PortSwigger Web Security: Email Spoofing

There is an Email Spoofing Vulnerability. Steps to reproduce: 1 Go to http://emkei.cz/ 2 Fill "From Email" field to [email protected] or any other portswigger email. 3 Fill the victim's address your address to "TO" field and fill in other details as you wish. You will receive email from...

Nextcloud: BruteForce in to Admin Account

Hello, My self Abdulwahab, I want to Alert You that Your website is Facing a serious Problem Called : Username Enumeration This Problem is on nextcloud.com/wp-admin We Use wpscan to get username and the username is "frank" After getting username a user can Bruteforce it Using Wpscan and get acces...

ownCloud: [doc.owncloud.org] CRLF Injection

PoC: http://doc.owncloud.org/%23%0dSet-Cookie:crlf=injection;domain=.owncloud.org; HTTP Response: HTTP/1.1 301 Moved Permanently\r\n Date: Wed, 27 Jul 2016 07:58:47 GMT\r\n Server: Apache\r\n Location: https://doc.owncloud.org/\r injection \r Set-Cookie:crlf=injection;domain=.owncloud.org;\r\n...

Nextcloud: Log pollution can lead to HTML Injection.

Hi Team, I was looking around in your app and on the log part accessed by the admin, I noticed that the log file is downloaded as an HTML file. Naturally I started trying to inject code I noticed that when HTML code is inserted, a HTML comment start tag is inserted. But I was able to bypass this...

Internet Bug Bounty: Adobe Flash Player ShimContentResolver.configure Memory Corruption Vulnerability

I. Summary Adobe Flash Player is prone to a vulnerability which leads to memory corruption because of improper validation of ShimContentResolver.configure. ------------------------------------------------------------------ II. Description Adobe Flash is a multimedia and software platform used for...

Pornhub: [idor] Profile Admin can pin any other user's post on his stream wall

The researcher discovered a vulnerability where a user may pin and post other users' content to their stream without their authorization...

Ruby: SMTP command injection

Net::SMTP is vulnerable to RCPT TO/MAIL FROM injection due to lack of input validation and conformance to the SMTP protocol. Publicly disclosed already: http://www.mbsd.jp/Whitepaper/smtpi.pdf People are wrongly assigning this to the mail gem http://rubysec.com/advisories/OSVDB-131677/ and thinki...

QIWI: SSL Certificate on qiwi.com will expire soon.

The validity of the SSL certificate is about to expire on 15 may 2016. The browser will normally present the user with a warning message indicating that the certificate has expired. These warnings are extremely confusing for the typical web user, and cause most users to question the authenticity ...

Uber: Possible to View Driver Waybill via Driver UUID

Due to an access control vulnerability it was possible to view the waybill of an arbitrary driver/partner by supplying their UUID to the /rt/drivers/DRIVERPARTNERUUID/waybill endpoint...

Veris: User enumeration via error message

Hi guys, Well, the issue is in authentication process, an attacker able to enumerate registered users on the site via brute forcing the login page, in case when user is not exist, system returns the following error message: "User not exist", in case when user exist, but incorrect password:...

Ruby on Rails: Remote code execution using render :inline

Possible remote code execution vulnerability in Action Pack. There is a possible remote code execution vulnerability in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2016-2098. Versions Affected: 3.2.x, 4.0.x, 4.1.x, 4.2.x Not affected: 5.0+ Fixed Versions: 3.2.22.2,...

Internet Bug Bounty: Flash Player information disclosure (etc.) CVE-2015-3044, PSIRT-3298

The vulnerability allows a malicious Flash app on a website to read and write Local Shared Objects belonging to any website. As a special case, LSO's of macromedia.com contain global Flash settings. Overwriting them allows e.g. unlimited access to camera and microphone of the target user. Other...

Mail.ru: http://tp-dev1.tp.smailru.net/

Логин-пароль на вход admin/admin + YII в дебаге...

HackerOne: Auto Approval of Invitation to join Team as a Team member

Hi Hackerone, I have found a vulnerability wherein once a Team manager of any team sends out an Invitation to another Hackerone user to join his team, the invited team member gets auto accepted into the team to which he is being invited to join. The choice of "Accept" or "Reject" invitation which...

Mail.ru: e.mail.ru: SMS spam with custom content

Привет! Суть в том, что можно неограниченно ! рассылать на любые номера SMS и контролировать содержание второй части SMS-ки. Таким образом можно слать как фейковые события, так и делать рассылку рекламы/поддельные сообщения, итд. Вида "для подтверждения вашего ящика отправьте полученный код на...

Mail.ru: Перечисление каталогов за счёт уязвимости в IIS

Приветствую! Сервер с багой : game1.bb.mail.ru Можно попытаться перебирать каталоги за счёт уязвимости в IIS. PoC game1.bb.mail.ru/images/1/a.aspx?aspxerrorpath=/ game1.bb.mail.ru/images/2/a.aspx?aspxerrorpath=/ Можно запустить сканнер и пофаззить эту багу более конкретно...

Yahoo!: information disclosure (LOAD BALANCER + URI XSS)

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

Internet Bug Bounty: Flash local-with-fileaccess Sandbox Bypass

The proof of concept attached will exploit the implementation of flash in some browsers that will bypass the local-with-fileaccess sandbox. By encoding in ignored file:// uri characters, and navigating to another page with a decoder script. one is able to read arbitrary files AND parse it to the...

HackerOne: RTL override symbol not stripped from file names

Any U+202E RIGHT-TO-LEFT OVERRIDE and similar symbols in file names of uploaded files are not stripped from the file name, causing potentially malicious executables to look like harmless images, for example. This might trick HackerOne panel members into accidentally opening evil h4x0r filez. I’ve...

Internet Bug Bounty: OpenSSH: Memory corruption in AES-GCM support

Vulnerability A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during kex exchange. If exploited, this vulnerability might permit code execution with the privileges of the...

curl: Stack Buffer Overflow in cURL Cookie Parsing Leads to RCE

Summary I discovered a critical stack-based buffer overflow vulnerability in cURL's cookie parsing mechanism that can lead to remote code execution. The vulnerability occurs when processing maliciously crafted HTTP cookies, affecting all applications that use libcurl for HTTP requests. Descriptio...

curl: Heap-buffer-overflow (Out-of-Bounds Read) in DoH hostname encoding

Summary: I found a heap-buffer-overflow in the dohreqencode function in lib/doh.c. The bug happens when curl processes a DNS-over-HTTPS request for a hostname that is an empty string. The code gets the string length as 0, then tries to access hostlen - 1, which becomes host-1. This is an...

HackerOne: Able to Create Testimonials for myself using Sandbox

The vulnerability allowed hackers to create and display self-authored testimonials on their public profiles. This was achieved by creating a sandbox program on HackerOne and inviting an alternate account. The alternate account could submit reports to the sandbox program, and the primary account,...

Nextcloud: RCE on Wordpress website

A remote code execution vulnerability was exploited on a WordPress website due to unsafe deserialization of user input. This allowed arbitrary code execution as the web server user...

inDrive: Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`

The vulnerability allowed an unlimited increase of the passenger's rating in the city-to-city shared ride feature. The request to the /api/v1/reviews/ride//driver endpoint was manipulated by changing the rating value to a higher number, which was accepted by the application and resulted in an...

Internet Bug Bounty: (CVE-2023-32006) Permissions policies can impersonate other modules in using module.constructor.createRequire()

A vulnerability was discovered in Node.js that allowed permissions policies to impersonate other modules using the module.constructor.createRequire function. This could bypass the policy mechanism and enable the loading of modules outside of the defined policy. The vulnerability affected all user...

Teleport: robots.txt file

The web server includes a robots.txt file that serves a crucial role in providing instructions to web robots, such as search engine crawlers, about the permissible areas of the website that they can crawl and index. While the presence of this file does not pose a direct threat to the security of...

HackerOne: Create miscellaneous support ticket on anyone's account through [email protected] email

A vulnerability was discovered where an attacker could create support tickets on anyone's account by sending a fake email to [email protected]. This allowed the attacker to create tickets on behalf of victims or even HackerOne staff. The issue was resolved internally and the created tickets...

Kubernetes: The `io.kubernetes.client.util.generic.dynamic.Dynamics` contains a code execution vulnerability due to SnakeYAML

A code execution vulnerability was found in the io.kubernetes.client.util.generic.dynamic.Dynamics class of the Kubernetes Java Client version 17.0.0. The vulnerability was due to the use of SnakeYAML parser without safe constructor, which allowed an attacker to achieve code execution inside the...

Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields

Summary: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. Description: The following chunked request is processed. It should be rejected as Transfer-Encoding header obfuscatio...

HackerOne: Ability to escape database transaction through SQL injection, leading to arbitrary code execution

HackerOne has an internal backend interface that gives debugging capabilities to its engineers. One of the features is the ability to run EXPLAIN ANALYZE queries against a connected database. This feature is accessible by a handful of engineers. The feature is vulnerable to a SQL injection that...

VK.com: Reflected Xss On https://vk.com/search

XSS in Search...

IBM: Remote Code Execution at https://169.38.86.185/ (edst.ibm.com)

A discovered Gitlab server was running an old version affected by RCE. This vulnerability could have allowed an unauthenticated attackers to compromise the server by public exploit in ExifTool. The issue was reported to IBM and remediated...

Localize: Stored XSS in Document Title

Summary : Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XSS ...

Mail.ru: Blind XSS Stored and CORS misconfiguration в отчете "События" сервиса top.mail.ru

Details: Прежде чем начать, хотелось бы отметить что в правилах по XSS сказано including privilege escalations within the product are accepted without bounty, однако полученные таким образом Cookies жертвы не привязаны к домену продукта top.mail.ru. Вот пример, Cookies: ██████████ Domain, site,...

U.S. Dept Of Defense: Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)

A vulnerability in ForgeRock OpenAM allowed unauthenticated remote code execution due to unsafe Java deserialization in the Jato framework. The vulnerability, tracked as CVE-2021-35464, could be exploited by sending a crafted request to the /openam/ccversion/Version endpoint with a malicious...

Bumble: Exfiltrating a victim's exact location (to within 5m)

I used Bumble's distance feature to exfiltrate the exact location to within approx 5m of a victim. I did this by using the Bumble API to move my attacker account's location around the approximate area of the victim. I was able to obtain the exact distance between attacker and victim at 3 separate...

HackerOne: Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs

Hello, Hope you are doing well, SUMMARY -In hackerone user doesn't have permission to do any action like "disclosing/undiclosing" in disclosed report. -Here user can send the "cancel-disclosure-request" request to the server and server accepts the request gave 200ok response with ""flash":"The...

GitHub Security Lab: [JAVA]: CWE-347 - Improper Verification of Cryptographic Signature : Potential for Auth Bypass

This bug was reported directly to GitHub Security Lab...

Nextcloud: index.php/apps/files_sharing/shareinfo endpoint is not properly protected

When federated shares between two Nextclouds are created they do not use standard webdav to communciate. But to obtain the filelist they seem to use the SERVER/index.php/apps/filessharing/shareinfo endpoint. Unlike the other endpoint for tokens like public link shares. There is no brute force...

Exodus: Cache Poisoning DoS on downloads.exodus.com

Summary: Hello, The subdomain downloads.exodus.com hosts all files meant to be downloaded by exodus users. A few of the file I found are: https://downloads.exodus.com/releases/exodus-linux-x64-21.4.9.zip https://downloads.exodus.com/releases/hashes-exodus-21.2.12.txt...

Ruby: OS Command Injection in 'rdoc' documentation generator

Details: If the removeunparseable function receives a list of files with a command in the name of one of them, it will be executed. Just enough the name to match the pattern. The problem code: ruby def removeunparseable files files.reject do |file, | file =...

Automattic: SSRF & Blind XSS in Gravatar email

Nathan Cavitt rockybandana reported a blind XSS issue in the Gravatar service, which was due to incorrect/insufficient sanitization on adding emails to one's profile. The report was of good quality and the issue was fixed within a couple of days of report...

BlockDev Sp. Z o.o: xmlrpc.php FILE IS enabled it will used for Bruteforce attack and Denial of Service(DoS)

xmlrpc.php file is visible...

Node.js: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion

Summary: Node.js http2 server is vulnerable against denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new...

Mail.ru: CVE-2020-3187 на ip адресе 91.231.115.30

CVE-2020-3452 on webvpn.city-srv.ru...

GitLab: GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command Injection

Summary GitLab-Runner, when running on Windows with a docker executor, is vulnerable to Command Injection via the DOCKERAUTHCONFIG build variable. Injected commands are executed on the container host, not within a Docker container, as such could compromise all future builds which are executed by...

Nextcloud: No rate limiting on sinup page

Hi Team, Summary: As a best practice a login page should have a rate limiting. Below is the captured request of respective login page of nextcloud.com -------------------------------------------------------------------------------------------------------------------- POST...

InnoGames: Stored XSS on recruit.innogames.de

Summary: When applying for a Supporter/Moderator job at recruit.innogames.de the drop-down field "Position" is vulnerable to a stored XSS as the content is not validated. Description: Steps To Reproduce: 1. Visit https://recruit.innogames.de/staemme/de/index/page/show/apply 2. Fill out all requir...

Nextcloud: Access control missing while viewing the attachments in the "All boards"

The vulnerability lies in the "view attachment" of the tasks . When a user uploads the file to the Task, the attachment is given a numeric number and is increased +1 on further uploads. It is easy for any user to view and download all the files uploaded to the tasks by any user. The access is not...