Grammarly: “email” MFA mode allows bypassing MFA from victim’s device when the device trust is not expired

Summary: It is possible bypass MFA without the need to have the phone code. Description: When we turn on the MFA and we have the user and password of the user, it is possible bypass the MFA only changing some values the endpoint POST auth.grammarly.com//v3/api/login Steps To Reproduce: Note: - Us...

Monero: Remote Daemon RPC Attack

Remote Daemon RPC Attack https://www.activism.net/cypherpunk/manifesto.html...

Valve: [CS 1.6] Map cycle abuse allows arbitrary file read/write

The CS 1.6 server has a feature of map cycle - i.e. automatic map change after specified period of time. This feature relies on data of the file specified in mapcyclefile cvar. Any user with RCON access to the server can set this variable to arbitrary value - no input sanitization applies. In ord...

Valve: Vulnerability in GoldSource Engine allows to upload and run an arbitrary DLL on client

Introduction Greetings. In GoldSource Engine there is a vulnerability that allows to run an arbitrary DLL on the client, using the flaws in the file downloading system. Description Part of the problem is hidden in the CLBatchResourceRequest function. This is a client function that is responsible...

Starbucks: XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspx

Description: Hi,guys,when i was visited the jobs of starbucks websites in Chinahttps://ecjobs.starbucks.com.cn, i found a features of uploaded user's photo.Thought the bypass the security restrictions of upload,i can upload html|xhtml|xml|config files etc.The uploaded html file can realize the...

Chaturbate: Private and group tokens per minute endpoint active for disabled users

The hacker found that the private and group show rate endpoints where still active when an account was disabled. This was resolved. The endpoints only disclosed the rate for these shows...

Internet Bug Bounty: Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c

This bug was reported to PHP last month and a fix was public last week:https://bugs.php.net/bug.php?id=76423 Heap OverFlow in exifthumbnailextract of exif.c This vulnerability can be triggered by exifreaddata in any 32-bit system. exif.c:2947: if ImageInfo-Thumbnail.offset +...

Shopify: Potential SSRF and disclosure of sensitive site on *shopifycloud.com

Note: I am reporting this after talking with @shopify-peteryaworski Summary There is a staging/testing site for payment cancellations and refunds at shopifycloud.com. This site allows sending post request and fetching the response back to the user. This leads to SSRF because it allows fetching...

Automattic: RCE via Print function [Simplenote 1.1.3 - Desktop app]

In Simplenote 1.1.3 - Desktop app there is a stored XSS vulnerability that can be used to execute arbitrary code. If there is malicious code in the note and the user tries to print it for example to save it as a PDF, the malicious code runs. This report is based on the report 291539, by Yasin...

Reverb.com: Full account takeover

Hello Team, I got a security issue in reverb ios application which allows an attacker hack all users account. Since iOS application is not in the scope but still I am reporting this, because this vulnerability may compromise all users account. Please resolve this quickly. Desription: Reverb ios...

Semrush: CORS (Cross-Origin Resource Sharing)

Affected URL: https://ta.semrush.com/version/ Description: The application implements an HTML5 cross-origin resource sharing CORS policy for this request which allows access from any domain. Allowing access from all domains means that any domain can perform two-way interaction with the applicatio...

Grab: Unrestricted access to https://██████.█████myteksi.net/

Hello again Grab Security Team ! Following my previous research, it seems that your Microservices architecture you are currently running on .█████myteksi.net is publicly exposed on another endpoint : https://█████████.█████myteksi.net. Summary: When researching and starting a new enumeration of...

Legal Robot: Non-HTTPS link on blog

Hi, @legalrobot I found another venturebeat.com URL without HTTPS in https://www.legalrobot-uat.com/press/ I hope you fix this Screenshot attached bellow Cheers, Ph0b0s...

Snapchat: Subdomain Takeover via Unclaimed WordPress site

@ysx found a bitstripsforschools CNAME entry pointing to an unclaimed WordPress domain, which could be taken over by an external party. The CNAME entry was for a product that is no longer active. An unclaimed WordPress domain mapping upgrade could be leveraged to assume the...

Rockstar Games: Stored XSS on support.rockstargames.com

In this report, the researcher demonstrated an AngularJS injection that allowed them to leave Stored XSS attacks on Support Community threads. We were able to resolve this issue and others by updating the version of AngularJS we run on the Support site...

Legal Robot: Improper validation of parameters while creating issues

Heya LegalRobot Team, There is some Improper Access Control on the /Issues/insert endpoint, which leads to three notable vulnerabilities. ----- The first allows attackers to create public issues without undergoing review by setting state: "Open" and public: true. A sample request is given below:...

Cuvva: Missing Rate limiting on https://underwriter.partner.cuvva.com/login

Duplicate of 231380...

HackerOne: IE 11 Self-XSS on Jira Integration Preview Base Link

I wasn't sure if you would accept this report due to it being Self-XSS, but I figured it might be useful information because it breaks one of the flows used to validate URLs. Steps ==================== 1. Launch IE 11 2. Log into a HackerOne account that has admin on a program. 3. Go to the...

Nextcloud: Wordpress Version Disclosure Bug On Nextcloud

Hi @nextcloud , Description Wordpress version disclosure. Affected items https://nextcloud.com/readme.html https://nextcloud.com/wp-admin/install.php https://nextcloud.com/wp-login.php The impact of this vulnerability Possible Wordpress Version information disclosure.You are using wordpress 4.6.1...

Internet Bug Bounty: CVE-2016-7418 PHP Out-Of-Bounds Read in php_wddx_push_element

CVE-2016-7418 PHP Out-Of-Bounds Read in phpwddxpushelement 1. Affected Version + PHP 7.0.10 + PHP 5.6.25 2. Credit This vulnerability was discovered by Ke Liu of Tencent's Xuanwu LAB. 3. Testing Environments + OS: Ubuntu + PHP: 7.0.10 + Compiler: Clang + CFLAGS: -g -O0 -fsanitize=address 4. PoC...

Boozt Fashion AB: Make victim buy in attacker's account without any idea - http://www.booztlet.com/

INTRODUCTION ------------------------ During the testing of http://www.booztlet.com/ I have noticed that the account related links available from https://www.boozt.com/ are also available in http://www.booztlet.com/. This should not be the case, as this shop doesn't have a "My account" section...

OLX: Reflected XSS in www.olx.ph

Summary === The www.olx.ph domain is vulnerable to reflected XSS through the search function. Proof of concept === The following URL contains a harmless XSS vector, which causes an alert box to appear...

Urban Dictionary: Infinite Upvoting/Downvoting: Lockout Bypass, Plus: Exposed API Documentation

By sending an extra parameter kind=1 in the upvote/downvote API request, a user can vote as many times as he wants without any IP address restriction: http://api.urbandictionary.com/v0/vote?kind=1&direction=up&defid=94413 Seems harmless enough, but your site does depend on the accuracy of the...

Informatica: [informatica.com] Blind SQL Injection

Hi guys! JSON POST parameter "docId" is vulnerable to Blind SQL Injection attack PoC Raw query POST /vtibin/RatingsCalculator/RatingsCalculator.asmx/CalculateRatings HTTP/1.1 User-Agent: Opera/9.80 Windows NT 6.1; WOW64 Presto/2.12.388 Version/12.17 Host: kb-test.informatica.com Accept-Language:...

Internet Bug Bounty: Buffer Over flow when parsing tar/zip/phar in phar_set_inode

https://bugs.php.net/bug.php?id=69441 Multiple stack-based buffer overflows in the pharsetinode function in pharinternal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a 1 tar, 2 phar, or 3 ZIP...

Yahoo!: Local File Include on marketing-dam.yahoo.com

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program. Local File Includ...

Rocket.Chat: Authentication Bypass via XML Signature Wrapping in SAML SSO

The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the samlp:Response or saml:Assertion. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP...

Internet Bug Bounty: Usage of disabled protocol in curl

CVE-2024-2004 was a vulnerability in the usage of disabled protocols in curl. When a protocol selection parameter option disabled all protocols without adding any, the default set of protocols remained in the allowed set due to an error in the logic for removing protocols. This flaw was assessed ...

Publitas: CORS Misconfiguration on █████

A cross-origin resource sharing misconfiguration was found that could allow an attacker to steal sensitive user information or force unwanted actions. The misconfiguration allowed credentials and enabled CORS for external domains. A proof of concept was shown that could exploit this to exfiltrate...

HackerOne: Organization members can delete reports in teams they have no access to

Reports in teams could be deleted by organization members without access to those teams. The vulnerability allowed deletion of analytics reports for restricted teams through a GraphQL mutation even when members lacked permissions to view or edit those reports...

HackerOne: IDOR: Authorization Bypass in LockReport Mutation for public reports

An authorization bypass vulnerability allowed an attacker to lock any public report, potentially disrupting the reporting process...

Brave Software: Open redirect due to scanning QR code via brave browser

An open redirect vulnerability was discovered in Brave's QR code scanner, which allowed attackers to direct users to malicious sites without their consent or knowledge. This vulnerability put the security of Brave users at risk and allowed them to be exposed to phishing and malware attacks. The...

U.S. Dept Of Defense: Reflected XSS at ████████

A reflected cross-site scripting XSS vulnerability was discovered in the dochelper feature of a certain domain. An attacker could inject a crafted script into the userId parameter, which would execute when the victim user accessed the page, potentially allowing the attacker to steal the victim's...

Internet Bug Bounty: CVE-2022-35260: .netrc parser out-of-bounds access

Original Report:https://hackerone.com/reports/1721098 Impact If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service...

Rockstar Games: Modifying Sprunk vs eCola crew data

In this report, the researcher demonstrated an Insecure Direct Object Reference vulnerability that was exploitable in certain Rockstar Official Crews on the Social Club website. Rockstar Official Crews, unlike user-made Crews, use a flat hierarchy where all members are set to the same effective...

Cloudflare Public Bug Bounty: Ability to bypass locked Cloudflare WARP on wifi networks.

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

Internet Bug Bounty: CVE-2022-32207: Unpreserved file permissions

When curl saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name. In that rename operation, it might accidentally widen the permissions for the target file, leaving the update...

Nextcloud: SMTP Command Injection in iCalendar Attachments to Emails via Newlines

Note: This is similar to 1509216, but has a new source/attack vector. Apologies for not picking this up earlier. Summary: When users receive iCalendar attachments in Mail, there is an option to add it to their calendar: ██████████ Once they add it to calendar, a PUT request is sent: PUT...

U.S. Dept Of Defense: CVE-2020-3452 on https://█████/

Hello team, I hope you're doing well, healthy & wealthy. I found a CVE-2020-3452 path traversal and here is the explanation. A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an...

GitHub Security Lab: ihsinme: Add query for CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

This bug was reported directly to GitHub Security Lab...

U.S. Dept Of Defense: CSRF to Cross-site Scripting (XSS)

hello dear support I have found csrf to XSS on https://██████ my payload "; url: POST ██████████ post data answer=A"; Impact Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session...

Automattic: Reflected XSS due to vulnerable version of sockjs

Summary: There is reflected XSS on .simperium.com. The bug exists due to a vulnerable version of sockjs library. Platforms Affected: simperium.com js.simperium.com Steps To Reproduce: 1. Visit https://simperium.com/sock/1/0/0/0/htmlfile?c=alert'XSS'// 2. You will see an alert message because of...

Algolia: email verification bypass

An issue in the way email modification was handled during the email verification process allowed the creation of account with arbitrary email address, bypassing the email verification step. A logical flaw resulting in email verification bypass! :D...

Acronis: licenses key disclosure

Summary Hi team i found the licenses key stored as cleat text i think it important Steps To Reproduce 1. Go to this link https://dl.acronis.com/u/pdf/workstationlicenses.txt 2.And this link https://dl.acronis.com/u/pdf/serverlicenses.txt 3. You can see all licenses key Impact I think I can use th...

Shopify: Screenshot Service leaks X-ABS-App-Token

Login and create a development store 2. Start Burp Suite and open a burp collaborator client then copy the collaborator payload 3. Edit the section header.liquid of your current theme. Adding this: window.location="https://pasteherecollaborator/"; Finally go to...

MTN Group: No rate limit in otp code sending

Summary: There is no rate limit in sendind otp code. Thus, attacker can use this vulnerability to bomb out the mobile inbox of the victim. Steps To Reproduce: Step 1. Open burp suite, and click on "Intercept is on " button from Proxy tab. Step 2. Launch browser and visit https://mtnonline.com/nim...

OPPO: Information Disclosure at https://portal.finzfin.com/1.txt

Leaking internal network information Summary: While performing recon work on websites owned by oppo i came up with finzfin website which is leaking sensitive information. Description: The above website is leaking information , This is a high severity issue and requires immediate fixation. I look...

U.S. Dept Of Defense: IDOR to Account Takeover on https://████/index.html

Hello Team! Summary: I found when you wish to update your profile on https://███████/ after your login through https://██████████/signIn/signIn.html website due to an IDOR. This IDOR gives you the opportunity to change the origin email for the registered account by changing the ID parameter on th...

Internet Bug Bounty: Use after free vulnerability in phar_parse_zipfile

Malformed phar file with cache configuration leads freed memory as hash key when it inserts into the hash table. More detail information and original report is here: https://bugs.php.net/bug.php?id=79797 and it was assigned CVE-2020-7068. Impact Through this vulnerability that inserts freed memor...

U.S. Dept Of Defense: Stored XSS via Comment Form at ████████

Summary: An attacker can submit a comment form with injected HTML, leading to a number of malicious effects Step-by-step Reproduction Instructions 1. Browse to https://████ 2. Complete the form. I placed " in the Name field. Some example payloads for the Comments field are as follows: For...