HackerOne: User login page doesn't implement any form of rate limiting

Hi Team, Summary: As a best practice a login page should have a rate limitting just like hackerone.com Vulnerable Request POST /auth/postlogin HTTP/1.1 Host: ctf.hacker101.com User-Agent: Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://ctf.hacker101.com/...

VK.com: [Привязка email к странице] by [email protected] | email-flood

Отсутствие некоторых проверок при привязке почты. Impact: e-mail flood Флуд. █.vk.com/█?act=█&█=█&█=█&█=█&█=█&█=█&█=█&[email protected]&█=█&ref=█ Status: fixed Флуда больше нет. █.vk.com/█?act=█&█=█&█=█&█=█&█=█&chash=█&█=█&ref=█...

HackerOne: Submitted reports state logs leakage

Hi team, Summary ---------- The endpoint https://hackerone.com/ returns a JSON response containing some informations about the , the parameter signal is returned as a high precision float number up to 14 digits after the comma, the fractional part of this JSON parameter can be used to disclose so...

Semrush: Insecure Direct Object Reference on API without API key

Summary: It is possible to query the semrush API without specifying an API key. This allows anyone to query the API and retrieve information without having paid for a subscription. This is not a security vulnerability as such, but I believe it does undermine your business model in that a user doe...

Tor: solving TOR vulnerability, in other to make bruteforce difficult

Vulnerability description not provided...

VK.com: CSRF Добавить просмотр к записи без ведома пользователя.

Отсутствие параметра hash при учете просмотра записей. Отсутствовал параметр hash при учете просмотра записей. Можно было вести массовую накрутку просмотров на посты. При этом просмотры крутились даже в частную группу, несмотря на то, что у нас к ней не было доступа. POC выглядел так:...

Zomato: SQL Injection, exploitable in boolean mode

Issue The reporter found a SQL injection in one of the applications in www.zomato.com. Fix The issue was investigated and found to be valid and fixed...

HackerOne: Lack of input sanitization in Marketo form leads to execution of HTML in lead emails

Hi, There is SSRF vulnerability due to img tag injection in "Contact HackerOne Sales" form. Since vulnerability triggers after 18-20 minutes so I am not sure which site it affects. It might affect hackerone or marketo. So I thought it would be better to report it first on hackerone. POC 1. Naviga...

Airbnb: Nginx Version Disclosure

Hello, While i was testing airbnb i found nginx version disclosure in HTTP Response. Which can help attacker to gain information or an attacker might use the disclosed information to harvest specific security vulnerabilities for the version identified. URL: https://www.airbnb.com/ Version: 1.7.12...

HackerOne: IE 11 Self-XSS on Jira Integration Preview Base Link

I wasn't sure if you would accept this report due to it being Self-XSS, but I figured it might be useful information because it breaks one of the flows used to validate URLs. Steps ==================== 1. Launch IE 11 2. Log into a HackerOne account that has admin on a program. 3. Go to the...

GitLab: [RDoc] XSS in project README files

Hi, While experimenting with parser bypass techniques, I discovered that RDoc markup could be used to inject a stored JavaScript payload into a project README.rdoc file. Please note that this issue is separate to my earlier report 200565 XSS with AsciiDoc markup, marked as duplicate. Steps to...

LocalTapiola: Error Page Content Spoofing or Text Injection (viestinta.lahitapiola.fi)

Hi team! I want to report a context spoofing or text injection at the new scope added viestinta.lahitapiola.fi Vulnerability Description: The new scope allows users to inject any content on the 404 not found webpage Vulnerable Location:...

Internet Bug Bounty: SSLv2 doesn't block disabled ciphers (CVE-2015-3197)

This is a DROWN-related issue that essentially circumvented the instructions on how to disable SSLv2 at the time. Its primary effect was that a lot of servers were vulnerable to DROWN even though they thought they had SSLv2 disabled. It was reported to OpenSSL and fixed in versions 1.0.2f and...

Uber: Reading Emails in Uber Subdomains

Possibility to read emails from various Uber subdomains. None of the domains exposed were actively being used for Uber email communication to employees or users. Possibility of reading emails sent to certain Uber domains. Link to blog:...

Mail.ru: [upload-X.my.mail.ru] /uploadphoto Insecure Direct Object References

При загрузке аудио-файла с помощью сценария https://upload-14.my.mail.ru/uploadaudio отсутствует проверка принадлежности указанного playlistid текущему пользователю. Пример добавленного файла в чужой плейлист: https://my.mail.ru/music/playlists/18226273862 Пример запроса: POST /uploadaudio HTTP/1...

Uber: Phone Number Enumeration

I discovered it is possible to retrieve all Uber's customer's cell phone numbers using an API endpoint. While going through a sign up form, I noticed that the page was making an ajax call to an API to validate the email address being entered and to make sure it doesn't already belong to an accoun...

Udemy: Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate

I recently purchased a gift for a friend, and noticed the share URL gift ID was simply numeric. I managed to access other people's gifts simply by incrementing and decrementing the ID by 2, I was able to verify that the price was dropped to "Free", regardless of if I was logged in or not, and I w...

Internet Bug Bounty: CVE-2016-0799 memory issues in BIO_*printf functions

https://github.com/openssl/openssl/commit/9cb177301fdab492e4cfef376b28339afe3ef663...

Pornhub: [crossdomain.xml] Dangerous Flash Cross-Domain Policy

The researcher identified a permissive Flash cross-domain policy allowing access from any domain on a Pornhub-related property...

HackerOne: Reflected Filename Download

First of all congratulations on awesome bounty system. Big fan here! I found out that it's possible run a RFD attack on Hackerone. If we visit: https://hackerone.com/dsopas We see the normal HTML webpage. Nothing new here. But if we add ?format=json to the URL we can see the JSON file generated b...

HackerOne: Window Opener Property Bug

The bug mentioned in 23386 is not yet correctly patched I believe. See, if a user sets his/her profile's website link to a similar page as mentioned in 23386. I mean a page that can manipulate the window.opener property would be able to accomplish similar results as in 23386 Proof-of-Concept: 1...

WePay: CSRF & Nonce Token Weak Implementation

Hello, this report is a copy of my previous reports sent to your email [email protected] some days ago. Please note that everything written below are copied and pasted from the report. Ticket 437212 : As part of your responsible disclosure program, I am reporting this leakage weak implementation...

HackerOne: Accepting Invalid characters on email address

I tried to change my email address on hackerone.com.And when I tried adding null Bytes,it was being accepted by hackerone.com. I am registered wth ███ and I tried to change my email address to ████%00 And guess what,this address was granted as an email address...

Slack: User impersonation is possible with incoming webhooks

Using the incoming webhook service it is possible to send messages to the team from an arbitrary username. A malicious user could modify the image of the webhook service to match an existing user and then send a message with the username of an existing user. Other users would not be able to tell...

Internet Bug Bounty: important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)

important: Apache HTTP Server: Crash resulting in Denial of Service in modproxy via a malicious request CVE-2024-38477 A null pointer dereference vulnerability was discovered in modproxy in Apache HTTP Server versions 2.4.59 and earlier. This vulnerability allowed an attacker to crash the server ...

Internet Bug Bounty: CVE-2019-1551: rsaz_512_sqr overflow bug on x86_64

The CVE-2019-1551 vulnerability was an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli in the OpenSSL library. The vulnerability was found and reported by researchers. The issue was mitigated in the 1.1.1 and 1.0.2 versions of OpenSSL...

Node.js: HTTP Request Smuggling via Content Length Obfuscation

The team identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers could lead to HTTP request smuggling. Specifically, if a space was placed before a content-length header, it was not interpreted correctly, enabling attackers to smuggle in ...

TikTok: Multiple Open Redirect on TikTok domains

An open redirect vulnerability was discovered in the login process on TikTok Seller domains. This could have allowed takeover of a TikTok Seller account. The issue was reported privately and has been resolved...

HackerOne: IDOR: Authorization Bypass in LockReport Mutation for public reports

An authorization bypass vulnerability allowed an attacker to lock any public report, potentially disrupting the reporting process...

Hyperledger: DOS validator nodes of blockchain to block external connections

Attack was documented in the in the github repo: https://github.com/hyperledger/indy-node/security/advisories/GHSA-x996-7qh9-7ff7 Attack: The attacker sends 500 read requests to each node and opens a new one when holding 500 parallel connections. Every user is able to send read requests since it'...

Ruby on Rails: Incomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations)

While building a PoC for CVE-2022-32209, I noticed that I could not fix my vulnerable application by updating https://github.com/rails/rails-html-sanitizer from 1.4.2 to 1.4.3 even though the Hackerone report about this vulnerability suggested that this should fix it see here:...

Internet Bug Bounty: CVE-2022-30115: HSTS bypass via trailing dot

Advisory: https://curl.se/docs/CVE-2022-30115.html Original Report: https://hackerone.com/reports/1557449 Impact HSTS bypass...

Shopify: Xss triggered in Your-store.myshopify.com/admin/apps/shopify-email/editor/****

Hi team, I have found Store Xss in shopify-email Reproduction Instructions / 1.Configure shopify-email for Shopify stores at https://apps.shopify.com/shopify-email 2.Goto Your-store.myshopify.com/admin/apps/shopify-email/template-branding 3.Change F1607675 with " click Save. 4.Now Select any...

curl: Binary output bypass

Binary output check bypass Summary: When curl outputs content, it checks for binary output. If the output is large enough, it bypasses the check for binary output. This can mess with the terminal. Steps To Reproduce: 1. Setup a server of your choice. 2. Create a function f with these arguments:...

Nextcloud: bypass forced password protection via circles app

Summary: A user can bypass password enforcement for link and email shares by using a circle Steps To Reproduce: 1. enable forced passwords for link shares and email shares as administrator in the share settings 2. as user create a circle and add an e-mail-address 3. share some file to that circle...

8x8: Authentication Bypass & ApacheTomcat Misconfiguration in [██]

A single host in the pilot environment exposed the Apache Tomcat /admin and /manager endpoints. The issue has been rectified, as access to these endpoints has been restricted...

GitHub Security Lab: New experimental query: Clipboard-based XSS

This bug was reported directly to GitHub Security Lab...

Twitter Algorithmic Bias: Underrepresentation Bias through Twitter's Cropping Algorithm #2: Favoring Animals over Black People

Bounty Hunter Name: CyberQueenMeg About You: Megan, also known as CyberQueenMeg, is a passionate rising cybersecurity professional who is interested in programming, cybersecurity, and web development. Megan is a high school senior in a rigorous computer science program at her high school where sh...

U.S. Dept Of Defense: Cross site scripting

Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. Impact Malicious...

h1-ctf: ccc ctf

██████████ will send detailed report later Impact can get admin credentials...

X (Formerly Twitter): Blind XSS on Twitter's internal Big Data panel at █████████████

An attacker appears to be able to send an XSS payload to Twitter staff members, using a Support Form. This XSS payload will execute in the context of an internal subdomain, allowing it to exfiltrate sensitive internal Twitter information...

Revive Adserver: Reflected XSS on /admin/campaign-zone-zones.php

I found a reflected XSS attack on /admin/campaign-zone-zones.php. Revive-Adserver version is revive-adserver-5.1.1. - Go to http://revive-adserver.loc/admin/campaign-zone-zones.php?=&clientid=1&campaignid=1&status=available%22%3E%3Cimg%20src=1%20onerror=alertdocument.domain%3E&text= - Malicious...

Mail.ru: SDC bypass cloud.mail.ru for every /api/v3/* endpoint.

SDCS cookie was not properly checked for few cloud.mail.ru endpoints, allowing to bypass SDC secure domain cookies protection for privilege separation between projects...

CS Money: Application DOS via specially crafted payload on 3d.cs.money

Summary: Hello Team, While testing it was observed that on 3d.cs.money a DOS is possible via specially crafted request using only single request from single machine on search bar. Though I am aware of the Out of Scope policy "Any activity that could lead to the disruption of our service DoS", thi...

U.S. Dept Of Defense: Stored XSS via Comment Form at ████████

Summary: An attacker can submit a comment form with injected HTML, leading to a number of malicious effects Step-by-step Reproduction Instructions 1. Browse to https://████ 2. Complete the form. I placed " in the Name field. Some example payloads for the Comments field are as follows: For...

h1-ctf: [H1-2006 2020] Solution for the h1-2006 CTF challenge

Hi, The flag is ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$. I didn't know I can send it prior to the report until I saw some disclosed solutions from the previous challenges. The report will follow later today. Regards @thehackerish Impact Multiple vulnerabilities on .bountypay.h1ctf.com allow ...

Topcoder: Reflected XSS on error page on https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action

Hi : In https://apps.topcoder.com/wiki/plugins/socialbookmarking/updatebookmark.action bookmarkPageId parameter expects a number value. If you add XSS payload instead of number, an error page displays with XSS. PoC...

Omise: Email enumeration at SignUp page

Hi. There's bad security practise at https://trade.go.exchange/en/auth/sign-up against User enumeration. Description: At the signup page here https://trade.go.exchange/en/auth/sign-up , when you enter an existing user's mail , a msg box says "Email is invalid." F546294 The problem is that any use...

Internet Bug Bounty: Uninitialized read in gdImageCreateFromXbm

This bug is present in gdImageCreateFromXbm method of ext/gd/libgd/gdxbm.c file. This method contains below mentioned lines. c ... unsigned int b; ... sscanfh, "%x", &b; for bit = 1; bit = maxbit; bit = bit 1 gdImageSetPixelim, x++, y, b & bit ? 1 : 0; ... So when sscanf method is not able to rea...

Starbucks: Blind SQLi leading to RCE, from Unauthenticated access to a test API Webservice

@geekjeremy, at the same time as other hackers who submitted their own reports, discovered a browsable WSDL service on an API endpoint under the starbucks.com.cn domain, running on a non-standard port. @geekjeremy demonstrated that the service had several functions that executed without any...