Nextcloud: Disclosure of administrators via JSON on nextcloud.com Wordpress

@rbcafe reported the following issue, since it contains references to internal data we've decided to disclose this issue only limitedly. ------- Greetings, Description : ---------------- Since the update of the website to wordpress 4.7 the JSON discloses administrators : POC : ----------------...

Internet Bug Bounty: Use of uninitialized memory in unserialize()

The following is a copy of the bug report at https://bugs.php.net/bug.php?id=73832 Description There was found a bug showing that PHP uses uninitialized memory during calls to unserialize. As the following report shows, the payload supplied to unserialize may control this uninitialized memory...

Uber: Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront

Hi, 3 hours ago, rider.uber.com was responding like this: F127137 This happened on both HTTP and HTTPS. Now, as our blog post from last week says: https://labs.detectify.com/2016/10/05/the-story-of-ev-ssl-aws-and-trailing-dot-domains/ This means that there's a high chance this domain does not hav...

QIWI: [contact-sys.com] SQL Injection████ limit param

Уязвимый сценарий:████ Уязвимый параметр: limit POST█████ HTTP/1.1 Host: contact-sys.com Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Content-Length: 59 countrycode=RU&sendrectype=1&action=index&term=&limit=10+INTO+@A Ответ "error":"SQLSTATE21000: Cardinality violation: 1222 The...

GoCD: X-Content-Type-Options header missing at Auth Login

Hello Again, The doesn't have a header settings for X-Content-Type Options which means it is vulnerable to MIME sniffing. The only defined value, "nosniff", prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. This also applies to Google...

Pornhub: CSV Macro injection in Video Manager (CEMI)

Missing character escaping in video title delivery of an executable CSV payload to when exporting stats to file...

Shopify: "Remember me" token generated when "Remember me" box unchecked

Hi, This is a weird behaviour which regenerates secureadminsessionid cookie Steps to Reproduce : 1. Navigate to https://www.shopify.com/login 2. Enter credentials 3. Enter two factor code from authenticator Check cookie, There should be cookie named userauthtoken. I believe this token is...

itBit Exchange: No password length restriction denial of service

Hello , i am able to create a password with 1000000 words which fully leads to MySQL or server side Denial Of Service attack. You need to decrease password length :There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource...

jsDelivr: XSS

Dear Team, Step-by-step instructions on how to reproduce the problem: It was found the application is vulnerable to XSS attack. To achieve the same, open this link http://staging.jsdelivr.net/g//%3Cimg/src=%22%3E%22+onerror=alert%28927942%29%3E in firefox. it can't prompt bcoz there is nothng jus...

Internet Bug Bounty: LZ4 Core

Lab Mouse Security Report LMS-2014-06-16-6 Report ID: LMS-2014-06-16-6 CVE ID: CVE-2014-4611 Researcher Name: Don A. Bailey Researcher Organization: Lab Mouse Security Researcher Email: donb at securitymouse.com Researcher Website: www.securitymouse.com Vulnerability Status: Reported / No respons...

HackerOne: Account takeover

Hello, I found another bug on hackerone. This time it is very dangerous and creative. Hope you will definitely love it. Any valid account on hackerone can be hacked. eg Co-founders @jobert and @michiel can also be hacked. I tried this one on my account only. Lets go to the point ... Things requir...

HackerOne: Arbitrary file uploads to Amazon WS.

Hi, It seems one is able to upload arbitrary files to Amazon Webservices through the UI. This allows for uploading malware such as msf-payload-x86.jpg.exe or whatever. Beyond free hosting this could potentially be used to entice teams into downloading stuff they probably don't want. Actual...

Automattic: HTML form without CSRF protection

HTML form without CSRF protection Vulnerability description Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts...

Slack: open redirect in https://slack.com

Navigate to Https://slack.com append "/link?url=url=http://bing.com" or enter any website of your choice with http:// vulnerable link https://slack.com/link?url=http://bing.com notice that user is redirected to bing.com without being validated or notified...

Coinbase: User Enumeration, Information Disclosure and Lack of Rate Limitation on API

NOTE: I am making this email as I think the response from Coinbase originally, via my emails to them was not correct. They had not acknowledged that this flaw allowed for user enumeration and hence I am posting the report again - in hope of a proper and well evaluated response. The key security...

OkCupid: Instagram Authentication - No Request Token

Hello, On OkCupid, you have the ability to connect your Instagram account. This will sync any photos from your account onto your profile. This is performed by browsing to https://www.okcupid.com/okphotos/okinstagram.html, which will redirect to Instagram for the user to authorise the request. Onc...

Sandbox Escape: Win32k Window Handle Vulnerability (EoP)

This bug was disclosed directly to Microsoft. http://technet.microsoft.com/en-us/security/bulletin/ms14-003...

HackerOne: RTL override symbol not stripped from file names

Any U+202E RIGHT-TO-LEFT OVERRIDE and similar symbols in file names of uploaded files are not stripped from the file name, causing potentially malicious executables to look like harmless images, for example. This might trick HackerOne panel members into accidentally opening evil h4x0r filez. I’ve...

curl: setopt(VERIFYPEER) from callback bypasses TLS verify on connection reuse

Summary: Curlsslconnconfigupdate overwrites conn-sslconfig.verifypeer when curleasysetoptCURLOPTSSLVERIFYPEER, ... is called, with no handshake-state guard — only ifdata-conn. Since setopt is documented as callable from callbacks setopt.c:2930, an application can connect with verifypeer=0 accepti...

Booking.com: Default Admin Account lead to full access control at https://desk-demo.fareharbor.engineering

Login to the application at https://desk-demo.fareharbor.engineering/login with [email protected], password: test F3271060 2. Realizing that the login is successful, the attacker can use all functions in the application. F3271059 Impact attacker can use all admin functions...

HackerOne: IDOR vulnerability in unreleased HackerOne Copilot feature

An unreleased feature of HackerOne's Copilot was vulnerable to IDOR through a GraphQL mutation. By supplying another user's conversation ID, an attacker could have deleted conversations in the Copilot interface before this issue was addressed...

TikTok: CRLF injection leads to internal XSS on PangleGlobal

A cross-site scripting vulnerability was discovered due to carriage return line feed injection on the filename parameter of a PangleGlobal endpoint. This could have allowed JavaScript code execution in a user's browser through reflected cross-site scripting. The vulnerability has since been...

Mozilla: Mozilla Mastodon Staging Instance Admin API Key Disclosure Through Slack

Admin Mastodon API keys were inadvertently disclosed in the trust-and-safety-eng channel on Mozilla's Slack workspace, potentially granting unauthorized access to the Mastodon server and compromising user data. Immediate action is required to mitigate this vulnerability...

U.S. Dept Of Defense: [█████████] Information disclosure due unauthenticated access to APIs and system browser functions

Multiple information exposure vulnerabilities were discovered in a Jira Server instance, allowing unauthenticated access to APIs and system browser functions. These vulnerabilities could be exploited by an attacker to gain unauthorized access to sensitive data and run arbitrary code on the server...

HackerOne: Bypass report submit restriction/ban using the API key

A vulnerability was discovered that allowed banned researchers to submit reports through API keys, bypassing reporting restrictions. By creating an API key after an account was banned from submitting reports, a researcher could still submit reports to programs without restrictions, potentially...

U.S. Dept Of Defense: CVE-2023-24488 xss on https://██████/

Vulnerability description not provided...

U.S. Dept Of Defense: Reflected XSS in ██████████

A reflected XSS vulnerability was found on one of the subdomains of a website. The vulnerability was present in the "militarybranch" parameter of the "NextRequestAccount.action" page. An attacker could exploit this vulnerability to execute XSS attacks and steal user's cookies, launch phishing...

Internet Bug Bounty: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)

I reported at https://hackerone.com/reports/1684163 https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w Certain configurations of rails-html-sanitizer 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to...

Gymshark: Subdomain takeover on 'de-headless.staging.gymshark.com'

The Gymshark subdomain https://de-headless.staging.gymshark.com/ was pointing to an unclaimed Shopify site. Because of this an attacker could claim this subdomain, via Shopify, and serve their own content. This is extremely dangerous as an attacker could serve any malicious content on this domain...

U.S. Dept Of Defense: External service interaction ( DNS and HTTP ) in www.████████

An External Service Interaction vulnerability was found in www.█████████, allowing an attacker to induce the application to interact with arbitrary external services such as DNS and HTTP. This could lead to various attacks, including DDoS, OS Command Injection, DOS, and Code Manipulation...

Slack: Bypass invite accept for victim

Vulnerability description not provided...

Cloudflare Public Bug Bounty: Completely remove VPN profile from locked WARP iOS cient.

It was possible for a user to delete VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restriction enforced for enrolled devices by the Zero Trust platform. The issue was fixed in Warp...

Node.js: DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)

Summary: This is an insufficient fix of CVE-2022-32212, which itself is a fix of CVE-2018-7160. There exists a specific behaviour in browsers on macOS devices when handling the http://0.0.0.0URL that allows an attacker-controlled DNS server to bypass the DNS rebinding protection by resolving host...

Nextcloud: Information Exposure Through Directory Listing vulnerability

A directory listing provides an attacker with the complete index of all the resources located inside of the directory as well as download or access its contents. While the researcher did not dig deeper on to the available files, it might be possible that these websites host sensitive information...

GitLab: Container escape on public GitLab CI runners

Summary It is possible to circumvent the isolation in place for build jobs running on public CI runners by escaping the docker container running the build job. This is possible via abuse of the cgroup releaseagent functionality, made possible by CI jobs being allowed to mount filesystems inside t...

MTN Group: Remote code injection in Log4j on http://mtn1app.mtncameroon.net - CVE-2021-44228

The vulnerability CVE-2021-44228, a remote code injection flaw in Log4j, was discovered on the website http://mtn1app.mtncameroon.net. The vulnerability was confirmed to be present on the ports 8080 and 8443 of the website. The issue was demonstrated by retrieving the hostname of the affected...

Azbuka Vkusa: Мисконфигурация Cisco Smart Install

Closed...

Omise: XSS via X-Forwarded-Host header

Summary: The https://www.omise.co/ website is vulnerable to a cross-site scripting flaw if the server receives a crafted X-Forwarded-Host header. Description: The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an...

Lacework: Broken link profile in the website leads to identity theft.

Hi, I have found the Broken link profile in the website where the attacker can perform identity theft. Summary : When a web application has any pages, sources, links to external 3rd party services and are broken then the attacker can claim those endpoints to successfully conduct the attack and...

Reddit: Hash-Collision Denial-of-Service Vulnerability in Markdown Parser

Summary: We have found three bugs in Reddit's markdown parser. Two of these bugs are exploitable to launch an algorithmic complexity denial-of-service DoS attack. In this report we explain the bugs and exploits. We also show, in a non-disruptive way, that it appears to exist in the current versio...

Adobe: AEM forms XXE Vulnerability

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE. CVE: CVE-2021-40722 Ref: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html We...

Courier: [3] Bypassing IP Based Rate Limit Blocking leads to rate limit bypass in Courier Login Panel

Hi team, I would like to report rate limit issue based on IP blocking mechanism. Rate-limitation nowadays is not effective anymore to protect against brute-force. There are many botnets out there which can be used to overcome this hurdle, as well as cloud VPS services e.g. Amazon AWS EIPs, Digita...

MTN Group: Otp bypass in verifying nin

Summary: while conducting my research in your website I found that while verifying NIN number it send the otp to the enterd mobile number that can be bypassed. Steps To Reproduce: 1 Go to https://nin.mtnonline.com/nin/ 2 click submit nin.Now it will redirect to another page...

Basecamp: Domain Takeover [3737signals.com]

Hi, While i was analyzing the Basecamp3 Android app i found 3737signals.com on the source code as i understand you are passing it to the intentto view it on some case. F1368921 When I opened it on the browser I got DNS error says the domain name does not exist F1368922 As you can see at the botto...

HackerOne: Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs

Hello, Hope you are doing well, SUMMARY -In hackerone user doesn't have permission to do any action like "disclosing/undiclosing" in disclosed report. -Here user can send the "cancel-disclosure-request" request to the server and server accepts the request gave 200ok response with ""flash":"The...

Nextcloud: Download of file with arbitrary extension via injection into attachment header

Description ----------- When downloading mail attachments, the app fails to properly escape quotes in the content disposition header. Because of this, an attacker can send a victim a file with a benign extension such as .txt or .png which when downloaded will be stored with a malicious extension...

Sifchain: clickjacking vulnerability

Summary: add summary of the vulnerability While performing security testing of your website i have found the vulnerability called Clickjacking. Many URLS are in scope and vulnerable to Clickjacking. What is Clickjacking ? Clickjacking User Interface redress attack, UI redress attack, UI redressin...

HackerOne: Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token.

Details Title: Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token. Risk: High Impact: High Exploitability: High Target: baseurl parameter on UpdatePhabricatorIntegration mutation at /graphql endpoint. Introduction Sensitive data...

GitHub Security Lab: [javascript] CWE-90: CodeQL to detect LDAP Injection

This bug was reported directly to GitHub Security Lab...

TikTok: [CSRF] TikTok Careers Portal Account Takeover

A missing CSRF protection and open redirect vulnerability was reported in the TikTok Careers portal single sign on flow which is used by applicants to apply for TikTok positions. This flaw was quickly remediated and does not impact TikTok.com or mobile application. We thank @lauritz for reporting...