15405 matches found
Snapchat: CreatorID leaked from public content posted to SnapMaps
TL;DR - the Snap Map media responses unnecessarily return a creatorId. The creator's Snap username cannot be immediately derived from creatorId, but users can use the creatorId to correlate multiple public snaps with that creator. The impact is limited by the fact that all Our Story Snaps that...
Mail.ru: [staging.tarantool.org] Github Pages Subdomain-take-over
Unused staging.tarantool.org subdomain was delegated to github pages and was not claimed...
Glassdoor: XSS at https://www.glassdoor.com/Salary/* via filter.jobTitleExact
Summary: There exists a Cross Site Scripting and Content Injection vulnerability at https://www.glassdoor.com/Salary/ via the filter.jobTitleExact query parameter. Using URL encoded HTML entities, it is possible to inject HTML content and break out of the context of a tag. The WAF does a good job...
Kubernetes: Kubelet resource exhaustion attack via metric label cardinality explosion from unauthenticated requests
Report Submission Form Summary: Malicious clients can potentially DOS a kubelet by sending a high amount of specially crafted requests to the kubelet's HTTP server. For each request the kubelet updates/sets 3 metrics: - kubelethttprequeststotal Counter - kubelethttprequestsdurationseconds Histogr...
Internet Bug Bounty: tcpdump: CVE-2018-14879 - buffer overflow in tcpdump.c:get_next_file()
The release of tcpdump 4.9.3 brought many bug fixes, including one I submitted, CVE-2018-14879. The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:getnextfile. ==2288==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe363769bf at pc...
Informatica: accounts.informatica.com - RCE due to exposed Groovy console
Researcher identified a misconfigured "Groovy" panel on an AEM web application that was vulnerable to RCE. The panel was subsequently disabled...
HackerOne: [Bypass #645264] Report title disclosure despite the program settings for email notification is set to "No Content"
Hi Team, Summary: There is newly disclosed resolved report Program Email Nofication settings ignored when being added as an external contributor, However i found that the fix is incomplete. I have found that email invitation for a collaborator bounty splitting still disclosing the Report title in...
Nextcloud: Content Spoofing /Text Injection in https://docs.nextcloud.com
Hello Team, I have found a Content Spoofing / Text Injection on this domain https://docs.nextcloud.com Go to https://docs.nextcloud.com/!!!ATENTION!%20This%20server%20is%20on%20Maintenance%20please%20go%20to%20WWW.EVIL.COM%20%20%20%20%20%20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%...
Shopify: any staff members have the ability to comment in [discounts] he/she can disable comment section it to other staff even the admin of the store
Hi, I found this cool behavior by mistake when I was testing for some GraphQL, any user have ability to comment in discounts code at discounts section can turn off comments to the other staff members include the admin/manager of the store. this happens because when the GraphQL used to create a...
Shopify: DOM XSS via Shopify.API.Modal.initialize
Similar 422043 & 576532 Payload Based on 576532: html function attack const ctx = window.openlocation.origin+'/admin/themes', 'blank' const json = message: "Shopify.API.Modal.initialize", data: src: "" let interval; interval = setIntervalfunction if window.attackSuccess clearIntervalinterval else...
Chaturbate: Unrestricted POST request size on /customer_support/information_form/ endpoint
The hacker found that a form on the billing site had a high post size limit that could cause increased load. This was lowered to a reasonable amount. This had no effect on any stored data...
Razer US: Razer Synapse 3 Chromasdk.io Root CA with Private Key Re-use
The researcher found that a root certificate was preinstalled with the Chroma SDK with a exposed private key. He assisted us in testing a fix. This was integrated into the codebase in May and published at the end of June. We appreciate his assistance working with us on this issue. Razer Synapse 3...
Internet Bug Bounty: ChaCha20-Poly1305 with long nonces
This report relates to CVE-2019-1543, https://www.openssl.org/news/secadv/20190306.txt, which I reported to the OpenSSL maintainers a few days ago. OpenSSL accepts nonces for the AEAD cipher ChaCha20-Poly1305 of up to 16-bytes. This support is advertised in the OpenSSL documentation and via the...
Shopify: Bypass GraphQL rate limit by abusing negative cost queries
Hi security team, While looking into the graphql app I noticed an interesting implementation where each app has a bucket of query cost they are allowed to used in a given time with a certain refresh rate associated with it. The details can be found at...
Node.js third-party modules: [webpack-bundle-analyzer] Cross-site Scripting
I would like to report Cross-site Scripting in webpack-bundle-analyzer. It allows injecting and executing arbitray JavaScript code. Module module name: webpack-bundle-analyzer version: 3.0.3 npm page: https://www.npmjs.com/package/webpack-bundle-analyzer Module Description Visualize size of webpa...
Pornhub: Mobile Reflect XSS / CSRF at Advertisement Section on Search page
The researcher identified a search query parameter vulnerable to cross-site scripting in the Mobile view. It is same vulnerability of redtube's mobile search page. The report is 380246 . This vulnerability is performed XSS because protecting with adding slashes at double quoters. At the tag's...
HackerOne: Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabled
Hi HackerOne Team, Summary: I have found a critical bug but this will require a bit user interaction, BUT please take note that once exploited, a hackerone user's PII - personally identifiable information can be exposed. I have found this bug by using the sandbox with swag reward enabled . --- Le...
Greenhouse.io: DoS through cache poisoning using invalid HTTP parameters
I was taking a look into a related report https://hackerone.com/reports/298265 and I discovered that the https://boards.greenhouse.io/embed/jobboard/js?for= endpoint doesn't throw errors when I try to pass in an array of for parameters like this:...
Snapchat: Takeover 2 MAIN DOMAINS of a company Acquired by Snapchat
Hi, As you may realize I noted "Domain" and not subdomain because actually, I was able to take over the MAIN domain of a company Acquired by Snapchat. As you can see in the screenshot below, when you type "Addlive" in Google https://goo.gl/EAxBaj , the first two results will be: F261984 First one...
Trello: Trello Gold accounts free for 1 year
It is possible to create Trello Gold accounts and use it for free for 1 year. The issue lies in credit card validation. PoC: 1. Create a new trello account 2. After verification, go to Profile Trello Gold 3. Choose billed annually, enter a valid credit card number with $0 on it. and click on...
GitLab: GitLab CI runner can read and poison cache of all other projects
The GitLab CI runner allows users to cache files and directories in between runs. These files are stored in a ZIP file and uploaded to a shared cache instance. In my testing, the files were uploaded to runners-cache-4-internal.gitlab.com and runners-cache-3-internal.gitlab.com, even for dedicated...
Shopify: stored xss in invited team member via email parameter
Hey there, while testing your program I found a stored XSS vulnerability which can placed by owners or other staff members who have ability to manage members and it will triggered by visiting invited team member page e.g. https://partners.shopify.com/642416/invitations/15406. Reproduction Steps 1...
Weblate: Add another email address without verification
Introduction In the normal case, to link another email address to the Weblate account, users need to own the email address and click the verification link. However, I found an issue, that allows adding another email address without clicking on the verification link. Description and PoC: Create a...
Internet Bug Bounty: CVE-2017-1000101: cURL: URL globbing out of bounds read
FYI, this security advisory will not be released until 9 August 2017: curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an...
Mixmax: Subdomain takeover (sales.mixmax.com)
Unused DNS record was reported, we promptly removed...
Cuvva: Your two domain login email address are disclosed in
HI LINK: support-dashboard.corp.cuvva.co while accessing this link it takes to google authentication. then seen source page of that login page then i saw your email that used to login. POC attached. emails are: ███ ██████████ another way is to simply click on to "continue to cuvva.co" you will se...
Weblate: Insecure Account Removal #2
Hi Team, This report is the pretty much same of my closed report here: 223355 , the difference is BUG2 when a user created an account BUT did not supply the password, therefor there is nothing to reauthenticate when deleting the account, it will successfully delete the account without supplying...
HackerOne: HackerOne reports escalation to JIRA is CSRF vulnerable
Summary: HackerOne reports escalation to JIRA is CSRF vulnerable Description Include Impact: An attacker can steal private reports details through a CSRF in HackerOne report escalation to JIRA implementation. CSRF GET https://hackerone.com/reports/REPORTNUMBER/escalate Optional: Supporting...
Nextcloud: CSRF token validation is missing
Greetings, Hello Security Team, Summary I know this is a medium risk issue but i want you guys to be aware of it that the CSRF token validation is missing at the time of login on https://portal.nextcloud.com/login.php login page. PoC Code: Email Password Login Now Forgot Password? var tabs = '';...
X (Formerly Twitter): [Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME
Hi, The following endpoints are exposed to reflected cross-site scripting by way of a vulnerable "plupload.flash.swf" component on WordPress. A comprehensive explanation of this vulnerability can be found on resolved report 134738: WordPress is vulnerable against a Same-Origin Method Execution SO...
RubyGems: Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier
Description: The RubyGems client supports a gem server API discovery functionality, which is used when pushing or pulling gems to a gem distribution/hosting server, like RubyGems.org. This functionality is provided via a SRV DNS request to the users gem source hostname prepended with...
Legal Robot: Cross Site WebSocket Hijacking
Description: The given URL fails to validate Origin header- leading to Cross-Site WebSocket Hijacking. Impact: The impact, however, depends on how the server is configured. For example, it might require an authentication token which are user specific. In such cases, it might not be as sever as it...
Rockstar Games: Control Character Injection In Messages
This report involved the injection of control characters, such as Null Byte 0x00, into vulnerable fields in the Message endpoints in order to cause unexpected, harmful behaviors. Our solution was to both block control characters from being saved on the backend when included in user-input, as well...
Automattic: Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.com
Product / URL https://en.instagram-brand.com/wp-json/brc/v1/login/ Description and Impact An attacker can perform account takeover by leveraging following two vulnerabilities: Auth Bypass = Username Enumeration + Login Brute Force A. Username Enumeration: ------------------------------- For the...
Nextcloud: Disclosure of administrators via JSON on nextcloud.com Wordpress
@rbcafe reported the following issue, since it contains references to internal data we've decided to disclose this issue only limitedly. ------- Greetings, Description : ---------------- Since the update of the website to wordpress 4.7 the JSON discloses administrators : POC : ----------------...
Shopify: Stored XSS in https://productreviews.shopifyapps.com/proxy/v4/reviews/product
Hi , I have found a stored XSS issue in https://productreviews.shopifyapps.com Details: Going to https://productreviews.shopifyapps.com/proxy/v4/reviews/product?productid=8254331011&version=v4&shop=zh5403-attacker.myshopify.com&=cache&callback=test will show you the details of a product with the ...
Rockstar Games: Reflected XSS via #tags= while using a callback in newswire http://www.rockstargames.com/newswire
Hello, Here's the link: http://www.rockstargames.com/newswire/tags/?tags=../../commentsdal/users/getGlobalLoginSettings.json?callback=alert%28document.domain%29// Thanks, Ben...
Pornhub: CSV Macro injection in Video Manager (CEMI)
Missing character escaping in video title delivery of an executable CSV payload to when exporting stats to file...
Automattic: WordPress SOME bug in plupload.flash.swf leading to RCE
Intro == WordPress is vulnerable against a Same-Origin Method Execution SOME vulnerability that stems from an insecure URL sanitization problem performed in the file plupload.flash.swf. The code in the file attempts to remove flashVars ¹ in case they have been set GET parameters but fails to do s...
Mail.ru: Logical Vulnerability : REDIRECTING on pw.mail.ru by Parameter Spoofing
Hi Mail.ru, I was surfing in your website and i was trying to find a Reflected Cross-site Scripting Vulnerability , So i was trying to find a way to inject my payload in a LINK . While Surfing i've found this link : https://pw.mail.ru/validate/index.html?refurl=pw.mail.ru Screenshot :...
ownCloud: Information Exposure Through Directory Listing
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-062 Product: ownCloud Manufacturer: ownCloud Inc., Community Affected Versions: ownCloud = 8.2.1, = 8.1.4, = 8.0.9 Tested Versions: 8.1.1, 8.1.4 Vulnerability Type: Information Exposure Through Directory Listing CWE-548 Risk...
Internet Bug Bounty: Arbitrary code execution in str_ireplace function
https://bugs.php.net/bug.php?id=70140...
HackerOne: Content Spoofing - External Link Warning Page
Here is example link: Click Here Raw Data: Click Here Issue: In External link warning page, this link shown as plain text and no forced URL encoded, leading an attacker to frame sentences and trick users. In given example, attacker can trick user to click 'Proceed' button saying it will redirect...
Internet Bug Bounty: Adobe Flash Player Out-of-Bound Read/Write Vulnerability
I. Summary Adobe Flash Player is prone to a vulnerability which leads to Out-of-Bound access of memory. During the compilation of a malformed regular expression, relevant operations would cause Out-of-Bound Read/Write of stack and heap memory. Successful exploits may allow an attacker to gain...
Internet Bug Bounty: LZ4 Core
Lab Mouse Security Report LMS-2014-06-16-6 Report ID: LMS-2014-06-16-6 CVE ID: CVE-2014-4611 Researcher Name: Don A. Bailey Researcher Organization: Lab Mouse Security Researcher Email: donb at securitymouse.com Researcher Website: www.securitymouse.com Vulnerability Status: Reported / No respons...
Sandbox Escape: Win32k Window Handle Vulnerability (EoP)
This bug was disclosed directly to Microsoft. http://technet.microsoft.com/en-us/security/bulletin/ms14-003...
HackerOne: Session Management
Hackerone fails to expire the session cookie from the server side even when the user logs off upon clicking "Sign-Out" from the application. The cookie is cleared from the client side browser, but is not cleared from the server side. If reused, it provides access to the user's account. Upon loggi...
AWS VDP: AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF
Vulnerability description not provided...