Cloudflare Public Bug Bounty: Completely remove VPN profile from locked WARP iOS cient.

It was possible for a user to delete VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restriction enforced for enrolled devices by the Zero Trust platform. The issue was fixed in Warp...

Cloudflare Public Bug Bounty: Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts

The OIDC JWT token issued on a new Sign in with Apple ID to the Cloudflare Dashboard had an excessive lifetime. When intercepted by a malicious actor, it enabled impersonation of the affected user on multiple devices during the entire token validity period without the need to re-authenticate. The...

Adobe: DoS of https://research.adobe.com/ via CVE-2018-6389 exploitation

The researcher successfully exploited CVE-2018-6389 on https://research.adobe.com/. We appreciate the collaboration and the responsible disclosure...

TikTok: Impersonation of tiktok account via Broken Link in TikTok Newsroom

A broken link was found on TikTok Newsroom, which could have allowed an attacker to claim the associated username and hijack the link. We thank @bushidobrown200 for reporting this to our team and confirming its resolution...

JetBlue: Open Redirect

Vulnerability description not provided...

Kubernetes: Attacker can bypass authentication build on ingress external auth (`nginx.ingress.kubernetes.io/auth-url`)

Report Submission Form Summary: Sending request with ..%2F allows to manipulate headers: X-Original-Url X-Auth-Request-Redirect due to that manipulation external auth service could make wrong decision and return 204 instead of 401/403. To be clear: manipulation of those headers give no possibilit...

MTN Group: Otp bypass in verifying nin

Summary: while conducting my research in your website I found that while verifying NIN number it send the otp to the enterd mobile number that can be bypassed. Steps To Reproduce: 1 Go to https://nin.mtnonline.com/nin/ 2 click submit nin.Now it will redirect to another page...

Mail.ru: Blind XSS Stored and CORS misconfiguration в отчете "События" сервиса top.mail.ru

Details: Прежде чем начать, хотелось бы отметить что в правилах по XSS сказано including privilege escalations within the product are accepted without bounty, однако полученные таким образом Cookies жертвы не привязаны к домену продукта top.mail.ru. Вот пример, Cookies: ██████████ Domain, site,...

Basecamp: Domain Takeover [3737signals.com]

Hi, While i was analyzing the Basecamp3 Android app i found 3737signals.com on the source code as i understand you are passing it to the intentto view it on some case. F1368921 When I opened it on the browser I got DNS error says the domain name does not exist F1368922 As you can see at the botto...

Nextcloud: Download of file with arbitrary extension via injection into attachment header

Description ----------- When downloading mail attachments, the app fails to properly escape quotes in the content disposition header. Because of this, an attacker can send a victim a file with a benign extension such as .txt or .png which when downloaded will be stored with a malicious extension...

Homebrew: Brew bootstrap process is insecure

The process described in this page is not secure - no checksum / PGP signature is published and there is no way to check the download is legit: https://brew.sh/ "/bin/bash -c "$curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh"" This can lead to supply chain attacks su...

HackerOne: Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token.

Details Title: Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token. Risk: High Impact: High Exploitability: High Target: baseurl parameter on UpdatePhabricatorIntegration mutation at /graphql endpoint. Introduction Sensitive data...

Automattic: SSRF & Blind XSS in Gravatar email

Nathan Cavitt rockybandana reported a blind XSS issue in the Gravatar service, which was due to incorrect/insufficient sanitization on adding emails to one's profile. The report was of good quality and the issue was fixed within a couple of days of report...

Kubernetes: CVE-2019-11250 remains in effect.

Report Submission Form Summary: "CVE-2019-11250: TOB-K8S-001: Bearer tokens are revealed in logs" remains in effect. Kubernetes Version: Effects at least all versions since 1.4. - This was determined with some git archaeology. This was determined by following the code snippet from it's current...

Mail.ru: [webvpn.city-srv.ru] Path traversal via CVE-2020-3452

CVE-2020-3452 on webvpn.city-srv.ru...

Mail.ru: Path traversal on bank.mail.ru ( CVE-2013-3827 )

Defects in Oracle’s JSF2 implementation allowed limited path traversal in tbank.mail.ru...

InnoGames: Stored XSS on recruit.innogames.de

Summary: When applying for a Supporter/Moderator job at recruit.innogames.de the drop-down field "Position" is vulnerable to a stored XSS as the content is not validated. Description: Steps To Reproduce: 1. Visit https://recruit.innogames.de/staemme/de/index/page/show/apply 2. Fill out all requir...

PlayStation: Authorization Token on PlayStation Network Leaks via postMessage function

Description After some analysis on how playstation network authentication work, I came across a certain pattern of how authorization tokens are handled. The web application utilizes postMessage function to exchange authorization tokens between windows/frames. To simplify this, let's follow on one...

Google: CVE-2020-8913 - Persistent arbitrary code execution in Android's Google Play Core Library: details, explanation and the PoC

██████████████████████████...

Internet Bug Bounty: CVE-2017-13019: The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print()

Hello, The vulnerable code portion is linked below. The linked function is responsible for printing PGM packet payload information to the terminal e.g., stdout https://github.com/the-tcpdump-group/tcpdump/commit/4601c685e7fd19c3724d5e499c69b8d3ec49933e The issue may be reproduced as follows Check...

Internet Bug Bounty: Buffer Overflow in ext_lm_group_acl helper

Summary Due to incorrect buffer management extlmgroupacl is vulnerable to a denial of service attack when processing NTLM Authentication credentials. This problem is limited to installations using the extlmgroupacl binary. Affected Versions Squid 2.x - 2.7.STABLE9 Squid 3.x - 3.5.28 Squid 4.x - 4...

Nextcloud: "Secure View" aka "Hide Download" can be bypassed easily

The mid-2019 announced feature "Secure view" https://nextcloud.com/blog/secure-view-prevent-your-shared-files-from-getting-downloaded/ allows for hiding the Download button on public shares. Even though the announcement admits that there are always workarounds out there to get hands on the file...

Ubiquiti Inc.: Web Server Predictable Session ID on EdgeSwitch

In EdgeSwitch legacy web interface the SIDSSL cookie for admin can be guessed, enabling the attacker to obtain high privileges and get a root shell by a Command injection. These vulnerabilities were found on EdgeSwitch 1G switch ESWH and EdgeSwitch 10G switch ESGH firmware v1.9.0. The fix for the...

Nord Security: Password Reset Link Works Multiple Times

Background: Normally, a secure way to handle password reset links is to invalidate the link/token upon usage. Additionally, if multiple reset links are requested, older & unused tokens should also be invalidated i.e., if 2 reset tokens were requested, the 2nd token should be invalid upon your usa...

Node.js: HTTP request smuggling using malformed Transfer-Encoding header

Please see the attached PDF for a writeup of this vulnerability. Impact Please see the attached PDF for a writeup of this vulnerability...

MyEtherWallet: Local Storage Custom Node Credentials Leak

Summary Credentials for a custom node are stored in plain text inside Local Storage on the user's machine. If this node is configured in a certain way this could lead to the theft of any funds in accounts attached to this node, by a local attacker. And if not configured this way, an attacker coul...

TomTom: XSS Reflect

Hi guys, According to the attached prints, I found an XSS at https://www.tomtom.com/en/search/?q=%3C%2Fscript%3E link. Here is the payload used: https://www.tomtom.com/en/search/?q=%3C%2Fscript%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E Any questions, I'm available! Regards, z3xdd Impact A...

Monero: Excessive Resource Usage

Summary: Unbounded resource usage due to open one file descriptor per connection, Python script below is effectively a threadbomb on the destination and uses all available memory on the server, clients not sending anything are never terminated. Steps To Reproduce: Up our daemon % monerod Check if...

Valve: Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exe

Summary In the parsing routines of NAV files which contain the navigation mesh used by the AI for survivor bots, zombies, and the AI director spawning system a buffer overflow exists which can be used to control the EIP register and takeover code execution. Proof-of-Concept 1. Download the attach...

Monero: Computing hash of crafted block leads to crash in tree_hash()

I'm not sure how to test this against against an actual Monero instance, so I'm instead showing an isolated PoC: c include int mainvoid cryptonote::block b = AUTOVALINITb; for sizet i = 0; i baoss; std::string s; if ::serialization::serializeba, b == true s = oss.str; else return 0; / Uncomment t...

Mail.ru: Open Selenoid instance at 188.93.63.186 leads to LFR/SSRF.

Externally accessible Selenoid instance in Mail.Ru Games network was vulnerable to LFR and SSRF via URI injection...

Mail.ru: PHP-FPM Status Page

PHP-FPM Status Page available on pubg.my.com...

Mail.ru: CSRF на загрузку изображения Pandao

Domain, site, application https://pandao.ru/ -- Don't forget to include site address / application name / version information https://pandao.ru/ Testing environment -- OS version, browser information, settings and prerequisites to reproduce vulnerability, testing tools used, etc Parrot OS Steps t...

Open-Xchange: Username restriction bypass with SSL client authentication

Summary: Dovecot supports enforcing the login user name to be the one encoded in the SSL client certificate, thus restricting the username. Using SSL certificates that do not even contain the relevant field bypasses this restriction, maybe leading to full login bypass under some luckily rare...

GitLab: information disclosure of secret_key_base via encoding charcters

@pareshparmar discovered an error page that was disclosing the value of the secretkeybase key of customers.gitlab.com to unauthenticated users, which would have allowed an attacker to arbitrarily decrypt signed cookies. So I was fuzzing one parameter with different type of encodings. And one...

Grammarly: Permissive CORS policy trusting arbitrary extensions origin

@foobar7 identified that misconfigurations in CORS and CSRF handling allowed malicious browser extensions, which have permission to interact with grammarly.com domain, to impersonate the user. The vulnerability was resolved with improved CSRF/CORS handling...

Vanilla: Vanilla Forums Xenforo password splitHash Unserialize Remote Code Execution Vulnerability

Summary: An authenticated admin user can inject an unserializable password in a another users account. Later when attempting a login with that user, the attacker can trigger a call to an unserialize in the splitHash function. By using a custom pop chain to write into the constants.php file, an...

Internet Bug Bounty: DoS for HTTP/2 connections by crafted requests (CVE-2018-1333)

modhttp2 can be tricked by specially crafted requests to hold server resources longer than necessary. A simple demonstration of this for a server with h2c enabled is as follows: for x in seq 0 500; do echo...

Mail.ru: molotok.m.mail.ru delegated to external entity

SDC bypass secure cookies access vulnerability in m.mail.ru due to subdomain name pointing to uncontrolled external host...

VK.com: Доступ к администраторским faq

Просмотр некоторых закрытых статей FAQ. Уязвимость позволяла получить доступ к талмудам vk.com/tlmdXXX в которых хранится информация для администраторов и модераторов социальной сети ВКонтакте... Получение доступа к адм. информации... @ 500$...

Liberapay: Buffer overflow

A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program attempts to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an arra...

Liberapay: Phishing by Navigating Browser Tabs

Hi team, I was create a PR on github https://github.com/liberapay/liberapay.com/pull/1127 Details Opened windows through normal hrefs with target="blank" can modify window.opener.location and replace the parent webpage with something else, even on a different origin. While this doesn't allow scri...

Starbucks: SQL Injection Proof of Concept for Starbucks URL

browser: firefox quantum 60.0.1 64 bit os: windows 10 sqli type: char formula injection info found: oracle database system url: https://www.starbucks.de/coffee/our-coffees/format/whole-bean injected url using oracle concatenation and char functions:...

Valve: Stored XXS @ https://steamcommunity.com/search/users/#text= via Profile Name

Dear Valve security staff, Short description --------------------- There is a stored cross-site-scripting vulnerability present at the user search endpoint which can be exploited by modifying profile name of the would be attacking account. See POC picture. Steps to reproduce ---------------------...

HackerOne: Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profile

Hi Team, Summary: First of all, i am not sure if a private program or any program have the capability to not show their response efficiency, but i assume they have because i saw some private programs that do not show response efficiency percentage on their public page. Description: Below list of...

Upserve : Ability to reset password for account

The attacker was able to send a password reset link to an arbitrary email by sending an array of email addresses instead of a single email address. POST https://hq.breadcrumb.com/api/v1/passwordreset HTTP/1.1 with body like "emailaddress":"[email protected]","[email protected]"...

Node.js third-party modules: Prototype pollution attack (merge-deep)

As discussed in 309391, here's the separate report for each of the library. This one is the information for the merge-deep library. Module: merge-deep Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part of th...

Node.js third-party modules: [glance] Path Traversal in glance static file server allows to read content of arbitrary file

Hi Guys, There is Path Traversal vulnerability in glance module. This issue allows to read arbitrary files from the server, where glance is installed. Module glance a quick disposable http server for static files https://www.npmjs.com/package/glance Stats 33 downloads in the last day 34 downloads...

Uber: The Microsoft Store Uber App Does Not Implement Certificate Pinning

Summary The Microsoft Store Uber App Windows Phone Architecture does not properly implement certificate pinning. Security Impact Layer-2+ network traffic transmitted from and received by the app can be surreptitiously intercepted and transparently modified by an attacker, with no warnings or erro...

Uber: No rate limiting on https://biz.uber.com/confirm allowed an attacker to join arbitrary business.uber.com accounts

A lack of rate limiting on the "/confirm" endpoint made it possible for an attacker to add themselves to arbitrary business.uber.com accounts by brute forcing confirmation codes. If they were able to successfully brute force the correct confirmation code, this would allow an attacker to take ride...