vulnerability was discovered that allowed standard users to delete external storage resources from any user account in the application. By modifying a system-generated ID, unauthorized users could remove externally linked storage without special privileges, potentially resulti...

Rockstar Games: Modifying Sprunk vs eCola crew data

In this report, the researcher demonstrated an Insecure Direct Object Reference vulnerability that was exploitable in certain Rockstar Official Crews on the Social Club website. Rockstar Official Crews, unlike user-made Crews, use a flat hierarchy where all members are set to the same effective...

U.S. Dept Of Defense: Unauthenticated SQL Injection at █████████ [HtUS]

Summary Hi team, I found Unauthenticated SQL Injection at ██████. Because of non-filter and non-escape input at API /api/organizations/, attacker can inject malicious payload after single quote ' to exploit and extract database. Step to Reproduce: Execute Request GET...

Internet Bug Bounty: CVE-2022-32207: Unpreserved file permissions

When curl saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name. In that rename operation, it might accidentally widen the permissions for the target file, leaving the update...

curl: CVE-2022-27782: TLS and SSH connection too eager reuse

Summary: Curl fails to consider some security related options when reusing TLS connections. For example: - CURLOPTSSLOPTIONS - CURLOPTPROXYSSLOPTIONS - CURLOPTCRLFILE - CURLOPTPROXYCRLFILE As a result for example TLS connection with lower security CURLSSLOPTALLOWBEAST, CURLSSLOPTNOREVOKE connecti...

Shopify: XSS at jamfpro.shopifycloud.com

An XSS vulnerability was discovered in the instance of Jamf Pro running on https://jamfpro.shopifycloud.com due to the old Swagger-UI being exposed at /classicapi/doc/. An attacker could have crafted a URL to introduce an XSS payload and execute arbitrary JS code in the context of the application...

Basecamp: Bypass Tracking Blocker Protection Using Slashes Without Protocol On The Image Source.

Summary: - Some Way Has Been Discovered To Bypass Image Rewriting On HeyMail Using Slashes Without Protocol /\www.evil.com That Allows Bypassing Tracking Blocker And Collect Users Information Via Emails. Description: - While Searching I Found That The Image Rewriting Function On Heymail Could Be...

U.S. Dept Of Defense: Blind stored XSS due to insecure contact form at https://█████.mil leads to leakage of session token and

Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://███████.mil/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets. I was able to...

OPPO: Information Disclosure at https://portal.finzfin.com/1.txt

Leaking internal network information Summary: While performing recon work on websites owned by oppo i came up with finzfin website which is leaking sensitive information. Description: The above website is leaking information , This is a high severity issue and requires immediate fixation. I look...

Mail.ru: Subdomain takeover http://promo.instamart.ru/

Unused promo.instamart.ru subdomain was delegated to wix.com and not claimed...

Basecamp: HEY.com email stored XSS

An attacker can bypass the HEY.com HTML sanitizer and inject arbitrary unsafe HTML in emails. To reproduce the bug you have to send raw HTML-formatted email. You can do it e.g. with the Sendmail tool on Linux. Example email: plain From: [email protected] To: [email protected] Subject: HackerOne test...

Valve: Add apps to packages 0, 61, 62 with /store/ajaxpackagemerge

The ajaxpackagemerge API incorrectly allowed partners to add their own apps to certain Valve administrative packages. This can be further leveraged to generate CD key ranges for these administrative packages. The API access control was corrected...

TikTok: Open Redirect Vulnerability on TikTok Ads Portal

An Open Redirect vulnerability was found that could expose the user session cookie potentially allowing an attacker to obtain access to an account on the TikTok ads portal...

h1-ctf: [h1-2006 CTF] Payments for May have been processed!

Hi : First off thanks for a great CTF! It had its ups and downs mainly due to my mistakes but here is the final flag: ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ My write up can be found at https://devcraft.io/bountypay-h1-2006-ctf.html unpublished detailing the process, tools, and mistakes I ma...

Mail.ru: [account.mail.ru] XSS-уязвимость в форме авторизации

User-assisted XSS in account.mail.ru due to unsafe usage of GET parameter Думаю, что данная XSS'шка является отличным примером того, что фильтрация HTML-символов во входных данных не всегда достаточная мера защиты. Если будем раскрывать уязвимость, то вот более удачная демонстрация, без моих куко...

h1-ctf: [H1-2006 2020] CTF Writeup!

The Beginning ===================== The scope of the H1-2006 CTF was .bountypay.h1ctf.com. After opening https://bountypay.h1ctf.com, I noticed that on the top left of the screen there was a dropdown with two login pages: one for Customers https://app.bountypay.h1ctf.com/ and one for Staff...

Internet Bug Bounty: Null Pointer Dereference in PHP Session Upload Progress

Affected Versions ------------ Affected is all of PHP5.4/5.5/5.6 Affected is all of PHP7 Credits ------------ This vulnerability was disclosed by Taoguang Chen. Description ------------ session.c static int phpsessionrfc1867callbackunsigned int event, void eventdata, void extra / / ... switcheven...

Shopify: Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO

I told Pete I would take a look at Spotify, hi Pete. Summary It's possible to take over any store account through bypassing the email confirmation step in .myshopify.com. I found a way to confirm arbitrary emails, and after confirming arbitrary email in .myshopify.com, user is able to integrate...

Semrush: Reflected XSS on https://www.semrush.com/my_reports/externalSource/callback/googleAccountsGMB

Researcher found reflected XSS vulnerability on https://www.semrush.com/myreports/externalSource/callback/googleAccountsGMB Report: The parameter status is missing sanitization in the following url: https://www.semrush.com/myreports/externalSource/callback/googleAccountsGMB?status=xssalert//...