Internet Bug Bounty: Python vulnerability: reading arbitrary process memory

Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the json module caused by insufficient bounds checking. The sole prerequisites of this attack are that the attacker is able to control or influence the two parameters of the default scanstrin...

HackerOne: Accepting Invalid characters on email address

I tried to change my email address on hackerone.com.And when I tried adding null Bytes,it was being accepted by hackerone.com. I am registered wth ███ and I tried to change my email address to ████%00 And guess what,this address was granted as an email address...

Slack: User impersonation is possible with incoming webhooks

Using the incoming webhook service it is possible to send messages to the team from an arbitrary username. A malicious user could modify the image of the webhook service to match an existing user and then send a message with the username of an existing user. Other users would not be able to tell...

HackerOne: Enumeration of users

As I can see, you prevent enumeration of users actually e-mails of registered users in Sign In https://hackerone.com/users/signin and Forgot password https://hackerone.com/users/password/new functionalities. However, the users can be enumerated in Sign Up https://hackerone.com/users/signup - just...

HackerOne: A password reset page does not properly validate the authenticity token at the server side.

Go to https://hackerone.com/users/password/new and request a new password. 2. go to email, and click on the link. 3. put the new password, submit and intercept the request; remove the authenticity token from the request and now forward it to the server. 4. you will see request still got...

curl: Buffer overflow in strcpy

Vulnerability description not provided...

Automattic: Authentication & Registration Bypass in Newspack Extended Access

The Newspack Extended Access plugin failed to validate the JWT signing on the registration and login JSON endpoint. This allowed for the registration of accounts with arbitrary user-supplied details and authentication bypass if a target account email was known...

Internet Bug Bounty: CVE-2019-1551: rsaz_512_sqr overflow bug on x86_64

The CVE-2019-1551 vulnerability was an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli in the OpenSSL library. The vulnerability was found and reported by researchers. The issue was mitigated in the 1.1.1 and 1.0.2 versions of OpenSSL...

Internet Bug Bounty: Path traversal by monkey-patching Buffer internals

In Node.js 20 and 21, a path traversal vulnerability was introduced due to the ability to monkey-patch Buffer internals. By overwriting Buffer.prototype.utf8Write, an attacker could bypass the path resolution logic and access restricted file system paths. The vulnerability was caused by the...

GoCD: XSS in new.loading.page.html

A cross-site scripting vulnerability was found in new.loading.page.html due to inadequate handling of query parameters. This allowed attackers to insert javascript URIs as redirectors, leading to unauthorized script execution...

Node.js: "Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash

A vulnerability was discovered in the Node.js HTTP/2 stack http2 package. An attacker could send a small amount of TCP packets with HTTP/2 frames, causing the Node.js server to crash due to an assertion failure in the Http2Session destructor. The issue occurred when headers with HTTP/2 CONTINUATI...

Node.js: Permission model bypass by specifying a path traversal sequence in a buffer,

A vulnerability was discovered in Node.js version 20, specifically within the experimental permission model. This flaw allowed for the bypassing of file permissions by specifying a path traversal sequence in a buffer. The vulnerability affected all users utilizing the experimental permission mode...

Brave Software: UXss on brave browser via scan QR Code

A UXss vulnerability was found in Brave browser on Android 13, allowing an attacker to execute Xss on all open domains by scanning a QR code containing a malicious URL. The vulnerability could potentially allow attackers to steal victim's cookies and affect various websites...

Adobe: DOM XSS at `https://adobedocs.github.io/OAE_PartnerAPI/?configUrl={site}` due to outdated Swagger UI

Vulnerability description not provided...

Nextcloud: A vulnerability classified as critical has been found in gsi-openssh-server 7.9p1 on Fedora (Connectivity Software) on server (http://95.217.64.181:22

Summary: " hello " vulnerability: GSI-OPENSSH-SERVER 7.9P1 ON FEDORA /ETC/GSISSH/SSHDCONFIG CREDENTIALS MANAGEMENT Description of problem: A vulnerability classified as critical has been found in gsi-openssh-server 7.9p1 on Fedora Connectivity Software on server http://95.217.64.181:22. This...

Hyperledger: POOL_UPGRADE request handler may allow an unauthenticated attacker to remotely execute code on every node in the network.

This issue is related to the https://github.com/hyperledger/indy-node. The issue was found in the indy-node code that handles the write request of type POOLUPGRADE in file indy-node/indynode/server/requesthandlers/configreqhandlers/poolupgradehandler.py. The additionaldynamicvalidation function...

8x8 Bounty: Jitsi Desktop Client RCE By Interacting with Malicious URL Schemes on Windows

A command injection vulnerability was found in Jitsi Desktop Client before commit 8aa7be58522f4264078d54752aae5483bfd854b2 on Windows. This vulnerability could allow an attacker to execute arbitrary code by interacting with malicious URL schemes when launching browsers. The vulnerability has been...

Shopify: Subdomain Takeover at course.oberlo.com

Hi, I was able to takeover your subdomain course.oberlo.com via using kajabi services. Poc : visit https://course.oberlo.com/ you will see my poc https://web.archive.org/web/20220904143512/https://course.oberlo.com/ Suggested Fix : Clear your subdomain DNS. Impact Subdomains Takeovers can be use ...

GitLab: Unauthorized access

Hello Gents, I would like to report an issue where attackers are able to: 1. List about.gitlab.com GS bucket. 2. Access all resales through https://about.gitlab.com/all-releases.xml & https://about.gitlab.com/security-releases.xml, which contains undisclosed HackerOne reports. For Example: This...

Cloudflare Public Bug Bounty: Ability to bypass locked Cloudflare WARP on wifi networks.

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

GitLab: Bypass for Domain-level redirects (Unvalidated Redirects and Forwar)

Summary F1745460 While testing for the ability to define custom redirects in Gitlab Pages, I discovered I was able to define Domain-level redirects which are explicitly disabled in the documentation. At a first glance, the validation step seems to disable any link not starting with /, It has...

Internet Bug Bounty: CVE-2022-30115: HSTS bypass via trailing dot

Advisory: https://curl.se/docs/CVE-2022-30115.html Original Report: https://hackerone.com/reports/1557449 Impact HSTS bypass...

Stripe: Bypass global deny-lists by wrapping domains using "[]" in https://github.com/stripe/smokescreen

The Smokescreen proxy is an open source project written and maintained by Stripe to restrict the URLs that internal services can connect to. The primary use case for Smokescreen is to prevent server-side request forgery SSRF attacks in which external attackers leverage the behavior of our...

Showmax: Race Condition Vulnerability when creating profiles

Summary:This report describes a Race Condition Vulnerability which allows a user to create more profile as he wish which contradict your business logic, I was only allow to create six profiles on my account but using this bug I was able to create free 30 profiles. Description: There is a race...

On : No Rate Limit in Login Page

The login page of the website did not have a rate limit implemented, allowing an attacker to perform brute force attacks by trying multiple login attempts without being restricted...

Twitter Algorithmic Bias: Underrepresentation Bias through Twitter's Cropping Algorithm #2: Favoring Animals over Black People

Bounty Hunter Name: CyberQueenMeg About You: Megan, also known as CyberQueenMeg, is a passionate rising cybersecurity professional who is interested in programming, cybersecurity, and web development. Megan is a high school senior in a rigorous computer science program at her high school where sh...

UPchieve: Zero click account Takeover due to Api misconfiguration 🏂🎩

Hacker reported that full account takeover was possible through exploitation of one our forms. Hacker provided sufficient information to prove capability and how to remediate. Our team remediated the issue so that the takeover is no longer possible. i was able to take over any account without any...

Rocket.Chat: Post-Auth Stored XSS with User Interaction leads to Remote Code Execution

Summary: Unsafe usage of the toastr library leads to Stored XSS when combined with a validation bypass in the createRoom function. Targeting an admin account leads to Remote Code Execution. Description: The frontend uses the toastr library to display error messages to the user. However, it is use...

Topcoder: IDOR at https://fast.trychameleon.com/observe/v2/profiles/ via uid parameter discloses users' PII data

Summary: Hello, A API on apps.topcoder.com/forums/ exposes the email of any user on topcoder.com and some PIIs name, surname, id. Steps To Reproduce: 1 Create a profile at topcoder.com 2 Go to apps.topcoder.com/forums and login forum 3 Entery any topic example:...

Nextcloud: Acting under any different user via DB-stored credentials

The issue is related to all Nextcloud versions. It is not patched yet. All versions 18-20 seems to be vulnerable. The issue came up in the following environment: - nextcloud docker image 20.0.2 and 20.0.3 - LDAP authentication - external SMB shares via DB stored credentials The problem came up...

Mail.ru: SDC bypass cloud.mail.ru for every /api/v3/* endpoint.

SDCS cookie was not properly checked for few cloud.mail.ru endpoints, allowing to bypass SDC secure domain cookies protection for privilege separation between projects...

Nextcloud: Stored XSS in markdown file with Nextcloud Talk using Internet Explorer

While editing a markdown file through the text app, users can create link elements that have a javascript URL such as javascript:alert1. Steps to reproduce: While editing a markdown file, select some text and click the "Add Link" button. Using a web proxy, intercept the request and change the hre...

Mail.ru: Access User Tickets via IDOR in [widget.support.my.games]

IDOR vulnerability in widget.support.my.games allowed to disclose the user tickets...

U.S. Dept Of Defense: XML Injection on https://www.█████████ (███ parameter)

Greetings, I found an XML injection on https://www.███. This kind of vulnerability can be difficult to detect and exploit remotely; you should review the application's response here is the complete link: https://www.███/███████ Payload : ███████= Result : ███ best regards, frenchvlad Impact gaini...

Mail.ru: Cross-Site Request Forgery (CSRF) in my.games API

CSRF vulnerability allowed to add/delete/edit store.my.games comments...

Internet Bug Bounty: Out-of-Bound Read in urldecode() [CVE-2020-7067]

Hi, Please see: https://bugs.php.net/bug.php?id=79465&edit=2 CVE is assigned CVE-2020-7067 Fixed in 7.4.5 Release: https://www.php.net/ChangeLog-7.php7.4.5 Impact A remote attacker might leak values from the memory by crafting a malicious url-encoded string into PHP's urldecode...

Starbucks: Korea - LFI Server directory traversal at starbucks.co.kr

b4bilal discovered a misconfiguration when handling URI paths. This permitted an adversary to traverse the docroot and access non sensitive resources that are normally unavailable to web users. @b4bilal — thank you for reporting this vulnerability and for confirming the resolution...

Internet Bug Bounty: PHP link() silently truncates after a null byte on Windows

The bug submitted at: https://bugs.php.net/bug.php?id=78862 The security advisory at: https://nvd.nist.gov/vuln/detail/CVE-2019-11044 The issue allow remote attackers to read or write arbitrary files via crafted input to an application that calls the vulnerable function. As demonstrated by a...

New Relic: Mixed content issues on newrelic.com

Hi guys, I have found Mixed Content on https://newrelic.com/: Insecure endpoint http://newrelic.com/ that should be served over HTTPS. Description: Passive mixed content is content sent over HTTP that is contained on the HTTPS page, but which can not change other parts of the page. For example, a...

Omise: Email enumeration at SignUp page

Hi. There's bad security practise at https://trade.go.exchange/en/auth/sign-up against User enumeration. Description: At the signup page here https://trade.go.exchange/en/auth/sign-up , when you enter an existing user's mail , a msg box says "Email is invalid." F546294 The problem is that any use...

HackerOne: Team member with Program permission only can escalate to Admin permission

Summary https://hackerone.com/TEAM/groups URL is accessible to team members with Program permission, even when "Group Management" and "User Management" menus aren't visible. I didn't research this further, however, I was able to grant all permissions to the user assigned to a group with Program...

Django: Jenkins Unauthenticated RCE on https://djangoci.com/

This report discloses an RCE issue on djangoci.com as outlined in https://www.djangoproject.com/weblog/2019/may/15/rce-djangoci/ While technically a valid issue, it is out of scope for bounty, please see https://hackerone.com/django for details on which issues qualify for bounties...

Weblate: No Rate Limit On Add new word

Hello I found in that there is no limit in the place of adding a new word which allows the attacker to add an infinite number of words which may cause a problem in the site and the server Steps To Reproduce : 1. Go To https://hosted.weblate.org/dictionaries/andors-trail/en/add And Fill in fields...

Mail.ru: astrumnival.com subdomain

Hostname in astrumnival.com domain was unintentionally delegated to external service. astrumnival.com domain is not currently in use...

MyCrypto: SPF Records (SMTP protection not used)

Hello MyCrypto Team , I am checking your website and found something is missing in SPF record.I don't find you have applied strict SMTP policy to stop spoofed email sending from your domain. I would like to recommend you to read the following article :...

Mail.ru: xss

XSS was reported for bb.cdn.gmru.net domain. This domain is considered sandbox with no security impact for XSS, but same XSS also existed in bb.mail.ru subdomain...

QIWI: XXE on ██████████ by bypassing WAF ████

XXE on ■■■■■■.qiwi.com with WAF bypass The endpoint on ██████ accepts a POST request with an XML document. A Web-Application Firewall WAF successfully blocked all requests that contained any of the keywords !DOCTYPE, !ENTITY or !ELEMENT, that are necessary for XXE attacks to be successful. Howeve...

Pornhub: Mobile Reflect XSS / CSRF at Advertisement Section on Search page

The researcher identified a search query parameter vulnerable to cross-site scripting in the Mobile view. It is same vulnerability of redtube's mobile search page. The report is 380246 . This vulnerability is performed XSS because protecting with adding slashes at double quoters. At the tag's...

Internet Bug Bounty: CVE-2018-6797: A crafted regular expression can cause a heap buffer write overflow in Perl 5 giving a remote attacker control over bytes written

An attacker supplies a regular expression containing one or more \xDF characters after an escape putting the regexp into unicode matching mode, such as a \N escape. Each \xDF character adds one byte of overflow, and any other text in the regular expression is written in order, providing the...

Node.js third-party modules: `memjs` allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage

I would like to report a Buffer allocation vulnerability in memjs. In cases when the attacker is able to pass typed input e.g. via JSON to the storage, it allows to cause DoS on all Node.js versions and to store and potentially later extract chunks of uninitialized server memory containing...