15581 matches found
Internet Bug Bounty: UrnState Heap Overflow
Summary: When handling a URN Request an attacker controlled response can cause Squid to overflow a heap buffer. The buffer exist within a struct so not only does it allow an attacker to overflow adjacent memory, but also control a pointer that follows the buffer enabling them to free arbitrary...
Internet Bug Bounty: Cache Poisoning
Summary: An attacker can cause Squid to return to the user attacker controlled data, for any domain. From Squid-4.7 and below both HTTPS and FTP could be poisoned. This is due to Squid URL decoding parts of the Request URL and using that to create a hash. Request that decode to the same URL will...
X (Formerly Twitter): Twitter Source Label allow 'mongolian vowel separator' U+180E (app name)
Summary: Twitter app-names which are shown in the Tweet source label are supposed to be unique and because of that they must not include invisible unicode characters. However, you can use the mongolian vowel separator in these app-name, which allows to fake a app-name. Description: Every tweet ha...
ok.ru: Plain text password for 'unknown' user exist in URL when opening jira.apiok.ru
Documentation at https://api.mail.ru/docs/guides/billing/ has a link to http://apiok.ru/jira/documents/ which redirects to https://jira.apiok.ru/secure/CreateIssue.jspa?pid=-2&osusername=unknown&ospassword=X7:1OEh3 This pair of username & password - is effective login & password to JIRA system an...
Trint Ltd: IDOR to update folder name of other user
Summary There is an IDOR to update folder name of other user Steps To Reproduce: - user A login to the application and see the folder name F494331 - user B login to the application and call the API with the projectId of user A POST / HTTP/1.1 Host: graphql2.trint.com User-Agent: Mozilla/5.0 Windo...
Dropbox: Algorithmic complexity vulnerability in ZXCVBN leads to remote denial of service attack
@davidrenardy discovered that the ZXCVBN algorithm is quadratic in time complexity, which implies that the user can submit an arbitrarily long password to the library, leading to a potential denial of service attack if performed at scale. Given how ZXCVBN is used at Dropbox, we accept the Denial ...
Central Security Project: Pippo XML Entity Expansion (Billion Laughs Attack)
Maven artifact groupId: ro.pippo artifactId: pippo-jaxb version: 1.12.0 Vulnerability Vulnerability Description Pippo unsafely parses user provided XML. The fromString in the ro.pippo.jaxb.JaxbEngine class allows user provided DTDs that the rest of the XML may reference. This can lead to recursiv...
Mail.ru: Cross site scripting vulnerability in JW Player SWF
Flash-based XSS in aw-xbox.my.com...
X (Formerly Twitter): Stored XSS on reports.
Summary: Stored XSS can be submitted on reports, and anyone who will check the report the XSS will trigger. Description: Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application...
Valve: RCE on Steam Client via buffer overflow in Server Info
Introduction In Steam and other valve games CSGO, Half-Life, TF2 there is a functionality to find game servers called the server browser. In order to retrieve the information about these servers the server browser communicates with a specific UDP protocol called server queries. The protocol is we...
Keybase: Privilege Escalation via Keybase Helper (incomplete security fix)
In the previous report, about the privileged helper lacks of validation so any applications can abuse it to gain root privilege. But the security fix is incomplete. I can describe 3 different ways to bypass possibly 4, I doubt. All the poc are simplified to not sending the actual attack payload,...
Liberapay: Broken Authentication and session management OWASP A2
Hello @liberapay, Description: It seems now if attacker has csrf token & victim cookies then attacker can easily login to victim account without any login details. No need Of Any Username/Password Theory Proof-Of-Concept: - Go to https://liberapay.com/admin.101/edit/username any username/Self...
Uber: [usuppliers.uber.com] - Server Side Request Forgery via XXE OOB
It was possible to determine open internal ports on an usuppliers.uber.com server, via examination of different error messages to a specific POST request made with various payloads. This error message discrepancy would allow an attacker to discover open internal ports, potentially allowing more...
h1-5411-CTF: H1-5411 CTF Writeup
So, Hackerone posted a tweet about the Meme CTF Where barcode was in the tweet image by scanning it and decoding from hex I found this link : https://h1-5411.h1ctf.com/ where we can create/generate a memes and for generating the meme this was used form GitHub which i found in source code analysis...
Shopify: Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypass
Summary athena-flex-production.shopifycloud.com seems to be an internal system that Shopify uses because it redirects user to Okta login. During this however, I noticed that it first returns 200 and then does a redirect meaning some part of the website loads before redirecting. With this, I was...
Mail.ru: api.icq.com / возможность смотреть аватарку и название приватного чата
It was possible to manipulate chat ID in forward message to get meta-data chat name of private group chat...
Node.js third-party modules: Prototype pollution attack (merge-deep)
As discussed in 309391, here's the separate report for each of the library. This one is the information for the merge-deep library. Module: merge-deep Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part of th...
Trello: Able to run script on https://trello-attachments.s3.amazonaws.com/ [N/A]
HI Trello Security Team this pratik From India ------------------------------------------------------------------------------ I have Founded Stored XSS On your Website critical issue need to be patched before someoneattacker exploit this...
HackerOne: Reverse Tabnabbing Vulnerability in Outgoing Links
The external links in the reports are not properly handled, using the issue the links can access the openers and replace them with some other page. To Verify the issue, just go to any report which do have any external link and inspect the proceed button. Where the issue lies: rel="noreferrer"...
Mail.ru: Unupdated ImageMagic leads to uninitialized server memory disclosure
It was possible to disclosure the part of server memory from uncontrolled location on account.my.com project via uploaded GIF image header manipulation. account.my.com is not currently in the Bug Bounty scope, reward was paid as a bonus due to potential severity. CVE-2017-15277...
X (Formerly Twitter): [dev.twitter.com] XSS and Open Redirect
Description === XSS via Request-URI which requires user interaction. The vulnerability is caused by the difference in the Request-URI processing in the Location header and in the link on the page. By creating an incorrect port in the link on the Location header, you can block the redirection for...
Pornhub: Stored XSS in the any user profile using website link
The researcher discovered a stored XSS in the Website field of a user's profile page. I discovered Stored XSS attack vector in the user profile page using Website field. A similar bug was fixed several months ago i got a Duplicate in that time, but after some time I checked this again, and... the...
Concrete CMS: Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0)
Intro First things first, so... Crayons, crayons everywhere : Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.1.0 Summary There is Stored XSS vulnerability in Name field SEO dialog for pages. Malicious user is able to prepare payload which is then...
Nextcloud: Reflected XSS in error pages (NC-SA-2017-008)
Hello, I found a HTML injection vulnerability 1 flaw in the Nextcloud and Owncloud latest version. Through this vulnerability an attacker could manipulate the website. This vulnerability could affect to the logged users. An attacker could send a malicious link that contains the manipulated URL to...
Internet Bug Bounty: Out of bounds memory read in unserialize()
I have found and reported an out of bounds memory read in PHP: https://bugs.php.net/bug.php?id=73825 It affected all three supported versions and has been fixed with the latest updates: https://secure.php.net/ChangeLog-5.php5.6.30 https://secure.php.net/ChangeLog-7.php7.0.15...
Uber: Authentication Issue for easter egg on bonjour.uber.com
This probably ok, almost definitely is just informative but thought I would throw it out here anyways. : bonjour.uber.com hosts an easter egg view source and scroll down where the passcode is insecurely stored as a javascript variable. The source for the easter egg is: html //error easter egg -...
Nextcloud: help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running
The https://help.nextcloud.com sub-site is running Nginx/1.10.0 which is vuln to a known issue CVE-2016-4450 which allows a remote malformed HTTP request to cause the Nginx process to crash. DoS testing is mentioned as not requested, but if you know of an issue give it a go .. You can determine t...
Veris: SSL/TLS BEAST ATTACK VULNERABILITY
hello, i m pentesting sandbox.veris.in and found that it is vulnerable to SSL/TLS BEAST ATTACK vulnerability at port 443. PoC Supported versions: TLSv1.0 TLSv1.1 TLSv1.2 Deflate compression: no Supported cipher suites ORDER IS NOT SIGNIFICANT: TLSv1.0 RSAWITH3DESEDECBCSHA DHERSAWITH3DESEDECBCSHA...
Gratipay: X-Content-Type Header Missing For aspen.io
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared...
Ruby on Rails: Regarding [CVE-2016-0752] Possible Information Leak Vulnerability in Action View
Possible Information Leak Vulnerability in Action View. There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all the scenarios. This vulnerability has been assigned the CVE...
Internet Bug Bounty: libcurl duphandle read out of bounds
http://curl.haxx.se/docs/adv20141105.html...
jsDelivr: Pretty Photo Dom XSS
Hi Team, Javascript for http://www.jsdelivr.com/!prettyphoto hosted on the website points to 3.1.5 which is vulnerable to DOMXSS the upstream released an update 3.1.6 7 days back still the CDN is serving vulnerable edition effectively making all the websites vulnerable to DoMXSS Details about the...
Phabricator: Login CSRF using Twitter OAuth
This bug is related to bug report 774 Log in a user to another account by @dawidczagan as this bug also allows a user to be logged in as the attacker. The main reason is that no state is maintained in the authentication flow. Although the Twitter flow still uses OAuth 1.0A, which has no state...
curl: heap-use-after-free in curl_easy_cleanup() called from callback
Summary: Curlclose lib/url.c:214 calls curlmultiremovehandledata-multi, data and ignores the return value. When curleasycleanup is invoked from within a write/read/progress/header callback, multi-incallback is TRUE, so curlmultiremovehandle lib/multi.c:818-819 returns CURLMRECURSIVEAPICALL withou...
Shopify: Shopify Partners Invitation Process Allows Privilege Escalation Without Email Verification
The Shopify Partners invitation process allowed privilege escalation without email verification. The vulnerability permitted unauthorized users to gain access to Shopify Partners accounts and escalate their privileges by creating accounts using the email addresses of invited owners and accepting...
curl: CVE-2024-6874: macidn punycode buffer overread
The libcurl at commit 58772b0e082eda333e0a5fc8fb0bc7f17a3cd99c contained a stack-buffer overread in the function macidntoascii that could be triggered when the host of a URL was converted to punycode. The root cause was in the function uidnanameToASCIIUTF8, which left the output buffer unterminat...
U.S. Dept Of Defense: IDOR leads to view other user Biographical details (Possible PII LEAK)
The researcher discovered an Insecure Direct Object Reference IDOR vulnerability in the www.██████████ domain. The vulnerability allowed a user to access other users' biographical details, leading to a potential Personally Identifiable Information PII leak. The vulnerable endpoints were located i...
HackerOne: An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name
An attacker could view any hacker or normal user's email on HackerOne by sending an invitation via a dummy report, thereby disclosing their private email...
Node.js: DiffieHellman doesn't generate keys after setting a key
DiffieHellman in Node.js did not generate new keys after setting a key, due to an issue in OpenSSL. This vulnerability could have allowed for key reuse and potential compromise of confidentiality and integrity in applications relying on DiffieHellman for security...
Mattermost: Uninstalling Mattermost Launcher for Windows (64-bit), then reinstalling keeps you logged in without authentication
The Mattermost Desktop App for Windows 64-bit had a vulnerability where uninstalling and then reinstalling the app would automatically log the user back in without requiring authentication, allowing unauthorized access to the user's account and data. The uninstall process did not remove session...
curl: CVE-2022-42915: HTTP proxy double-free
This is a finding that Trail of Bits found in their ongoing curl security audit. Reported at a status meeting today. Summary: curl frees memory twice in some cleanup function related to HTTP proxies. It as simple as curl -x http://localhost:80 dict://127.0.0.1 Using valgrind on the current git...
EXNESS: subdomain takeover at odoo-staging.exness.io
Domain: https://odoo-staging.exness.io PoC https://odoo-staging.exness.io Cname: $ host odoo-staging.exness.io odoo-staging.exness.io is an alias for exness-stg.odoo.com. exness-stg.odoo.com has address 141.95.172.222 exness-stg.odoo.com mail is handled by 10 eu123a.odoo.com. Impact Scam, phishin...
GitLab: Container escape on public GitLab CI runners
Summary It is possible to circumvent the isolation in place for build jobs running on public CI runners by escaping the docker container running the build job. This is possible via abuse of the cgroup releaseagent functionality, made possible by CI jobs being allowed to mount filesystems inside t...
Twitter Algorithmic Bias: Underrepresentation Bias through Twitter's Cropping Algorithm
Bounty Hunter Name: CyberQueenMeg About You: Megan, also known as CyberQueenMeg, is a passionate rising cybersecurity professional who is interested in programming, cybersecurity, and web development. Megan is a high school senior in a rigorous computer science program at her high school where sh...
GitHub Security Lab: ihsinme: CPP Add query for CWE-1126: Declaration of Variable with Unnecessarily Wide Scope
This bug was reported directly to GitHub Security Lab...
U.S. Dept Of Defense: ████████ portal is open to enumeration once authenticated. Session ID's appear static. All PII available once a valid session ID is found.
Description: Once Authenticated to █████████ portal with valid credentials you can type in another members session id and you can see any service members data as if you were authenticated as them. https://█████████ I did not see if there was a way to dump all session id's, but wouldn't be too...
U.S. Dept Of Defense: Self XSS + CSRF Leads to Reflected XSS in https://████/
Hi Security Team, The form inputs in https://███/ Vulnerable to Self XSS Either the form was vulnerable to CSRF When these two bugs available and attacker could combine them to Perform a Reflected XSS Attack Impact Reflected XSS Execute JS Code in behave of a user System Hosts █████████ Affected...
U.S. Dept Of Defense: Self stored Xss + Login Csrf
Description: User can set username between 8-20 alphanumeric characters, but with the help of inspect element attacker can manipulate ██████= & can insert a xss payload resulting in self stored xss & with the help of login csrf attacker can force the victim into attacker's account causing...
Nextcloud: XSS through image upload of contacts using svg file with png extension
Hello again, this is a bypass 89487 basically use the same payload file but change the extension to PNG Impact XSS or Open redirect when viewing the image of a contact...