15685 matches found
Krisp: SQL Injection + Insecure Deserialization leads to Remote Code Execution on https://krisp.ai
The tenweb-speed-optimizer WordPress plugin prior to version 2.12.22 was vulnerable to unauthenticated SQL injection in /wp-json/tenwebio/v2/compress-one, which could be exploited to gain remote code execution by chaining it with insecure deserialization...
U.S. Dept Of Defense: Remote Code Execution - Unauthenticated Remote Command Injection (via Microsoft SharePoint CVE-2019-0604)
Summary: Microsoft recently released a patch for CVE-2019-0604. This vulnerability is caused by the Microsoft SharePoint application deserializing untrusted data from a user. This means an attacker can send a specially crafted/encoded parameter to a Microsoft SharePoint URL, and it will allow...
Logitech: SSRF allows reading AWS EC2 metadata using "readapi" variable in Streamlabs Cloudbot
Detailed summary is provided by the hacker below. Summary: Streamlabs Cloudbot is a customisable chatbot provided by Streamlabs which allows the creation of custom commands along with custom responses. These chat responses can take in "Variables" wrapped in curly brackets as documented in...
Cloudflare: SSRF
Hi i make report grabtaxi for SSRF But grabtaxi answer me coffeecup closed the report and changed the status to Not Applicable. Jul 26th 2 hrs ago Hello @linkks - After further review, we have determined that this is not SSRF on any of our web properties or assets. All IP's mentioned in this repo...
Deriv.com: Mailgun subdomain takeover
Summary: I have found an unclaimed subdomain of deriv.cloud. Which is successfully claimable. Platforms Affected: email.mailgun.deriv.cloud Steps To Reproduce: You just need a mailgun account and the you can successfully claim this domain. Supporting Material/References:...
HackerOne: @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.
Hola amigos, First off, I know RFCs are annoying. Second of all, namespace attacks are a btch. With that out of the way, here is an Inti-bug that was discovered as a result of reading RFC2142 very carefully. Brief summary of RFC2142 RFC2142 defines a standard set of email addresses that cover...
Autodesk: HTML Injection in Business Name Parameter in Payapps
A HTML injection vulnerability was found in Autodesk Payapps, where arbitrary HTML content could have been injected in emails sent to users on signup. The vulnerability was reported by @0xsom3a and has been fixed by Autodesk...
Internet Bug Bounty: Drupal 7 pre auth sql injection and remote code execution
Motivation I found a SQL Injection bug in Drupal $value ... $newkeys$key . '' . $i = $value; The function assumes that it is called with an array which has no keys. Example: dbquery"SELECT FROM users where name IN :name", array':name'=array'user1','user2'; Which results in this SQL Statement SELE...
DRIVE.NET, Inc.: [www.drive2.ru] CSRF through FCTX token bypass
During login on the login page, login is attempted through the FCTX token. In addition, the login page was implemented through g-recaptcha-response captcha, but an attacker can bypass g-recaptcha-response captcha without FCTX tokens, and login CSRF is possible. The issue was fixed by enabling the...
Internet Bug Bounty: netrc and redirect credential leak
The netrc file in curl could lead to the unintentional leakage of a password to a different host when following HTTP redirects, if the netrc file had an entry matching the redirect target hostname but omitting either just the password or both login and password...
Liberapay: Leaking Of Sensitive Information on Github
Summary: Sensitive Data were leaked in https://github.com/liberapay/liberapay.com Steps To Reproduce: 1. Install gitleaks from https://github.com/zricethezav/gitleaks 2. Run the following command in a Linux terminal gitleaks -v --pretty -r=https://github.com/liberapay/liberapay.com The following...
U.S. Dept Of Defense: Read-only path traversal (CVE-2020-3452) at https://█████
Summary: I discovered a vulnerability Read-only path traversal CVE-2020-3452 at https://███████ Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote...
Top Echelon Software: Public and secret api key leaked in JavaScript source
Summary: Summary the vulnerabilities I am surfing on the bb3jobboard.topechelon.com website. I found a sensitive data including authentication key written in public accessible javascript file. URL Vulnerability https://bb3jobboard.topechelon.com/!/search?page=1 Steps To Reproduce: Open...
Internet Bug Bounty: [CVE-2024-54133] Possible Content Security Policy bypass in Action Dispatch
A vulnerability was discovered in the contentsecuritypolicy helper in Action Pack of Ruby on Rails. Carefully crafted inputs were able to inject new directives into the Content-Security-Policy CSP header, potentially leading to a bypass of the CSP and its protection against cross-site scripting X...
Pornhub: SSRF and local file disclosure by video upload on https://www.tube8.com/
The researcher was successful in exploiting a vulnerability in 3rd party encoding library resulting in the execution of SSRF attacks and Local File Disclosure...
HackerOne: RCE in profile picture upload
Issue ===== The profile picture upload at /settings/profile/edit is vulnerable to remote code execution due to the uploaded file being passed to ImageMagick without checking whether it's an actual image. Combined with the fact that ImageMagick parses ASCII text as so called MVG Magic Vector...
U.S. Dept Of Defense: Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://████
Description Hello. Some time ago, researcher Orange Tsai from DEVCORE team had a talk on Defcon/BlackHat regarding Pulse Secure SSL VPN vulnerabilities fixed on 2019/4/25: CVE-2019-11510 - Pre-auth Arbitrary File Reading CVE-2019-11542 - Post-auth Stack Buffer Overflow CVE-2019-11539 - Post-auth...
Mattermost: html injection via invite members can be leads account takeover
An HTML injection vulnerability was found on the website that allowed an attacker to inject HTML code into an email invitation sent to a victim. This could lead to the victim being redirected to a malicious site or tricked into giving away login credentials...
Pornhub: XSS Vulnerability at https://www.pornhubpremium.com/premium_signup? URL endpoint
The researcher discovered an XSS-vulnerable parameter at the premiumsignup endpoint...
BTFS: Subdomain Takeover uptime
Hello Team: i can't report it to the company so i hope to accept it as a valid bug , i found subdomain takeover in your subdomain uptime.btfs.io , i found this subdomain pointed to uptimerobot and not claimed so i signedup in uptimerobot and claimed it. POC: ------ 1 - open https://uptime.btfs.io...
Snapchat: Github Token Leaked publicly for https://github.sc-corp.net
Description : GitHub is a truly awesome service but it is unwise to put any sensitive data in code that is hosted on GitHub and similar services as i was able to find github token indexed 7 hours Ago by user ██████ - Software Engineer - Snap Inc Issue & POC : You can find the leak in this link :...
LocalTapiola: DoS of www.lahitapiolarahoitus.fi via CVE-2018-6389 exploitation
Description There is possibility in /wp-admin/load-scripts.php script to generate large 3Mb amount of data via simple non-authenticated request to server. The vulnerability is registered as https://vulners.com/cve/CVE-2018-6389 Details Detailed attack scenario is described for example here:...
Sifchain: CORS Misconfiguration
Summary: An cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of th...
Valve: [Portal 2] Remote Code Execution via voice packets
Description RCE can be achieved on other players via voice packets due to the lack of length validation when reading into a stack based buffer. POC 1. As the victim, invite the attacker into a game. 2. Wait until both players have loaded into the game. 3. Inject the following DLL into the attacke...
Node.js: Node Installer Local Privilege Escalation
Node is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. To demonstrate thi...
JamieWeb: Insecure Transportation Security Protocol Supported (TLS 1.0) on https://www.jamieweb.net
Summary: https://www.jamieweb.net still support TLS 1.0 protocol which has several flaws. Vulnerability: With a SSL security scanner i was able to identify that an insecure transportation security protocol TLS 1.0 is still supported by your web server. TLS 1.0 has several flaws. An attacker can...
Node.js: CRLF Injection in legacy url API (url.parse().hostname)
Summary: There is CRLF Injection in legacy url.hostname API. Description: During the recent penetration test, I have found a whitelist bypass using CRLF Injection. We did a code review and determined the issue is in a legacy url.hostname API. Not sure if it's a known issue or not, I wasn't able t...
Shopify: Subdomain takeover on s3.shopify.com
Preword I know that this is not explicitly in scope, but I still felt it was serious enough to justify a report and let you decide the potential impact. Description The subdomain s3.shopify.com was pointed using CNAME to Amazon S3, but no bucket with that name was registered. This meant that anyo...
Weblate: CSV export filter bypass leads to formula injection.
Dear Weblate bug bounty team, Summary --- The new filter can be bypassed using: %0A-3+3+cmd|' /C calc'!D2. python text = "%0A-3+3+cmd|' /C calc'!D2" def csvfilterbypass: if text and text0 in '=', '+', '-', '@': return "'" + text return text How can this be fixed? --- You need to escape and detect...
Zomato: Clickjacking: Delete Account, Change privacy settings, Rate business, follow/unfollow (IE)
Inspired by report 337219. Please note that this report includes a clear security impact as well as a proof of concept. CVSS ---- medium 5.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L Description ----------- The application does not send a X-Frame-Options header, thus allowing pages to be...
U.S. Dept Of Defense: springboot actuator is leaking internals at ██████████
Proof of Concept If you go to https://█████████/actuator you'll get a complete overview of all the endpoints that are accessable Suggestion: Use a Firefox Browser if possible, its json representation is well formed and the links are clickable ██████████ Impact Information Disclosure...
Rockstar Games: Bypass CAPTCHA protection
In this report, the researcher found that it was possible to bypass our CAPTCHA check by injecting a random value into the X-Forwarded-For header in the sign in POST request. At the time the researcher submitted this report, we only enforced CAPTCHA checks on sign-in requests that had failed...
Dropcontact: Django DEBUG mode enabled and leaked system information.
We were leaking / showing system information. Django DEBUG mode was enabled and showing some information on some errors.I just follow the errors and finally got some sensitive system information such as configuation ,API keys ,Database users ,System Directories,etc...
██████: Golden techniques to bypass host validations in Android apps
███...
Pornhub: DOM-based XSS on youporn.com (main page)
The researcher found a DOM-based XSS on the youporn.com main page. The malicious input could be injected into JS comment section //jscomment. Using CRLF %0d%0a in the , it was possible to escape from JS comment section, and execute arbitrary JavaScript. Simple alert box, and crossdomain request...
Starbucks: Java Deserialization RCE via JBoss on card.starbucks.in
The researcher discovered that a Starbucks online system running on the domain http://card.starbucks.in/ performs deserialization of java objects that are submitted by users on a specific path belonging to JBOSSMQ without sanitizing/validating the data. As a result, an attacker can inject a...
Mail.ru: [mobs.mail.ru] nginx path traversal via misconfigured alias
Domain, site, application -- mobs.mail.ru Steps to reproduce -- http://mobs.mail.ru/media../mobs/settings.py Actual results -- py ... SECRETKEY = '████████████' ... DISTIMOPRIVATEKEY = '████████████' ... PoC, exploit code, screenshots, video, references, additional resources --...
ownCloud: Apache Range Header Denial of Service Attack (Confirmed PoC)
owncloud.com is vulnerable to Apache range header denial of service. This was confirmed by injecting Range: header payloads and analyzing the request vs. response times to an arbitrary page. The results confirm that processing times took up to 50,000 milliseconds per request when the range header...
Khan Academy: Weak Ciphers Enabled
Vulnerability Details:- I detected that weak ciphers are enabled during secure communication SSL. You should allow only strong ciphers on your web server to protect secure communication with your visitors. Impact:- Attackers might decrypt SSL traffic between your server and your visitors. Remedy:...
UPchieve: Session Hijacking leads to full control of account by attacker
Hi Team , I am Samprit Das MCEH Metaxone Certified Ethical Hacker and a Security Researcher I just checked your website and got a critical vulnerability please read the report carefully. Description:- The Session Hijacking attack consists of the exploitation of the web session control mechanism,...
U.S. Dept Of Defense: CVE-2020-3187 - Unauthenticated Arbitrary File Deletion
A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...
U.S. Dept Of Defense: Remote Code Execution through DNN Cookie Deserialization
Summary: The application at https://████████ presents a deserialization vulnerability that permits RCE and file read/write Step-by-step Reproduction Instructions 1. Navigate to a random page that must return a 404 Error status like https://████/test 2. Add this cookie in the request header:...
Omise: Facebook Username Takeover via Broken Link in Footer
The Facebook username associated with the broken link in the footer was available for takeover. This could have allowed an attacker to create a fake Facebook page and mislead users into trusting it...
HackerOne: HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension
An HTML injection vulnerability was discovered on HackerOne.com through the H1 Triage Wizard Chrome Extension. An attacker could inject malicious code into the triage questionnaire modal, potentially leading to the compromise of confidential information or impacting its integrity...
U.S. Dept Of Defense: [CVE-2020-3452] Unauthenticated file read in Cisco ASA
I found out that https://███/ was vulnerable to CVE-2020-3452. The IP has a SSL certificate pointing to DoD. curl -kv https://██████████/ Output: Server certificate: subject: █████ Impact Anyone can read any file present on the server. System Hosts ████ Affected Products and Versions CVE Numbers...
Logitech: Host Header injection in oslo.io (using X-Forwarded-For header) leading to email spoofing
Hello team I hope it will be a happy year for you and for me 😇 Summary: I found Host Header injection in oslo.io I tried to use it to show the security effect on users And I found this Steps To Reproduce: 1. Well, first of all, enter your project 2.Make an invitation by email 3.Now through the...
CS Money: Pixel Flood Attack leads to Application level DoS
Summary: Hello Team, I had gone through your policy and I saw that DoS is out of scope but I am not sure about Application level DoS. The another reason to report this attack because it affects real customers who want to chat with your support team. I had tested this with two accounts 1. From...
Acronis: Subdomains takeover of register.acronis.com, promo.acronis.com, info.acronis.com and promosandbox.acronis.com
Summary: The Subdomains https://register.acronis.com, https://promo.acronis.com, https://info.acronis.com and https://promosandbox.acronis.com are vulnerable to takeover due to unclaimed marketo CNAME records. Anyone is able to own these subdomains at the moment. This vulnerability is called...
QIWI: [send.qiwi.ru] Soap-based XXE vulnerability /soapserver/
An XML external entities injection vulnerability exists on the soap server hosted on send.qiwi.ru. The attack allows an attacker to open local files although perhaps not return the data, see below, leading at best to a DoS. Often this attack can be used to extract files from the server such as...