Kubernetes: DoS for client-go jsonpath func

Summary: jsonpath recursive descent cause a DoS vul kubectl apiextensions-apiserver cli-runtime and kubernetes is depends on client-go I think evalRecursive cause of this vulnerability function pos: client-go/util/jsonpath/jsonpath.go:451 Component Version: client-go:master Steps To Reproduce: i...

X (Formerly Twitter): XSS via referrer parameter

Description Hi, i would like to report an XSS via javascript scheme in https://www.twitterflightschool.com/student/award/ID?referer=, the payload e need just a click of user to be triggered because the link will be placed in a tag...

Stripo Inc: XSRF Token is Not being validated when sending emails test request which lead to CSRF attack using the flash file + 307 redirect technique

XSRF Token is Not being validated when sending emails test request which lead to CSRF attack using the flash file + 307 redirect technique...

Mail.ru: JMX RMI command injection on 195.211.131.82(Mail.ru Gaming)

Externally available Jolokia interface in Mail.Ru Gaming network allowed JMX RMI commands injection Сommand injection in Jolokia JMX. Reading the docs helps. A lot. Also, having good friends who can help you when you need it:...

HackerOne: Password not checked when disabling 2FA on HackerOne

Hi, when I was submitted a report to a program that request 2FA ON, I notice that if you try to disable this option will ask for backup code - password and if you enter a random password in the request filed and a correct backup code it will be successfully disabled the 2FA without check if the...

Pornhub: SSRF and local file disclosure by video upload on http://www.youporn.com/

The researcher was successful in exploiting a vulnerability in 3rd encoding party library resulting in the execution of SSRF attacks and Local File Disclosure...

Internet Bug Bounty: [CVE-2018-18313] regcomp: heap-buffer-overflow read in S_grok_bslash_N

See: https://rt.perl.org/Public/Bug/Display.html?id=133192 CVE ID: CVE-2018-18313 Impact Potential information leakex: secret variables or source codes...

DuckDuckGo: XXE on https://duckduckgo.com

An XML External Entity XXE injection vulnerability was discovered in the x.js endpoint on https://duckduckgo.com via u parameter. This was due to improper sanitation of external XML entities. The results was a leak of certain world readable files on the system. This issue was patched. Additionall...

Internet Bug Bounty: heap buffer overflow in phar_detect_phar_fname_ext

The original report is here https://bugs.php.net/bug.php?id=77247 txt USEZENDALLOC=0 ./php-src-PHP-7.2.13/sapi/cli/php -r "vardumpnew Pharfilegetcontents'poc.phar',0,'test.phar';" txt ================================================================= ==44888==ERROR: AddressSanitizer:...

Grammarly: Grammarly Keyboard for Android <4.1 leaks user input through logs (except for sensitive input fields)

@homelander identified that Grammarly for Android on Android 4.1 was leaking user-entered text to device logs. Currently, Grammarly for Android doesn't support devices with platform versions less than Android 5.0...

Internet Bug Bounty: CVE-2018-12882: heap-use-after-free in PHP 7.2 through 7.2.6, possible 7.2.7

exifreaddata in PHP 7.2 through 7.2.6 and possibly 7.2.7 is vulnerable to a heap use after free when fed a specially crafted JPEG. Any online service that uses PHP 7.2 and reads EXIF data from uploaded JPEGs is potentially vulnerable to this flaw. USEZENDALLOC=0 ./php-e147eb2 -r...

ExpressionEngine: RCE By import channel field

The reporter determined that a malicious Channel Set could be used to allow an administrator to upload a PHP file that they might otherwise not have permission to upload. Combined with the temporary folder name algorithm being available in the source code, the malicious administrator could...

Ruby: HTTP header can split /[\r\n]/ instead of /\r\n/

https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/...

Node.js third-party modules: [m-server] HTML Injection in filenames displayed as directory listing in the browser allows to embed iframe with malicious JavaScript code

I would like to report Stored XSS vulnerability in m-server module. m-server displays content of selected directory as HTML in the browser. However, no escape is implemented which allows malicious user to embed executable JavaScript or HTML code eg. to load HTML document into iframe element and...

Node.js third-party modules: Prototype pollution attack (assign-deep)

As discussed in 309391, here's the separate report for each of the library. This one is the information for the assign-deep library. Module: assign-deep Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part of...

Coursera: [www.coursera.org] Leaking password reset link on referrer header

Hi team, the user gets the email with a password reset link when opening it you will be redirected to password reset page when clicking on external links within the reset password page leaked password reset token in the referer header. steps: 1. open lost password page 2. enter your email and cli...

Mapbox: Admin Panel Accessed (OAuth Bypassed )

On December 4, 2017, @aneeskhan reported an authentication bypass vulnerability on a Mapbox internal portal. The vulnerability allowed them to bypass OAuth authentication and generate a valid session for the site. This session was then used by @aneeskhan to access information on the portal which...

Open-Xchange: SSRF in /appsuite/api/autoconfig

FYI: This was conducted on a local install of App Suite and not the sandbox. App Suite version was: 7.8.4 Rev14 Hello, There is a possible SSRF vulnerability in the following App Suite API endpoint that will primarily allow blind port scanning of the App Suite server and any internal servers...

Instacart: Bruteforcing password reset tokens, could lead to account takeover

Hey Instacart security team, Description When resetting a new password on https://shoppers.instacart.com/password you will receive an email with a reset link. when clicking on this link. you go to this page: https://shoppers.instacart.com/password/edit?resetpasswordtoken=YourToken when entering a...

Legal Robot: No alert in verify email address with wrong input

Hello team @legalrobot, In your verify email address sector, I got something different. in that sector if I click on "Resend verification email" option and see the request. There is a parameter named email. So when I input something in that parameter it's show me done on output. I have show all i...

Legal Robot: Update any profile

A security researcher discovered that profile fields first name, last name, title, company, bio could be modified by another authenticated user, if the other user had access to the victim's randomly generated user id. Thanks to @samczsun for an excellent and detailed report!...

Gratipay: Inadequate/dangerous jQuery behavior

Every text/javascript response gets executed. JQuery 1.10.2 is vulnerable and executes response received. https://assets.gratipay.com/jquery.min.js?etag=YoBy5yEtsejNrLIrIXUs2g https://github.com/jquery/jquery/issues/2432...

Nextcloud: Files Drop: WebDAV endpoint is leaking existence of resources

The new WebDAV endpoint implementation in 11 is leaking too many informations if one executes a MKCOL or a PUT against an existing item. With Files Drop one should only be able to upload files but not leak any existence of items. Leaking existence using PUT When doing a PUT the expectation is to...

Instacart: API OAuth Public Key disclosure in mobile app

Our Android/iOS app can be decompiled and the OAuth Public token can be accessed. Contrary to Instacart's summary, the API private key is also leaked, allowing anyone to use Instacart's private API without restriction. Instacart which I have found to be great in general ignored my additional...

Uber: Blind OOB XXE At "http://ubermovement.com/"

Test Summary : - POST data was set to &dtgmlf6ent; An HTTP request was initiated for the domain http://122.180.248.81/ which indicates that this script is vulnerable to XXE injection. NOTE : As it was Blind XXE Test I was Successful in Ping Test for XXE. But unable to retrieve any sensitive...

Instacart: Authentication Bypass in Updating Personal Information

Hello Instacart, Firstly, I would like to remind you that I made this report by mail 2 days ago, Sat, 16-08-2016 before I got the invite here. Although a user is expected to input password before updating their personal information. This is not so anyway as I have found that one could actually...

Ubiquiti Inc.: Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entry

Hi, So lately I have discovered that CloudFront is not validating which user that connects a CNAME:d domain to a CloudFront Origin. This means that if I could find a domain that is still pointing to CloudFront, without being connected to any Origin as a Custom CNAME, I can actually claim the doma...

LocalTapiola: Source Code Disclosure on out of scope domain viestinta.lahitapiola.fi

Issue The reporter had found an open .git folder on one of our out of scope domains. Fix The issue was investigated and found to be valid. The source code was removed from the public server. The source code did not contain any business critical information and customer information was never at...

X (Formerly Twitter): [Critical] - Steal OAuth Tokens

Hi, This bug is caused because of the same mis-configuration as 128119. Only this time Microsoft Outlook auth is vulnerable instead of Facebook. this time I will try to be as clear as possible. after sign up of Twitter, Twitter asks users to import contacts and it only requires on authorization -...

Ubiquiti Inc.: Read-Only user can execute arbitraty shell commands on AirOS

On the last version of AirOS including the 8.0 beta is possible to a read-only user to inject shell commands. Is possible to exploit the vulnerability using the following URL adjusting the airosid value to a valid session:...

Ruby on Rails: Regarding [CVE-2016-0752] Possible Information Leak Vulnerability in Action View

Possible Information Leak Vulnerability in Action View. There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all the scenarios. This vulnerability has been assigned the CVE...

Mail.ru: reflected in xss

hello i found vulnerability cross site scripting https://touch.mail.ru This vulnerability affects /cgi-bin/passremind. Attack details Cookie input VID was set to 14svrC28zu5Q1MWh0r"prompt979663" The input is reflected inside tag between single quotes. Request GET /cgi-bin/passremind HTTP/1.1...

X (Formerly Twitter): XSS on OAuth authorize/authenticate endpoint

Hi, I would like to report an issue where certain endpoints on twitter.com and api.twitter.com is vulnerable to XSS. Detail The redirection page after authorization/authentication does not sanitize the oauthcallback parameter. PoC 1. Go to http://innerht.ml/pocs/twitter-oauth-xss Please use IE or...

Internet Bug Bounty: PHP yaml_parse/yaml_parse_file/yaml_parse_url Double Free

https://bugs.php.net/bug.php?id=69616 Description: ------------ The yaml parsing functions suffers from an exploitable double free caused by the error path for the phpvarunserialize call on line 797 of pecl/fileformats/yaml.git/parse.c: if ISNOTIMPLICITANDTAGISevent, YAMLPHPTAG const unsigned cha...

Udemy: Misconfigured SPF Record Flag

Hello Team , Description : this report is about misconfigured spf record flag , which can be use to abuse the organization by posing the identity , which allowing to fake mailing on behalf of respected organization . About the Issue : as i seen the SPF and TXT record for the Udemy.com which is :...

curl: curl GnuTLS backend accepts a clientAuth-only certificate for HTTPS server authentication

Summary: When curl/libcurl is built with the GnuTLS backend, the current HTTPS server-certificate validation path verifies the trust chain and hostname but does not enforce TLS server Extended Key Usage semantics. As a result, a leaf certificate that chains to a trusted CA, matches the requested...

Nintendo: [Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE

Vulnerability description not provided...

HackerOne: Bypassing Two-Factor Authentication via Account Deactivation and Password Reset

Vulnerability description not provided...

Internet Bug Bounty: (CVE-2023-32004) Permission model bypass by specifying a path traversal sequence in a Buffer

A vulnerability was discovered in Node.js version 20, specifically within the experimental permission model. It allowed for a bypass of the permission model by specifying a path traversal sequence in a Buffer, leading to improper handling of file permissions...

HackerOne: An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name

An attacker could view any hacker or normal user's email on HackerOne by sending an invitation via a dummy report, thereby disclosing their private email...

Nextcloud: Open redirect on "Unsupported browser" warning

An open redirect vulnerability was found in Nextcloud's UnsupportedBrowser.vue component. Attackers could construct a malicious URL that includes the redirecturl parameter and a URL of their choice, which would redirect the user to the attacker's URL without validating the decoded URL or checking...

Hyperledger: DOS validator nodes of blockchain to block external connections

Attack was documented in the in the github repo: https://github.com/hyperledger/indy-node/security/advisories/GHSA-x996-7qh9-7ff7 Attack: The attacker sends 500 read requests to each node and opens a new one when holding 500 parallel connections. Every user is able to send read requests since it'...

Internet Bug Bounty: CVE-2022-35948: CRLF Injection in Nodejs ‘undici’ via Content-Type

undici library should be protects HTTP headers from CRLF injection vulnerabilities. However, CRLF injection exists in the ‘content-type’ header of undici.request api. Impact = [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more...

Internet Bug Bounty: CVE-2022-32213 - HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding

Original Report: https://hackerone.com/reports/1524555 Impact Depending on the specific web application, HRS can lead to cache poisoning, bypassing of security layers, stealing of credentials and so on...

LinkedIn: Add me email address Authentication bypass

hi, this vulnerability can able to access user account without email verification in linkedins' add me email address function page. user add mail2 email address. without mail2 email address verification user can fully access mail1 linkedin account using mail2 email address. In linkedin mobile...

U.S. Dept Of Defense: CVE-2020-3187 - Unauthenticated Arbitrary File Deletion

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...

Aiven Ltd: [Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal Jolokia

Summary: The Aiven JDBC sink includes the SQLite JDBC Driver. This JDBC driver can be used to upload SQLite database files onto the server. The HTTP sink connector allows sending HTTP requests to localhost. There is unprotected Jolokia listening on localhost:6725. JMX exports the...

U.S. Dept Of Defense: CORS Misconfiguration

Vulnerable Url: www.█████████ Summary: Cross-origin resource sharing CORS is a browser mechanism that enables controlled access to resources located outside of a given domain. However, it also provides a potential for cross-domain-based attacks, if a website's CORS policy is poorly configured and...

Cloudflare Public Bug Bounty: API docs expose an active token for the sample domain theburritobot.com

A screenshot featured on API token creation documentation page exposed a valid API token with permissions sufficient to modify DNS records of one of Cloudflare’s demo zones. The token has since been revoked...

8x8: 8x8pilot.com: Reflected XSS in Apache Tomcat /jsp-examples example directory

A single host in the pilot environment exposed the Apache Tomcat /jsp-examples example directory. The issue has been rectified, as we removed the directory from the host...