15520 matches found
Rockstar Games: Client-side Template Injection in Search, user email/token leak and maybe sandbox escape
In this report, the researcher was able to perform AngularJS Template Injection on our Support site in order to retrieve data, including email address, userid and tokens. Typically, a user is always able to retrieve this information about themselves and on its own, this is known behavior. However...
Internet Bug Bounty: CVE-2017-5969: libxml2 when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference)
I first reported this bug to the developers on 20 November 2015. A patch was finally committed on 7 June 2017 here. The caveat here is that this only happens in recover mode which the developers say no sane person should ever use in production and/or against untrusted inputs. A CVE was assigned i...
Quora: self xss in
Hi Quora security team, there is self XSS vulnerability in https://www.quora.com/profile/Username/ Steps: copy and paste the link in chrome browser copy entire link within double quotes "javascript:alertdocument.domain//https://www.quora.com/profile/Username/" then XSS payload will trigger please...
HackerOne: HackerOne reports escalation to JIRA is CSRF vulnerable
Summary: HackerOne reports escalation to JIRA is CSRF vulnerable Description Include Impact: An attacker can steal private reports details through a CSRF in HackerOne report escalation to JIRA implementation. CSRF GET https://hackerone.com/reports/REPORTNUMBER/escalate Optional: Supporting...
RubyGems: Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier
Description: The RubyGems client supports a gem server API discovery functionality, which is used when pushing or pulling gems to a gem distribution/hosting server, like RubyGems.org. This functionality is provided via a SRV DNS request to the users gem source hostname prepended with...
Legal Robot: Cross Site WebSocket Hijacking
Description: The given URL fails to validate Origin header- leading to Cross-Site WebSocket Hijacking. Impact: The impact, however, depends on how the server is configured. For example, it might require an authentication token which are user specific. In such cases, it might not be as sever as it...
HackerOne: javascript: and mailto: links are allowed in JIRA integration settings
Summary: For new feature settings, you accept website URLs like javascript:// or data:// in base urls. Even https://evil.com works, this needs to be stripped, this can be used to create another integrations without Steps To Reproduce 1. https://hackerone.com/Team/integrations/jira/edit 2. Try in...
Automattic: Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.com
Product / URL https://en.instagram-brand.com/wp-json/brc/v1/login/ Description and Impact An attacker can perform account takeover by leveraging following two vulnerabilities: Auth Bypass = Username Enumeration + Login Brute Force A. Username Enumeration: ------------------------------- For the...
ownCloud: [doc.owncloud.org] CRLF Injection
PoC: http://doc.owncloud.org/%23%0dSet-Cookie:crlf=injection;domain=.owncloud.org; HTTP Response: HTTP/1.1 301 Moved Permanently\r\n Date: Wed, 27 Jul 2016 07:58:47 GMT\r\n Server: Apache\r\n Location: https://doc.owncloud.org/\r injection \r Set-Cookie:crlf=injection;domain=.owncloud.org;\r\n...
Nextcloud: Log pollution can lead to HTML Injection.
Hi Team, I was looking around in your app and on the log part accessed by the admin, I noticed that the log file is downloaded as an HTML file. Naturally I started trying to inject code I noticed that when HTML code is inserted, a HTML comment start tag is inserted. But I was able to bypass this...
Internet Bug Bounty: Adobe Flash Player ShimContentResolver.configure Memory Corruption Vulnerability
I. Summary Adobe Flash Player is prone to a vulnerability which leads to memory corruption because of improper validation of ShimContentResolver.configure. ------------------------------------------------------------------ II. Description Adobe Flash is a multimedia and software platform used for...
Open-Xchange: Outdated Apache Server in www.dovecot.fi is vulnerable to various attack.
Apache HTTP Server NULL Pointer Dereference Vulnerability CVE 2014-3581. Apache HTTP Server 2.4.10 and earlier is prone to a vulnerability, which can be exploited to cause a DoS Denial of Service. The vulnerability exists because the application contains flaw in the cachemergeheadersout function...
GitLab: SSRF when importing a project from a git repo by URL
Fixed in 8.17.4, 8.16.8, and 8.15.8 SSRF when importing a project from a Repo by URL GitLab instances that have enabled project imports using "Repo by URL" were vulnerable to Server-Side Request Forgery attacks. By specifying a project import URL of localhost an attacker could target services tha...
Automattic: WordPress SOME bug in plupload.flash.swf leading to RCE
Intro == WordPress is vulnerable against a Same-Origin Method Execution SOME vulnerability that stems from an insecure URL sanitization problem performed in the file plupload.flash.swf. The code in the file attempts to remove flashVars Ā¹ in case they have been set GET parameters but fails to do s...
Uber: Information Disclosure on lite.uber.com
Hello, according to your policy https://hackerone.com/uber?viewpolicy=true, you are looking for Local File Disclosure. And lite.uber.com also in scope for your program. request: GET https://lite.uber.com/auth/login HTTP/1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:42.0...
Algolia: No rate-limit in Two factor Authentication leads to bypass using bruteforce attack
Hi, There is no rate limit set for Two factor authentication, which demand for code sent to mobile. This code can be bruteforced easily to bypass this. POST /users/testqr HTTP/1.1 Host: www.algolia.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:44.0 Gecko/20100101 Firefox/44.0 Accept:...
Uber: Possible to View Driver Waybill via Driver UUID
Due to an access control vulnerability it was possible to view the waybill of an arbitrary driver/partner by supplying their UUID to the /rt/drivers/DRIVERPARTNERUUID/waybill endpoint...
Ruby on Rails: Remote code execution using render :inline
Possible remote code execution vulnerability in Action Pack. There is a possible remote code execution vulnerability in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2016-2098. Versions Affected: 3.2.x, 4.0.x, 4.1.x, 4.2.x Not affected: 5.0+ Fixed Versions: 3.2.22.2,...
HackerOne: Auto Approval of Invitation to join Team as a Team member
Hi Hackerone, I have found a vulnerability wherein once a Team manager of any team sends out an Invitation to another Hackerone user to join his team, the invited team member gets auto accepted into the team to which he is being invited to join. The choice of "Accept" or "Reject" invitation which...
Internet Bug Bounty: Use after free during the StageVideoAvailabilityEvent can result in arbitrary code execution
An attacker can register the StageVideoAvailabilityEvent and have the SWF movie reloaded at the same time with LoadMovie. During this process, an object may be freed allowing the attacker to take control of the code flow. Identified as CVE-2015-0315, and reported to Adobe via Chrome VRP:...
Mail.ru: ŠŠµŃŠµŃŠøŃŠ»ŠµŠ½ŠøŠµ ŠŗŠ°ŃŠ°Š»Š¾Š³Š¾Š² Š·Š° ŃŃŃŃ ŃŃŠ·Š²ŠøŠ¼Š¾ŃŃŠø Š² IIS
ŠŃŠøŠ²ŠµŃŃŃŠ²ŃŃ! Š”ŠµŃŠ²ŠµŃ Ń Š±Š°Š³Š¾Š¹ : game1.bb.mail.ru ŠŠ¾Š¶Š½Š¾ ŠæŠ¾ŠæŃŃŠ°ŃŃŃŃ ŠæŠµŃŠµŠ±ŠøŃŠ°ŃŃ ŠŗŠ°ŃŠ°Š»Š¾Š³Šø Š·Š° ŃŃŃŃ ŃŃŠ·Š²ŠøŠ¼Š¾ŃŃŠø Š² IIS. PoC game1.bb.mail.ru/images/1/a.aspx?aspxerrorpath=/ game1.bb.mail.ru/images/2/a.aspx?aspxerrorpath=/ ŠŠ¾Š¶Š½Š¾ Š·Š°ŠæŃŃŃŠøŃŃ ŃŠŗŠ°Š½Š½ŠµŃ Šø ŠæŠ¾ŃŠ°Š·Š·ŠøŃŃ ŃŃŃ Š±Š°Š³Ń Š±Š¾Š»ŠµŠµ ŠŗŠ¾Š½ŠŗŃŠµŃŠ½Š¾...
Automattic: logout csrf app.simplenote.com/logout
Proof of Concept:...
HackerOne: Session Management
Hackerone fails to expire the session cookie from the server side even when the user logs off upon clicking "Sign-Out" from the application. The cookie is cleared from the client side browser, but is not cleared from the server side. If reused, it provides access to the user's account. Upon loggi...
curl: TLS verifyhost bypass in rustls, mbedTLS, and wolfSSL when verifypeer=0
The now-well-known CURLOPTSSLVERIFYHOST-bypass-when-CURLOPTSSLVERIFYPEER=0 defect exists in three of curl's TLS backends: rustls EXPERIMENTAL, mbedTLS, and wolfSSL DNS hostnames only. The documented contract at docs/libcurl/opts/CURLOPTSSLVERIFYPEER.md:57-59: The check that the host name in the...
curl: HTTP Request Smuggling and SSRF via CRLF Injection in Curl_add_custom_headers
Summary: A lack of CRLF validation in Curladdcustomheaders at lib/http.c:1761 allows users to inject arbitrary HTTP headers. This violation of RFC 7230 Ā§3.2.4 leads to HTTP Request Smuggling and potential SSRF bypass. AI Disclosure: I utilized an AI assistant to aid in the initial code analysis a...
HackerOne: Able to Create Testimonials for myself using Sandbox
The vulnerability allowed hackers to create and display self-authored testimonials on their public profiles. This was achieved by creating a sandbox program on HackerOne and inviting an alternate account. The alternate account could submit reports to the sandbox program, and the primary account,...
U.S. Dept Of Defense: Time based SQL injection atāāāāāāāā
A time based SQL injection vulnerability was found in the /pubs/index.php endpoint on āāāāāā. The 'years' and 'authors' parameters were vulnerable, allowing time delays to be introduced in database queries. This could have led to sensitive data exfiltration from the database. The issue could be...
Mars: Test 4 āāāāā
This is test team summary with limited disclosure...
Internet Bug Bounty: Context isolation bypass via nested unserializable return value
A vulnerability was discovered in Electron that allowed for a bypass of context isolation. This meant that code running in the main world context in the renderer could access the isolated Electron context and perform privileged actions. The vulnerability was fixed in versions 25.0.0-alpha.2,...
inDrive: Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`
The vulnerability allowed an unlimited increase of the passenger's rating in the city-to-city shared ride feature. The request to the /api/v1/reviews/ride//driver endpoint was manipulated by changing the rating value to a higher number, which was accepted by the application and resulted in an...
HackerOne: Create miscellaneous support ticket on anyone's account through [email protected] email
A vulnerability was discovered where an attacker could create support tickets on anyone's account by sending a fake email to [email protected]. This allowed the attacker to create tickets on behalf of victims or even HackerOne staff. The issue was resolved internally and the created tickets...
Nextcloud: Password reset endpoint is not brute force protected
The lostpassword flow in Nextcloud was missing brute force protection for the password reset endpoint, allowing attackers to potentially brute force the token without being throttled...
Stripe: Promotion code can be used more than redemption limit.
A race condition vulnerability existed in the promotion code creation process, allowing users to use the same code more times than the specified redemption limit. This could result in unauthorized discounts or other unintended consequences...
Cloudflare Public Bug Bounty: Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts
The OIDC JWT token issued on a new Sign in with Apple ID to the Cloudflare Dashboard had an excessive lifetime. When intercepted by a malicious actor, it enabled impersonation of the affected user on multiple devices during the entire token validity period without the need to re-authenticate. The...
Kubernetes: Attacker can bypass authentication build on ingress external auth (`nginx.ingress.kubernetes.io/auth-url`)
Report Submission Form Summary: Sending request with ..%2F allows to manipulate headers: X-Original-Url X-Auth-Request-Redirect due to that manipulation external auth service could make wrong decision and return 204 instead of 401/403. To be clear: manipulation of those headers give no possibilit...
Nextcloud: index.php/apps/files_sharing/shareinfo endpoint is not properly protected
When federated shares between two Nextclouds are created they do not use standard webdav to communciate. But to obtain the filelist they seem to use the SERVER/index.php/apps/filessharing/shareinfo endpoint. Unlike the other endpoint for tokens like public link shares. There is no brute force...
Palo Alto Software: [Bypass #870709] Unauthorised access to pagespeed global admin at https://webtools.paloalto.com/
Hi team, I found bypass of report 870709. Just by using X-Forwarded-For: 127.0.0.1 you can again get access to global admin page. Bypass request Request GET /pagespeed-global-admin/ HTTP/1.1 Host: webtools.paloalto.com X-Forwarded-For: 127.0.0.1...
h1-ctf: [h1-ctf] 12 Days of Adventure to stop Grinch from ruining Christmas
--------------------------------------------------------------------------------------------------------------------------------------------------- Day 1: https://hackyholidays.h1ctf.com/robots.txt User-agent: Disallow: /s3cr3t-ar3a Flag: flag48104912-28b0-494a-9995-a203d1e261e7 Here we go with t...
TikTok: [CSRF] TikTok Careers Portal Account Takeover
A missing CSRF protection and open redirect vulnerability was reported in the TikTok Careers portal single sign on flow which is used by applicants to apply for TikTok positions. This flaw was quickly remediated and does not impact TikTok.com or mobile application. We thank @lauritz for reporting...
Mail.ru: [webvpn.city-srv.ru] Path traversal via CVE-2020-3452
CVE-2020-3452 on webvpn.city-srv.ru...
LY Corporation: Spring Actuator endpoints publicly available, leading to account takeover
Due to insufficient access controls, it was possible to access the Spring Boot Actuator endpoints /heapdump and /env. The /heapdump endpoint leaks data from the Java Virtual Machine, leading to disclosure of admin credentials, user tokens and a combination of other data. This endpoint was not...
Open-Xchange: Null pointer dereference in SMTP server function smtp_string_parse
Sending the following bytes to the SMTP server induces a NULL pointer dereference...
h1-ctf: [h1-415 2020] I got the flag
Hey guys, The flag is: h1ctfy3s1mc0sm1cn0w I'll submit a well written writeup later today or tomorrow. I now have a lot of work to catch up thanks to this devilish ctf hehehe. Thanks Ben and the rest of the team for this awesome challenge. Impact Getting the flag...
Ubiquiti Inc.: Web Server Predictable Session ID on EdgeSwitch
In EdgeSwitch legacy web interface the SIDSSL cookie for admin can be guessed, enabling the attacker to obtain high privileges and get a root shell by a Command injection. These vulnerabilities were found on EdgeSwitch 1G switch ESWH and EdgeSwitch 10G switch ESGH firmware v1.9.0. The fix for the...
Nextcloud: SignUp using Fake Email
In this trial I used the email '[email protected]' and after pressing the SIGN UP button it will automatically redirect to https://ppp.woelkli.com/apps/preferredproviders/password/set/emailfakeforregister/H2qlEWHxQ3yiJgCsEXkR8, not through the account verification process first. For full the link Po...
ZEIT: Open redirection in https://zeit.co/login?next=
you have a open redirection bug in https://zeit.co/login?next= now i want to redirect the victem to https://www.google.com https://zeit.co/login?next=\www.google.com done !! it will redirected F511594 Impact redirect the victems to any page and it can be xss bug...
Mail.ru: SSRF On [ allods.mail.ru ]
SSRF in allods.mail.ru. allods.mail.ru belongs to Ext.B scope...
Valve: Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exe
Summary In the parsing routines of NAV files which contain the navigation mesh used by the AI for survivor bots, zombies, and the AI director spawning system a buffer overflow exists which can be used to control the EIP register and takeover code execution. Proof-of-Concept 1. Download the attach...
TomTom: Reflected Cross Site Scripting vuln in tomtom.com
Hello Tomtom security team I found a reflected cross site scripting security vulnerability in tomtom.com https://www.tomtom.com/nlnl/search/?q=27%22--%3E%3CDetails%20Open%20OnToggle=confirmdocument.domain%3E This payload when loaded displays the domain the XSS vulnerability occurs in www.tomtom.c...
Automattic: Wordpress VIP leaks email of the test a/c
i was testing learn.fb.com and i came to known that its wp-json is open and when i saw all the routes of the websites than i got to known that one end-point is leaking their internal email address the endpoint is as follow https://learn.fb.com/wp-json/th/v1/usergeneration The issue has been fixed...