15581 matches found
Weblate: Insecure Account Removal #2
Hi Team, This report is the pretty much same of my closed report here: 223355 , the difference is BUG2 when a user created an account BUT did not supply the password, therefor there is nothing to reauthenticate when deleting the account, it will successfully delete the account without supplying...
Phabricator: IRC-Bot exposes information
You can setup the IRC-Bot, and set it into private channels, so that it posts only information about tasks into private channels. Example: T698 T698: Task title - https://url.example.org/T698 The problem is, that, if the bot is online in IRC, you can send him task numbers via private messages, an...
Gratipay: Gratipay uses the random module's cryptographically insecure PRNG.
Dear Gratipay bug bounty team, Summary --- Gratipay currently uses the random module's pseudo-random number generator which is not a cryptographically secure PRNG as stated in the docs: The pseudo-random generators of this module should not be used for security purposes. For security or...
HackerOne: Internal attachments can be exported via "Export as .zip" feature
Hello HackerOne Team This newly disclosed report: 182358 Partial disclosure of report activity through new "Export as .zip" feature was not completely fix. I have found that i can still view the attachment after it is being removed on the thread. Best PoC is this 182358 since this is the newly fi...
Ubiquiti Inc.: Subdomain Takeover (moderator.ubnt.com)
Hello Team This report is same as 179110 One of your subdomain http://moderator.ubnt.com is pointing towards 216.58.203.243 moderator.ubnt.com 216.58.203.243 ghs.google.com 216.58.203.243 ghs.l.google.com F134183 And it is unclaimed When I open it it is showing F134184 Impact :- An attacker can...
Instacart: Host Header Injection/Redirection in: https://www.instacart.com/
Hi, Your website is vulnerable to Host Header Injection because the host header can be changed to something outside the target domain In many cases, developers are trusting the HTTP Host header value and using it to generate links, import scripts and even generate password resets links with its...
Paragon Initiative Enterprises: SMTP server allows anonymous relay from internal addresses to internal addresses
Hello, Issue descripton your incoming SMTP servers, provided by google , seems to be accepting without authentication mails from addresses @paragonie.com and destined for addresses @paragonie.com. This can greatly ease spear-phishing attacks, as users usually put much trust into emails coming fro...
Internet Bug Bounty: Adobe Flash Player Metadata class Memory Corruption Vulnerability
I. Summary Adobe Flash Player is prone to a vulnerability which leads to memory corruption because of improper validation of Metadata.setMetadata. ------------------------------------------------------------------ II. Description Adobe Flash is a multimedia and software platform used for authorin...
Udemy: Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate
I recently purchased a gift for a friend, and noticed the share URL gift ID was simply numeric. I managed to access other people's gifts simply by incrementing and decrementing the ID by 2, I was able to verify that the price was dropped to "Free", regardless of if I was logged in or not, and I w...
Coinbase: XSSI (Cross Site Script Inclusion)
Hi, https://www.coinbase.com/pusher/auth returns sensetive a json auth-token response that can be parsed by javascript JSON.parse from external site. this can easily be mitigated by putting // or // chars at the beginning of the json response and thus making functions like JSON.parse unable to ge...
Zendesk: [CRITICAL] CSRF leading to account take over
Hi , I have found a CSRF issue in .zendesk.com/jobs/createjob that leads to full account take over. Details: When using bulk user import in https://.zendesk.com/import?kind=user after you upload a CSV file and press import , a request is sent to...
QIWI: XML External Entity (XXE) in qiwi.com + waf bypass
While testing tax payment service, I found that your server endpoint https://qiwi.com/order/external/multiple.action is vulnerable to XML External Entity Attack. Despite server doesn’t response with any information, attacker can still use out-of-band XXE technique to read arbitrary files on serve...
Internet Bug Bounty: AddressSanitizer reports a global buffer overflow in mkgmtime() function
https://bugs.php.net/bug.php?id=68027...
Internet Bug Bounty: Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow)
https://bugs.php.net/bug.php?id=69545...
Shopify: amazon aws s3 bucket content is public :- http://shopify.com.s3.amazonaws.com/
An Amazon S3 bucket http://shopify.com.s3.amazonaws.com/ was unintentionally left with directory listing enabled. Even though the files in the bucket were all publicly accessible, it was not intended for the directory listing to be visible...
Enter: CSRF token leakage
Hi, I have noticed that when the account verification fails here : https://wallet.robocoin.com/verify/ due to an error, the CSRF token is being leaked via GET method like : https://wallet.robocoin.com/verify/id?csrf=b8ede20d-0c0b-4e16-9d05-6ad2ed8b72c4 So the authenticity token is being stored in...
Internet Bug Bounty: Python vulnerability: reading arbitrary process memory
Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the json module caused by insufficient bounds checking. The sole prerequisites of this attack are that the attacker is able to control or influence the two parameters of the default scanstrin...
InVision: TLS Renegotiation and Denial of Service Attacks on InVision.
Hi, I found a Bug in your website.It's a TLS Renegotiation and Denial of Service Attacks. Description:- A group of hackers known as THC The Hacker's Choice last week released an interesting DoS tool that works at the SSL/TLS layer. The tool is exploiting the fact that, when a new SSL connection i...
DuckDuckGo: RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo Browsers
A vulnerability was discovered in the DuckDuckGo content-scope-scripts repository's GitHub Actions workflow. The workflow used the pullrequesttarget trigger without access controls, allowing untrusted code from fork pull requests to be checked out and executed. This could have led to remote code...
curl: libcurl: Improper Authentication State Management on Cross-Protocol Redirects
Following the recent advisory for CVE-2025-14524, I conducted an investigation into how libcurl manages OAuth2 credentials during complex redirect chains. I have confirmed that while the library successfully protects traditional user credentials, it fails to clear OAuth2 Bearer tokens in the same...
TikTok: IDOR on ads.tiktok.com Allows Unauthorized Product Addition
An Insecure Direct Object Reference IDOR vulnerability was discovered on the TikTok Ads API that allowed the addition of arbitrary products to a user's catalog without proper authorization...
Internet Bug Bounty: Path traversal by monkey-patching Buffer internals
In Node.js 20 and 21, a path traversal vulnerability was introduced due to the ability to monkey-patch Buffer internals. By overwriting Buffer.prototype.utf8Write, an attacker could bypass the path resolution logic and access restricted file system paths. The vulnerability was caused by the...
curl: Buffer Overflow Vulnerability in WebSocket Handling
Vulnerability description not provided...
inDrive: Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`
The vulnerability allowed an unlimited increase of the passenger's rating in the city-to-city shared ride feature. The request to the /api/v1/reviews/ride//driver endpoint was manipulated by changing the rating value to a higher number, which was accepted by the application and resulted in an...
Internet Bug Bounty: Cargo not respecting umask when extracting crate archives
Cargo did not respect the umask when extracting crate archives on UNIX-like systems, potentially allowing a local attacker to modify the source code compiled and executed by the current user...
Internet Bug Bounty: [CVE-2023-22796] Possible ReDoS based DoS vulnerability in Active Support’s underscore
A regular expression based Denial of Service DoS vulnerability was discovered in Active Support. The vulnerability allowed for a specially crafted string to cause the regular expression engine to enter a state of catastrophic backtracking, leading to excessive CPU and memory usage. The...
TD Bank: Reflected XSS on Admin Login Page
When you try to access private pages on the domain https://td.intelliresponse.com/a6 you are redirected to a login page, which has reflected values in the DOM from the URL on the parameter 'win'. Once there is no proper handle for the data reflected, it turns out into a vulnerable path on the...
Expedia Group Bug Bounty: Cache Poisoning Allows Stored XSS Via hav Cookie Parameter (To Account Takeover)
A cache poisoning vulnerability allowed for stored cross-site scripting XSS attacks via the "hav" cookie parameter on abritel.fr, leading to account takeover. The server had a protection mechanism that hid double quotes, but not greater than and less than symbols, which allowed the attacker to...
Nextcloud: A vulnerability classified as critical has been found in gsi-openssh-server 7.9p1 on Fedora (Connectivity Software) on server (http://95.217.64.181:22
Summary: " hello " vulnerability: GSI-OPENSSH-SERVER 7.9P1 ON FEDORA /ETC/GSISSH/SSHDCONFIG CREDENTIALS MANAGEMENT Description of problem: A vulnerability classified as critical has been found in gsi-openssh-server 7.9p1 on Fedora Connectivity Software on server http://95.217.64.181:22. This...
Hyperledger: POOL_UPGRADE request handler may allow an unauthenticated attacker to remotely execute code on every node in the network.
This issue is related to the https://github.com/hyperledger/indy-node. The issue was found in the indy-node code that handles the write request of type POOLUPGRADE in file indy-node/indynode/server/requesthandlers/configreqhandlers/poolupgradehandler.py. The additionaldynamicvalidation function...
U.S. Dept Of Defense: IDOR leaking PII data via VendorId parameter
Description: Dear DoD, I found one bug on your domain from Hack US program: █████ It's IDOR bug. Make sure to know that I didn't test many funcs here for IDOR. I didn't test for ATO Account Takeover. But you should fix this. Here's the PoC: ██████████ Thank you DoD! Impact An attacker could steal...
Internet Bug Bounty: CVE-2022-30115: HSTS bypass via trailing dot
Advisory: https://curl.se/docs/CVE-2022-30115.html Original Report: https://hackerone.com/reports/1557449 Impact HSTS bypass...
U.S. Dept Of Defense: Found Origin IP's Lead To Access ████
Discovered that the ██████ site exposed its Non-Cloudflare IP which could allow bypassing of anti-DDoS mechanisms. Your origin servers are not blocking access from non-Cloudflare servers.This way crawlers can find your origin servers' IPs by checking random IPs until they found your origin server...
Internet Bug Bounty: Renderers can obtain access to random bluetooth device without permission
With the default configuration in Electron, renderer processes which should not have access to system resources by default can gain read/write access to a nearby bluetooth device. To reproduce: Run the electron-quick-start app with a vulnerable version of Electron:...
U.S. Dept Of Defense: username and password leaked via pptx for █████████ website
Description: While performing my recon, I can accross this https://███/███████ which contain username and password for accessing your asset here █████ ████ References: ███████ Impact I tried accessing the ip but it is not working here, I f it can be accessed somewhere this will result in full...
HackerOne: HackerOne Staging uses Production data for testing
Summary: Today I received an email related to smart rewards from HackerOne. This included staging environment details, such as: sender: [email protected] Privacy / Terms links pointing to domain: https://www.enorekcah.com/... This basically tells us that HackerOne is using hacker dat...
QIWI: Subdomain Takeover on 1c-start.tochka.com pointing to unbouncepages
Actuall this report is same as of this one:- https://hackerone.com/reports/38007 Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker to set up a page on t...
U.S. Dept Of Defense: Cross site scripting
Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. Impact Malicious...
GitHub Security Lab: ihsinme:CPP Add query for CWE-415 Double Free
This bug was reported directly to GitHub Security Lab...
UPchieve: Zero click account Takeover due to Api misconfiguration 🏂🎩
Hacker reported that full account takeover was possible through exploitation of one our forms. Hacker provided sufficient information to prove capability and how to remediate. Our team remediated the issue so that the takeover is no longer possible. i was able to take over any account without any...
Stripo Inc: Stored XSS at Module Name
Summary: Hello, I found stored xss at module name with this payload "Hello : Steps To Reproduce: 1. Add new container, it doesn't matter which is it 2. Paste this payload in the module name"Hello : 3. Update it then check the module name again in setting 4. Alert Popup Stored XSS Stored cross-sit...
Rockstar Games: Open redirect on https://signin.rockstargames.com/connect/authorize/rsg
In this report, the researcher found that a previously-addressed Open Redirect vulnerability on https://signin.rockstargames.com/connect/authorize/rsg had once again become exploitable. We were able to quickly re-apply our previous solution and once again resolve the vulnerability...
Automattic: SSRF & Blind XSS in Gravatar email
Nathan Cavitt rockybandana reported a blind XSS issue in the Gravatar service, which was due to incorrect/insufficient sanitization on adding emails to one's profile. The report was of good quality and the issue was fixed within a couple of days of report...
VK.com: XSS в обработчике ссылок
XSS в парсере ссылок...
Stripo Inc: No rate limiting - Create Plug-ins
Hello team Stripo, how are you? I found a rate limit for data creation. Target = https://my.stripo.email/cabinet//plugins/293814 Request to Post: POST /cabinet/stripeapi/v1/plugin/293814/plugins HTTP/1.1 Host: my.stripo.email User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101...
Mail.ru: SDC bypass cloud.mail.ru for every /api/v3/* endpoint.
SDCS cookie was not properly checked for few cloud.mail.ru endpoints, allowing to bypass SDC secure domain cookies protection for privilege separation between projects...
BugPoC: Strict Transport Security Misconfiguration
Hello I have found security vulnerable The vulnerable URL: https://bugpoc.com/icons/bandage.svg Summary The table below shows the numbers of issues identified in different categories. Issues are classified according to severity as High, Medium, Low or Information. This reflects the likely impact ...
TikTok: [CSRF] TikTok Careers Portal Account Takeover
A missing CSRF protection and open redirect vulnerability was reported in the TikTok Careers portal single sign on flow which is used by applicants to apply for TikTok positions. This flaw was quickly remediated and does not impact TikTok.com or mobile application. We thank @lauritz for reporting...
InnoGames: Stored XSS on recruit.innogames.de
Summary: When applying for a Supporter/Moderator job at recruit.innogames.de the drop-down field "Position" is vulnerable to a stored XSS as the content is not validated. Description: Steps To Reproduce: 1. Visit https://recruit.innogames.de/staemme/de/index/page/show/apply 2. Fill out all requir...