New Relic: WordPress username enumeration (/author)

@rootbakar identified a previously-reported issue where authors could be viewed from an endpoint within our WordPress blog. As authors are intended to be public, this was closed as not having any security impact to the blog...

Dropbox: Stored XSS in dropboxforum.com

This report described a vulnerability where an attacker could put a specially crafted payload into the reply section of threads on dropboxforum.com to bypass the HTML filter on the site. This enabled a stored XSS attack against anyone viewing the message. This was an issue in Lithium forum...

Internet Bug Bounty: XML hash collision DoS vulnerability in Python's xml.etree module

Python's standard library uses libexpat to parse XML. Internally the expat library has a hash table implementation to efficiently store and lookup DTD elements like entities, elements, attributes, etc. Hash tables are potentially vulnerable to hash collision Denial-of-Service attacks, which turns...

Node.js third-party modules: [express-cart] Customer and admin email enumeration through MongoDB injection

I would like to report an injection in express-cart It allows to enumerate the email address of the customers and the administrators. Module module name: express-cart version: 1.1.7 npm page: https://www.npmjs.com/package/express-cart Module Description expressCart is a fully functional shopping...

Starbucks: Subdomain takeover on svcgatewaydevus.starbucks.com and svcgatewayloadus.starbucks.com

Hello, This is fairly close to this report however these are different subdomains than the one in the report. This can be pretty serious since I can server virtually anything I want. In the 45 minutes I've held the domain I have served to 341 unique IP addresses. Two starbucks.com subdomains are...

Nextcloud: File access control rules not enforced on image files

Installed Nextcloud from Snap package version 13.0.2snap1, revision 6916 on fresh Ubuntu 18.04 LTS install. 2. Installed and enabled Files access control v1.3.0 and Files automated tagging v1.3.0 apps. 3. As an administrator created an invisible collaborative tag Secret. 4. Added Files automated...

HackerOne: Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot

Summary: The hacktivity of a private program is visible to banned user if he gets invited to a program by hackbot. Description: Back in 2016 i was banned by █████'s private program ███ due to some conflict between me and their security team, i think they manually put me in banned users list, but...

Ed: Session Cookie Without Secure Flag

Hi Ed, The bug mentioned in the report 343095 is not yet correctly patched I believe. Previously, the Researcher reports that the cookiegitlabsession is not Secure Missing Secure Flag and u closed that report as Informative and said that "Expoitability of this issue is so low that it does not...

Monero: Buffer out of bound read in miniupnpc xml parser

Summary: This is a buffer oob read vulnerability in miniupnpc when parsing xml response. This vulnerability could result in denial of service attack in monero client to in local area Network. Description: In miniupnpc, file "Minixml.c": The funnction parseelt: static void parseeltstruct xmlparser...

Ubiquiti Inc.: UniFi Video Server web interface Configuration Restore path traversal leading to local system compromise

In UniFi Video Controller 3.9.3 and prior, an user with administrator privileges can restore the configuration using a specially crafted zip file. Due to the lack of validation for path transversal, the user can upload arbitrary files to arbitrary locations...

Node.js third-party modules: [crud-file-server] Stored XSS in filenames when directory index is served by crud-file-server

Hi Guys, crud-file-server allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript. Module crud-file-server This package exposes a directory and its children to create, read, update, and delete operations over http...

Open-Xchange: SSRF - RSS feed, blacklist bypass (IP Formatting)

FYI - Tested on local installation of App Suite 7.8.4 REV 17 Hello, There appears to be a SSRF vulnerability in the below endpoint. This is due to a failure in the App Suite code when evaluating an IP address against a blacklist. The SSRF is limited to scanning hosts on port 80/443 but accuracy i...

Semrush: Single Sing On - Clickjacking

Description: Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on. Browsers Verified In: Any Steps To Reproduce: Create HTML file containg...

U.S. Dept Of Defense: Remote Code Execution (RCE) in a DoD website

Summary: One of the DoD applications uses a java library which is vulnerable to expression language injection. Using only an URL I was able to inject java code. I made a simple PoC that requests a name resolution to a DNS server. Description: The application at https://███ uses Primefaces version...

WakaTime: Missing filteration of meta characters in all full name field on wakatime.com

Hi there Vulnerability Title: Meta characters are not filtered into full name Description You haven't filtered control meta characters such as %00 etc in full name field which allows an attacker to impersonate or hide their real identity within the application. This one is not rejected. It turns...

Shopify: XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications

Description Shopify allows developers to create a special type of application called a "Sales Channel". Developers are allowed to upload a 16x16 SVG "Navigation Icon" for their app provided the SVG follows the design guidelines which limits the allowed elements and attributes. For some reason whe...

Cuvva: Your two domain login email address are disclosed in

HI LINK: support-dashboard.corp.cuvva.co while accessing this link it takes to google authentication. then seen source page of that login page then i saw your email that used to login. POC attached. emails are: ███ ██████████ another way is to simply click on to "continue to cuvva.co" you will se...

Ubiquiti Inc.: Ability to log in as any user without authentication if █████████ is empty

Devices that can be monitored by airControl include a ticket based authentication system that allows access to the WebUI using a ticket id. This system had a flaw that allowed unauthenticated access without a valid ticket, given these requirements were met: 1. A device was monitored by airControl...

Ubiquiti Inc.: Content Spoofing or Text Injection in (403 forbidden page injection) and Nginx version disclosure via response header

Hello there, I know that this is Non-critical issue but i want you guys to be aware of it. 1. I have found a Content Spoofing or Text Injection in This url http://dl-origin.ubnt.com/ Go to this url...

Shopify: Stored XSS in https://productreviews.shopifyapps.com/proxy/v4/reviews/product

Hi , I have found a stored XSS issue in https://productreviews.shopifyapps.com Details: Going to https://productreviews.shopifyapps.com/proxy/v4/reviews/product?productid=8254331011&version=v4&shop=zh5403-attacker.myshopify.com&=cache&callback=test will show you the details of a product with the ...

Nextcloud: \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype

The SabreDAV plugin \OCA\DAV\CardDAV\ImageExportPlugin is used for displaying pictures of a VCF. It registers on a GET request on a CardDAV element and acts when the query parameter photo is sent. The logic can be seen below: / Intercepts GET requests on addressbook urls ending with ?photo. @para...

bitaccess: Missing Rate limiting for sensitive actions (like "forgot password") and reCaptcha error.

Due to a bug on session management, Rate limit was not properly applied to some functionalities on the website, which let a bad actor to send unlimited password reset emails by bypassing the Recaptcha rate limit. This was not a security issue, fixed to prevent spamming users...

Shopify: Access to Splunk at https://apt.ec2.shopify.com:8089

Description: Default Splunk admin credentials were found at https://apt.ec2.shopify.com:8089 Default credentials login:admin password:changeme See pic 1 as POC Resolution: Change credentials Please let me know if you need some extra information. Sorry if this report if out of scope, i thought it...

Nextcloud: Arbitrary File Upload in Logo & Log in image Theming setting.

Hi team First I think this vulnerability doesn't fall at your bug bounty program but this is a bad design that should fix right now cause if an attacker get admin access he still can upload a malicious file in client server side. I saw that Logo & Log in image allow to upload other files type...

Pornhub: CSV Macro injection in Video Manager (CEMI)

Missing character escaping in video title delivery of an executable CSV payload to when exporting stats to file...

HackerOne: CSV Injection via the CSV export feature

Hi , I have managed to bypass your fix for 72785 by submitting a report with NewLine character 0x0a in the title before the CSV formula. Steps to reproduce: 1. As a researcher , Submit a report to a program with the title %0A-2+3+cmd|' /C calc'!D2 , here is an example request: POST...

ok.ru: Same-Origin Policy Bypass #2

Hi, This is really similar issue to my previous report 102234 - exploitation mechanism is really same but other swf file is vulnerable. All conditions are met: - st.mycdn.me domain which is in ok.ru crossdomain.xml - Security.allowDomain'' - possibility to execute own SWF code provided by URL...

Internet Bug Bounty: Buffer Over-read in unserialize when parsing Phar

https://bugs.php.net/bug.php?id=69324 ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service buffer over-read and application crash via a crafted length value in...

Ruby on Rails: Active Record SQL Injection Vulnerability Affecting PostgreSQL

This vulnerability was reported directly to Rails. https://groups.google.com/forum/!msg/rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J...

Automattic: logout csrf app.simplenote.com/logout

Proof of Concept:...

HackerOne: Arbitrary file uploads to Amazon WS.

Hi, It seems one is able to upload arbitrary files to Amazon Webservices through the UI. This allows for uploading malware such as msf-payload-x86.jpg.exe or whatever. Beyond free hosting this could potentially be used to entice teams into downloading stuff they probably don't want. Actual...

Slack: open redirect in https://slack.com

Navigate to Https://slack.com append "/link?url=url=http://bing.com" or enter any website of your choice with http:// vulnerable link https://slack.com/link?url=http://bing.com notice that user is redirected to bing.com without being validated or notified...

Coinbase: User Enumeration, Information Disclosure and Lack of Rate Limitation on API

NOTE: I am making this email as I think the response from Coinbase originally, via my emails to them was not correct. They had not acknowledged that this flaw allowed for user enumeration and hence I am posting the report again - in hope of a proper and well evaluated response. The key security...

Node.js: Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line

The llhttp HTTP response parser in Node.js up to version 24.14.1 llhttp v9.3.0 and v9.3.1 was found to unconditionally accept a bare carriage return CR as a valid response status line terminator. This parsing asymmetry was present in the response path but not in the request parsing, enabling...

Internet Bug Bounty: CVE-2024-31079 in nginx

CVE-2024-31079 was discovered in the NGINX HTTP/3 QUIC module. When NGINX Plus or NGINX OSS were configured to use this module, undisclosed HTTP/3 requests could cause NGINX worker processes to terminate or experience other potential impact. The vulnerability was classified as a stack-based buffe...

HackerOne: View any user email using the Team's audit log section

Vulnerability description not provided...

U.S. Dept Of Defense: [█████████] Information disclosure due unauthenticated access to APIs and system browser functions

Multiple information exposure vulnerabilities were discovered in a Jira Server instance, allowing unauthenticated access to APIs and system browser functions. These vulnerabilities could be exploited by an attacker to gain unauthorized access to sensitive data and run arbitrary code on the server...

HackerOne: HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organization

A vulnerability was discovered where SAML signup domain enforcement for new signups belonging to SAML-enabled organizations could be bypassed by appending control characters, allowing unauthorized access. This was leveraged to access the HackerOne PullRequest organization and view source code in...

U.S. Dept Of Defense: CVE-2023-24488 xss on https://██████/

Vulnerability description not provided...

Nextcloud: Open redirect on "Unsupported browser" warning

An open redirect vulnerability was found in Nextcloud's UnsupportedBrowser.vue component. Attackers could construct a malicious URL that includes the redirecturl parameter and a URL of their choice, which would redirect the user to the attacker's URL without validating the decoded URL or checking...

Snapchat: internal dev tokens disclosure

Sensitive internal development information was inadvertently disclosed in the commits history of the open-source project Keydb, which was made public by Snapchat. This included a Personal Access Token PAT used for GitHub authentication, which could have been exploited by malicious actors...

Node.js: The use of __proto__ in process.mainModule.__proto__.require() bypasses the permission system in Node v19.6.1

The use of proto in process.mainModule.proto.require allowed bypassing the permission system in Node v19.6.1, enabling the loading of unauthorized dependencies...

Consensys: CSV Injection at https://assets-paris-demo.codefi.network/

Summary: Hi consensys Security Team. I have found CSV Injection when generate report at https://assets-paris-demo.codefi.network/ CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program such as Microsoft Excel or...

U.S. Dept Of Defense: External service interaction ( DNS and HTTP ) in www.████████

An External Service Interaction vulnerability was found in www.█████████, allowing an attacker to induce the application to interact with arbitrary external services such as DNS and HTTP. This could lead to various attacks, including DDoS, OS Command Injection, DOS, and Code Manipulation...

Cloudflare Public Bug Bounty: Ability to bypass locked Cloudflare WARP on wifi networks.

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

Hyperledger: Fix : (Security) Mitigate Path Traversal Bug

Unsanitized input from arg0 argument flows into java.io.FileOutputStream, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to write to arbitrary files. Impact Being able to access and manipulate an arbitrary path leads to vulnerabilities when a...

Node.js: DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)

Summary: This is an insufficient fix of CVE-2022-32212, which itself is a fix of CVE-2018-7160. There exists a specific behaviour in browsers on macOS devices when handling the http://0.0.0.0URL that allows an attacker-controlled DNS server to bypass the DNS rebinding protection by resolving host...

EXNESS: CRLF Injection - Http Response Splitting

HTTP response splitting allowed to add a malicious header to the response...

Azbuka Vkusa: Мисконфигурация Cisco Smart Install

Closed...

Courier: [3] Bypassing IP Based Rate Limit Blocking leads to rate limit bypass in Courier Login Panel

Hi team, I would like to report rate limit issue based on IP blocking mechanism. Rate-limitation nowadays is not effective anymore to protect against brute-force. There are many botnets out there which can be used to overcome this hurdle, as well as cloud VPS services e.g. Amazon AWS EIPs, Digita...