curl: An integer overflow found in /lib/urlapi.c

Summary: libcurl contains a heap-based buffer overrun in /lib/urlapi.c. A similiar issue to CVE-2018-14618. Steps To Reproduce: analysis I found a potential integer overflow which may lead to a buffer overrun in /curl/lib/urlapi.c. In function seturl, urllen was multiplied by 2 and then passed to...

OLX: web cache deception in https://tradus.com lead to name/user_id enumeration and other info

summary Hi OLX team, i found a web cache deception vulnerability in https://tradus.com. With this vulnerability an attacker can gain access to the name of the victim user, the userid and other informations. Attack scenario 1 an attacker send to the victim a link to the malicious page like the PoC...

Chaturbate: Unrestricted POST request size on /customer_support/information_form/ endpoint

The hacker found that a form on the billing site had a high post size limit that could cause increased load. This was lowered to a reasonable amount. This had no effect on any stored data...

Node.js third-party modules: [webpack-bundle-analyzer] Cross-site Scripting

I would like to report Cross-site Scripting in webpack-bundle-analyzer. It allows injecting and executing arbitray JavaScript code. Module module name: webpack-bundle-analyzer version: 3.0.3 npm page: https://www.npmjs.com/package/webpack-bundle-analyzer Module Description Visualize size of webpa...

MyCrypto: SPF Records (SMTP protection not used)

Hello MyCrypto Team , I am checking your website and found something is missing in SPF record.I don't find you have applied strict SMTP policy to stop spoofed email sending from your domain. I would like to recommend you to read the following article :...

Mail.ru: ОДМИН ТЭСТ

Test script on jw-cn-test-1.ext.terrhq.ru could be used to disclosure local database account. Database itself was not accessible...

QIWI: XXE on ██████████ by bypassing WAF ████

XXE on ■■■■■■.qiwi.com with WAF bypass The endpoint on ██████ accepts a POST request with an XML document. A Web-Application Firewall WAF successfully blocked all requests that contained any of the keywords !DOCTYPE, !ENTITY or !ELEMENT, that are necessary for XXE attacks to be successful. Howeve...

Internet Bug Bounty: XML hash collision DoS vulnerability in Python's xml.etree module

Python's standard library uses libexpat to parse XML. Internally the expat library has a hash table implementation to efficiently store and lookup DTD elements like entities, elements, attributes, etc. Hash tables are potentially vulnerable to hash collision Denial-of-Service attacks, which turns...

HackerOne: User login page doesn't implement any form of rate limiting

Hi Team, Summary: As a best practice a login page should have a rate limitting just like hackerone.com Vulnerable Request POST /auth/postlogin HTTP/1.1 Host: ctf.hacker101.com User-Agent: Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://ctf.hacker101.com/...

Vanilla: Vanilla Forums Xenforo password splitHash Unserialize Remote Code Execution Vulnerability

Summary: An authenticated admin user can inject an unserializable password in a another users account. Later when attempting a login with that user, the attacker can trigger a call to an unserialize in the splitHash function. By using a custom pop chain to write into the constants.php file, an...

Shopify: Open redirection in OAuth

steps to reproduce: 1-Open your shopify partner account. 2-Create an app and click on test your app. 3-Select a development store you own. 4-Intercept the request using burpsuite and change the "installappSelect a store" parameter to any store with no validation. The request like this: POST...

Node.js third-party modules: [flintcms] Account takeover due to blind MongoDB injection in password reset

I would like to report a privilege escalation vulnerability in flintcms. It allows to reset a known user password, extract its password reset token and reset its password to then access the account. Module module name: flintcms version: v.1.1.9 npm page: https://www.npmjs.com/package/flintcms...

Starbucks: Subdomain takeover on svcgatewaydevus.starbucks.com and svcgatewayloadus.starbucks.com

Hello, This is fairly close to this report however these are different subdomains than the one in the report. This can be pretty serious since I can server virtually anything I want. In the 45 minutes I've held the domain I have served to 341 unique IP addresses. Two starbucks.com subdomains are...

Upserve : OLO Total price manipulation using negative quantities

Manipulating an order request JSON object, containing an additional item with a negative quantity directly manipulates the total amount of the order. In the following JSON request, an order is submitted for 2 ChickenBurgers $12 each, as well as -1 BreadPuddings $9 each. The total price after tax...

Starbucks: SQL Injection Proof of Concept for Starbucks URL

browser: firefox quantum 60.0.1 64 bit os: windows 10 sqli type: char formula injection info found: oracle database system url: https://www.starbucks.de/coffee/our-coffees/format/whole-bean injected url using oracle concatenation and char functions:...

Zomato: URL is vulnerable to clickjacking

The browser has verified the identity: Successfully implemented in IE browser Reproduce steps: URLs do not have X-FRAME-OPTIONS set to DENY or SAMEORIGIN, and they are vulnerable to clickjacking. Run under the browser's code and you will see that the listed links are vulnerable to clickjacking...

Node.js third-party modules: Prototype pollution attack (deep-extend)

As discussed in 309391, here's the separate report for each of the library. This one is the information for the deep-extend library. Module: deep-extend Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part of...

Node.js third-party modules: [hekto] Path Traversal vulnerability allows to read content of arbitrary files

Hi Guys, There is Path Traversal vulnerability in hekto module, which allows to read arbitrary file from the remote server. Module hekto This package exposes a directory and its children to create, read, update, and delete operations over http. https://www.npmjs.com/package/hekto version: 0.2.0...

Node.js third-party modules: [glance] Path Traversal in glance static file server allows to read content of arbitrary file

Hi Guys, There is Path Traversal vulnerability in glance module. This issue allows to read arbitrary files from the server, where glance is installed. Module glance a quick disposable http server for static files https://www.npmjs.com/package/glance Stats 33 downloads in the last day 34 downloads...

U.S. Dept Of Defense: 2 vulnerabilities of arbitrary code in ████████ - CVE-2017-5929

Summary: GitHub repo: https://github.com/████████ QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. High Severity Arbitrary Code Execution Vulnerable module: ch.qos.logback:logback-core Introduced through:...

VK.com: CSRF Добавить просмотр к записи без ведома пользователя.

Отсутствие параметра hash при учете просмотра записей. Отсутствовал параметр hash при учете просмотра записей. Можно было вести массовую накрутку просмотров на посты. При этом просмотры крутились даже в частную группу, несмотря на то, что у нас к ней не было доступа. POC выглядел так:...

Shopify: XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications

Description Shopify allows developers to create a special type of application called a "Sales Channel". Developers are allowed to upload a 16x16 SVG "Navigation Icon" for their app provided the SVG follows the design guidelines which limits the allowed elements and attributes. For some reason whe...

RubyGems: Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier

Description: The RubyGems client supports a gem server API discovery functionality, which is used when pushing or pulling gems to a gem distribution/hosting server, like RubyGems.org. This functionality is provided via a SRV DNS request to the users gem source hostname prepended with...

Informatica: [wave.informatica.com]- Subdomain missconfiguration

One of your subdomain https://wave.informatica.com has a CNAME record that resolved to ghs.google.com and shows 404 error when navigating to subdomain. You should remove CNAME entry for that subdomain pointing towards ghs.google.com. Although I couldnt verify the domain ownership process to fully...

Nextcloud: Missing Rate Limit for Current Password field in nextcloud.com

There is no rate limit enabled for "Current Password" field on Setting page of nextcloud.com. A malicious minded user can continually tries to brute force an account password...

Nextcloud: Disclosure of administrators via JSON on nextcloud.com Wordpress

@rbcafe reported the following issue, since it contains references to internal data we've decided to disclose this issue only limitedly. ------- Greetings, Description : ---------------- Since the update of the website to wordpress 4.7 the JSON discloses administrators : POC : ----------------...

X (Formerly Twitter): Remote Unrestricted file Creation/Deletion and Possible RCE.

Hello Gents, During my research on Twitter BBP, I found below domain name: Reverb.twitter.com Background: We worked with Twitter to develop TwitterReverb, an application that reveals how conversations arise and reverberate across the entire Twitter landscape. The custom application allows visitor...

Gratipay: Secure Pages Include Mixed Content

Hello, The page includes mixed content, that is content accessed via HTTP instead of HTTPS. tag=img src=http://www.gravatar.com/avatar/abbcd6344e160597fb2694f25c46149f.jpg?s=256&d=http%3A%2F%2Fwww.openstreetmap.org%2Fassets%2Fusers%2Fimages%2Flarge-8d2e51c2ddd01eb899f4bfb0bca3cf5e.png Evidence:...

Uber: Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront

Hi, 3 hours ago, rider.uber.com was responding like this: F127137 This happened on both HTTP and HTTPS. Now, as our blog post from last week says: https://labs.detectify.com/2016/10/05/the-story-of-ev-ssl-aws-and-trailing-dot-domains/ This means that there's a high chance this domain does not hav...

Instacart: WordPress Authentication Denial of Service

Hi, I found out that you are using WordPress version 4.5.3. Researchers found out 5 days ago, that this version has a vulnerability, a Path traversal in WordPress Core Ajax handlers. Intro WordPress is web software that can be used to create a website, blog, or app. A path traversal vulnerability...

Internet Bug Bounty: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)

I found some vulnerable code that leads to the memory leak in exifprocessIFDinTIFF. Let take look at code chunk : if !ImageInfo-Thumbnail.data && ImageInfo-Thumbnail.offset && ImageInfo-Thumbnail.size && ImageInfo-readthumbnail ImageInfo-Thumbnail.data = safeemallocImageInfo-Thumbnail.size, 1, 0;...

ownCloud: [doc.owncloud.org] CRLF Injection

PoC: http://doc.owncloud.org/%23%0dSet-Cookie:crlf=injection;domain=.owncloud.org; HTTP Response: HTTP/1.1 301 Moved Permanently\r\n Date: Wed, 27 Jul 2016 07:58:47 GMT\r\n Server: Apache\r\n Location: https://doc.owncloud.org/\r injection \r Set-Cookie:crlf=injection;domain=.owncloud.org;\r\n...

GoCD: X-Content-Type-Options header missing at Auth Login

Hello Again, The doesn't have a header settings for X-Content-Type Options which means it is vulnerable to MIME sniffing. The only defined value, "nosniff", prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. This also applies to Google...

Mail.ru: [upload-X.my.mail.ru] /uploadphoto Insecure Direct Object References

При загрузке аудио-файла с помощью сценария https://upload-14.my.mail.ru/uploadaudio отсутствует проверка принадлежности указанного playlistid текущему пользователю. Пример добавленного файла в чужой плейлист: https://my.mail.ru/music/playlists/18226273862 Пример запроса: POST /uploadaudio HTTP/1...

Pornhub: CSV Macro injection in Video Manager (CEMI)

Missing character escaping in video title delivery of an executable CSV payload to when exporting stats to file...

Internet Bug Bounty: CVE-2016-0799 memory issues in BIO_*printf functions

https://github.com/openssl/openssl/commit/9cb177301fdab492e4cfef376b28339afe3ef663...

ownCloud: Information Exposure Through Directory Listing

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-062 Product: ownCloud Manufacturer: ownCloud Inc., Community Affected Versions: ownCloud = 8.2.1, = 8.1.4, = 8.0.9 Tested Versions: 8.1.1, 8.1.4 Vulnerability Type: Information Exposure Through Directory Listing CWE-548 Risk...

Instacart: Cookie-Based Injection

Hi Security Team instacart I'm Found Vulnerability Cookie-Based Injection It's may be possible to steal or manipulate session and cookies if attacker can injection XSS . details --- in path /help/ contain header in cookie paramter ahoyvisitor and ahoyvisit it's allow injection because re request...

HackerOne: Content Spoofing - External Link Warning Page

Here is example link: Click Here Raw Data: Click Here Issue: In External link warning page, this link shown as plain text and no forced URL encoded, leading an attacker to frame sentences and trick users. In given example, attacker can trick user to click 'Proceed' button saying it will redirect...

HackerOne: Homograph attack

Hi, I would like to report an incomplete fix of 58612 is. In short, backslash is not taken in consideration. PoC \http://ebay.com http://ebay.com...

Internet Bug Bounty: Memory Corruption in phar_parse_tarfile when entry filename starts with null

https://bugs.php.net/bug.php?id=69453...

Internet Bug Bounty: ZIP Integer Overflow leads to writing past heap boundary

https://bugs.php.net/bug.php?id=69253 Integer overflow in the zipcdirnew function in zipdirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service...

Airbnb: Vulnerability type xss uncovered in airbnb.es

The vulnerability is exploited doing an upload of the file Exploit attached in this conversation as profile photo...

Internet Bug Bounty: Use after free during the StageVideoAvailabilityEvent can result in arbitrary code execution

An attacker can register the StageVideoAvailabilityEvent and have the SWF movie reloaded at the same time with LoadMovie. During this process, an object may be freed allowing the attacker to take control of the code flow. Identified as CVE-2015-0315, and reported to Adobe via Chrome VRP:...

Internet Bug Bounty: Adobe Flash Player Out-of-Bound Read/Write Vulnerability

I. Summary Adobe Flash Player is prone to a vulnerability which leads to Out-of-Bound access of memory. During the compilation of a malformed regular expression, relevant operations would cause Out-of-Bound Read/Write of stack and heap memory. Successful exploits may allow an attacker to gain...

Coinbase: Simultaneous Session Logon : Improper Session Management

Hi, I would like to report this bug related to improper simultaneous logon. Issue: 1 When a user is logged in to the application already authenticated, visits the login page https://coinbase.com/signin he/she should directly get redirected to their home page as there is already a session running...

Mail.ru: Admin panel of http://tp-test1.corp.mail.ru/ is acccessible publicly

http://tp-test1.corp.mail.ru/ link has various operations which should not be accessible to an anonymous user. As admin panel is accessible an attacker can use this information in targeted attack and he can bruteforce the username and password. on the other side server information is easily...

Mail.ru: rs.mail.ru - Flash Based XSS

Hi, I found a flash based XSS in rs.mail.ru. Vulnerable link: http://rs.mail.ru/b27161485.swf?link1=javascript:alertdocument.domain Just click on the page and you will see the alert. Tested on Mozilla Firefox Regards, Florin...

Khan Academy: Lighttpd version disclosure / directory listing

Hello there, the website at http://graphite.khanacademy.org/ isn't configured correctly. It displays the lighttpd version as well the directory contents. You should disable these features in your lighttpd.conf / php.ini. PoC: Index of / Name Last Modified Size Type Parent Directory/ - Directory...

Yahoo!: SQLi on http://sports.yahoo.com/nfl/draft

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...