Shopify: Bypass GraphQL rate limit by abusing negative cost queries

Hi security team, While looking into the graphql app I noticed an interesting implementation where each app has a bucket of query cost they are allowed to used in a given time with a certain refresh rate associated with it. The details can be found at...

Open-Xchange: Username restriction bypass with SSL client authentication

Summary: Dovecot supports enforcing the login user name to be the one encoded in the SSL client certificate, thus restricting the username. Using SSL certificates that do not even contain the relevant field bypasses this restriction, maybe leading to full login bypass under some luckily rare...

Weblate: No Rate Limit On Add new word

Hello I found in that there is no limit in the place of adding a new word which allows the attacker to add an infinite number of words which may cause a problem in the site and the server Steps To Reproduce : 1. Go To https://hosted.weblate.org/dictionaries/andors-trail/en/add And Fill in fields...

Liberapay: Publicly editable GitHub wikis

Hello team, While browsing https://github.com/liberapay I found that many of the repositories have their wikis publicly editable by any GitHub user. The following are some of the affected repositories: https://github.com/liberapay/cardregistration-js-kit/wiki...

MyCrypto: SPF Records (SMTP protection not used)

Hello MyCrypto Team , I am checking your website and found something is missing in SPF record.I don't find you have applied strict SMTP policy to stop spoofed email sending from your domain. I would like to recommend you to read the following article :...

Node.js: Fix for CVE-2018-12122 can be bypassed via keep-alive requests

Summary: Fix for CVE-2018-12122 can be bypassed via keep-alive requests Description: I'm not a security expert, neither I'm familiar with Node.js core, so please forgive me if this report is inaccurate and in that case, sorry for your time. While investigating the issue 515I checked out the fix t...

Nextcloud: Share recipient can modify a share's expiration date

Vulnerable URL http://server/nextcloud/ocs/v2.php/apps/filessharing/api/v1/shares/share ID number Summary Nextcloud users can set expiration dates on documents they share with others. However, the function to update a share does not appear to properly validate the requester is the owner when...

HackerOne: Accidental Access to Programs Information via SAML Login

On November 8th, 2018, HackerOne released software to production that contained a bug which impacted our Security Assertion Markup Language SAML authentication system. As a result of the bug, the SAML JIT Just-In-Time provisioning mechanism granted users of one customer program read-only access t...

QIWI: XXE on ██████████ by bypassing WAF ████

XXE on ■■■■■■.qiwi.com with WAF bypass The endpoint on ██████ accepts a POST request with an XML document. A Web-Application Firewall WAF successfully blocked all requests that contained any of the keywords !DOCTYPE, !ENTITY or !ELEMENT, that are necessary for XXE attacks to be successful. Howeve...

PayPal: XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)

Steps to reproduce On Chrome and Firefox: 1. Go to...

Dropbox: Stored XSS in dropboxforum.com

This report described a vulnerability where an attacker could put a specially crafted payload into the reply section of threads on dropboxforum.com to bypass the HTML filter on the site. This enabled a stored XSS attack against anyone viewing the message. This was an issue in Lithium forum...

Shopify: Open redirection in OAuth

steps to reproduce: 1-Open your shopify partner account. 2-Create an app and click on test your app. 3-Select a development store you own. 4-Intercept the request using burpsuite and change the "installappSelect a store" parameter to any store with no validation. The request like this: POST...

Brave Software: Unsafe handling of protocol handlers

Summary: Brave browser macOS handles protocol handlers in unsafe way and differently from other browsers. Key differences between protocol handlers handling in Brave and other browsers: Open external app vs Open "Terminal" Brave only asks about opening external app. Other browsers e.g. Chrome ask...

Upserve : OLO Total price manipulation using negative quantities

Manipulating an order request JSON object, containing an additional item with a negative quantity directly manipulates the total amount of the order. In the following JSON request, an order is submitted for 2 ChickenBurgers $12 each, as well as -1 BreadPuddings $9 each. The total price after tax...

Liberapay: Buffer overflow

A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program attempts to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an arra...

Zomato: URL is vulnerable to clickjacking

The browser has verified the identity: Successfully implemented in IE browser Reproduce steps: URLs do not have X-FRAME-OPTIONS set to DENY or SAMEORIGIN, and they are vulnerable to clickjacking. Run under the browser's code and you will see that the listed links are vulnerable to clickjacking...

Semrush: Broken Authentication: A project addition request can be used multiple time for different users

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: Broken...

LocalTapiola: Securemail server used to internal spam and resource exhaustion

Basic report information Summary: Confidential message systems fails to restrict large amount of receivers. This might lead to hardware exhausting and/or attacking localtapiola internal employees as securemail recipient. Description: Despite https://secure.lahitapiola.fi/ is designed to send...

Trello: Trello Gold accounts free for 1 year

It is possible to create Trello Gold accounts and use it for free for 1 year. The issue lies in credit card validation. PoC: 1. Create a new trello account 2. After verification, go to Profile Trello Gold 3. Choose billed annually, enter a valid credit card number with $0 on it. and click on...

Phabricator: Window.opener protection Bypass

SUMMURY ======== If you create a post/comment with a link like http://x.com in fabricator then server add rel="norefferrer" to anchor tag . So child window dont have access to parent window. But it can be bypassed with url like /\x.com/index.php and child window can change the location property o...

Node.js third-party modules: Fastify denial-of-service vulnerability with large JSON payloads

Module: Fastify - https://www.npmjs.com/package/fastify Affected versions: =0.37.0 all version before 0.38.0 Summary: A denial-of-service attack can be performed against servers running Fastify by sending a request with "Content-Type: application/json" and a very large payload. Description: Fasti...

GitLab: SQL injection in MilestoneFinder order method

The MilestoneFinder is a class used to find milestones based on group or project identifiers. The class is used in multiple controllers. It allows to filter based on state and can be used to order the result set. One of the uses can be found in the Groups::MilestonesController. When the index...

Uber: The Microsoft Store Uber App Does Not Implement Certificate Pinning

Summary The Microsoft Store Uber App Windows Phone Architecture does not properly implement certificate pinning. Security Impact Layer-2+ network traffic transmitted from and received by the app can be surreptitiously intercepted and transparently modified by an attacker, with no warnings or erro...

Open-Xchange: IDOR - setAttribute action of user object in API

Note. I selected sandbox.open-xchange.com as the asset in Hackerone but this was tested on a local installation . Hello, There appears to be a possible IDOR vulnerability in the following API endpoint for setting custom attributes:...

Internet Bug Bounty: Perl $ENV Key Stack Buffer Overflow

The CPerlHost::Add method in win32\perlhost.h is vulnerable to a stack buffer overflow. void CPerlHost::AddLPCSTR lpStr char szBuffer1024; LPSTR lpPtr; int index, length = strlenlpStr+1; forindex = 0; lpStrindex != '\0' && lpStrindex != '='; ++index szBufferindex = lpStrindex; szBufferindex = '\0...

Shopify: stored xss in invited team member via email parameter

Hey there, while testing your program I found a stored XSS vulnerability which can placed by owners or other staff members who have ability to manage members and it will triggered by visiting invited team member page e.g. https://partners.shopify.com/642416/invitations/15406. Reproduction Steps 1...

VK.com: CSRF Добавить просмотр к записи без ведома пользователя.

Отсутствие параметра hash при учете просмотра записей. Отсутствовал параметр hash при учете просмотра записей. Можно было вести массовую накрутку просмотров на посты. При этом просмотры крутились даже в частную группу, несмотря на то, что у нас к ней не было доступа. POC выглядел так:...

Internet Bug Bounty: Malformed SHA512 ticket DoS (CVE-2016-6302)

If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a DoS attack where a malformed ticket will result in an OOB read which will ultimately crash. The use of SHA512 in TLS session tickets is comparatively rare as it requires a custom server callback and ticket lookup mechanism...

Automattic: Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/login/ Description and Impact An attacker can perform account takeover by leveraging following two vulnerabilities: Auth Bypass = Username Enumeration + Login Brute Force A. Username Enumeration: ------------------------------- For the...

Automattic: Captcha bypass for the most important function - At en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/approval-requests Description and Impact The Instagram Brand Site has a functionality for business users to request for using Instagram Assets. The URL for creating a new request is: https://en.instagram-brand.com/requests/new There is a...

Imgur: Unauthenticated Docker registry

A docker registry was open and unauthenticated, giving access to outdated Imgur source code and secret keys...

Shopify: Stored XSS in https://productreviews.shopifyapps.com/proxy/v4/reviews/product

Hi , I have found a stored XSS issue in https://productreviews.shopifyapps.com Details: Going to https://productreviews.shopifyapps.com/proxy/v4/reviews/product?productid=8254331011&version=v4&shop=zh5403-attacker.myshopify.com&=cache&callback=test will show you the details of a product with the ...

Nextcloud: Log pollution can lead to HTML Injection.

Hi Team, I was looking around in your app and on the log part accessed by the admin, I noticed that the log file is downloaded as an HTML file. Naturally I started trying to inject code I noticed that when HTML code is inserted, a HTML comment start tag is inserted. But I was able to bypass this...

Open-Xchange: Outdated Apache Server in www.dovecot.fi is vulnerable to various attack.

Apache HTTP Server NULL Pointer Dereference Vulnerability CVE 2014-3581. Apache HTTP Server 2.4.10 and earlier is prone to a vulnerability, which can be exploited to cause a DoS Denial of Service. The vulnerability exists because the application contains flaw in the cachemergeheadersout function...

Uber: Information Disclosure on lite.uber.com

Hello, according to your policy https://hackerone.com/uber?viewpolicy=true, you are looking for Local File Disclosure. And lite.uber.com also in scope for your program. request: GET https://lite.uber.com/auth/login HTTP/1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:42.0...

Internet Bug Bounty: Buffer Over-read in unserialize when parsing Phar

https://bugs.php.net/bug.php?id=69324 ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service buffer over-read and application crash via a crafted length value in...

Internet Bug Bounty: ZIP Integer Overflow leads to writing past heap boundary

https://bugs.php.net/bug.php?id=69253 Integer overflow in the zipcdirnew function in zipdirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service...

Internet Bug Bounty: libcurl: URL request injection

libcurl: URL request injection CVE-2014-8150...

Internet Bug Bounty: Adobe Flash Player Out-of-Bound Read/Write Vulnerability

I. Summary Adobe Flash Player is prone to a vulnerability which leads to Out-of-Bound access of memory. During the compilation of a malformed regular expression, relevant operations would cause Out-of-Bound Read/Write of stack and heap memory. Successful exploits may allow an attacker to gain...

Internet Bug Bounty: Adobe Flash Player MP4 Use-After-Free Vulnerability

I. Summary Adobe Flash Player is prone to a vulnerability which leads to Use-After-Free. After parsing a malformed mp4 file, Flash will keep on accessing a block of memory for timing. Such memory block is still accessed even the page containing Flash is closed, which leads to a memory crash...

Coinbase: New Device confirmation tokens are not properly validated.

Hi, team I noticed that the new device confirmation code sent by your server is not validated . POC: 1 Login to a new computer and ask for confirmation code two times. Say around at 12.00 PM and at 12.01 PM 2 Now verify the device with the confirmation token which arrived at 12.01 PM and after...

HackerOne: Account takeover

Hello, I found another bug on hackerone. This time it is very dangerous and creative. Hope you will definitely love it. Any valid account on hackerone can be hacked. eg Co-founders @jobert and @michiel can also be hacked. I tried this one on my account only. Lets go to the point ... Things requir...

Mail.ru: rs.mail.ru - Flash Based XSS

Hi, I found a flash based XSS in rs.mail.ru. Vulnerable link: http://rs.mail.ru/b27161485.swf?link1=javascript:alertdocument.domain Just click on the page and you will see the alert. Tested on Mozilla Firefox Regards, Florin...

OkCupid: Instagram Authentication - No Request Token

Hello, On OkCupid, you have the ability to connect your Instagram account. This will sync any photos from your account onto your profile. This is performed by browsing to https://www.okcupid.com/okphotos/okinstagram.html, which will redirect to Instagram for the user to authorise the request. Onc...

Slack: Email enumeration

Navigate to the page - https://slack.com/signin Now, entering invalid email address returns an erroneous response. However, if you enter a valid email address like [email protected], it redirects you to a different page where it asks you to choose teams that belongs to [email protected]. You can then...

Sandbox Escape: Win32k Window Handle Vulnerability (EoP)

This bug was disclosed directly to Microsoft. http://technet.microsoft.com/en-us/security/bulletin/ms14-003...

Internet Bug Bounty: OpenSSH: Memory corruption in AES-GCM support

Vulnerability A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during kex exchange. If exploited, this vulnerability might permit code execution with the privileges of the...

Node.js: Node --run POSIX positional argument escaping allows shell command injection

Summary Node.js node --run -- attempts to append positional arguments to a package script after escaping each argument for the shell. On POSIX platforms, the escaping logic handles single quotes incorrectly. A positional argument containing a single quote can break out of the intended quoted...

Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)

A vulnerability was identified in Node.js where HTTPS Agent TLS session reuse skipped hostname verification across identity policies, which was an incomplete fix for CVE-2026-48934. This affected Node.js versions 22.x, 24.x, and 26.x...

curl: HTTP/2 proxy CONNECT tunnel unbounded 1xx chain (missing Curl_bump_headersize cap in cf-h2-proxy.c)

A malicious HTTPS-on-HTTP/2 proxy can grow a libcurl client's resident set without bound during the CONNECT phase by streaming 1xx informational responses. The CVE-2023-38039 cap MAXHTTPRESPHEADERSIZE, 300 KiB, enforced through Curlbumpheadersize is not applied on the HTTP/2 proxy path. The HTTP/...