15580 matches found
U.S. Dept Of Defense: Remote Code Execution (RCE) in a DoD website
An application deserialization vulnerability was found in a misconfigured Department of Defense DoD website by @joaomatosf via POST/GET request. Impressive work. This showcases your skills! Thank you for supporting the DoD Vulnerability Disclosure Program!...
U.S. Dept Of Defense: SSRF+XSS
I discovered that due to an outdated Jira instance, I was able to exploit an SSRF vulnerability in Jira and was able to perform several actions such as bypass any firewall/protection solutions, access AWS instance data, access Internal DoD Servers and internal services. Additionally I was able to...
Snapchat: Takeover 2 MAIN DOMAINS of a company Acquired by Snapchat
Hi, As you may realize I noted "Domain" and not subdomain because actually, I was able to take over the MAIN domain of a company Acquired by Snapchat. As you can see in the screenshot below, when you type "Addlive" in Google https://goo.gl/EAxBaj , the first two results will be: F261984 First one...
GitLab: SQL injection in MilestoneFinder order method
The MilestoneFinder is a class used to find milestones based on group or project identifiers. The class is used in multiple controllers. It allows to filter based on state and can be used to order the result set. One of the uses can be found in the Groups::MilestonesController. When the index...
International Islamic University Chittagong: PHP Myadmin Accesable & Database Error Information
Dear Team, MyPHPAdmin console is accessible over the internet as well as Directory of PHP documentation is accessible. Refer all attached images Kindly MOve this to 403 Forbidden resources Steps below to reproduce the same. enter this Url http://119.18.148.140/phpmyadmin/ accessible over Internet...
Aspen: Information leakage on django.aspen.io
Hi Team, I got a error message that disclose the version of nginx with OS detail, since The version of nginx is vulnerable to integer overflow. Impact: By seeing this information attacker can throw only interger overflow attack in order to get sensitive information Finally Request you to remove...
Aspen: No Rate Limit (Leads to huge email flooding/email bombing)
Dear sir, At first,i want to say that this sensitive action definitely should be set with rate limit. Note:-This is about huge bombing/brute force on any endpoints. Vulnerability:- -No rate limit has been set for generating account confirmation emails for accounts on above selected domain which i...
Rockstar Games: Client-side Template Injection in Search, user email/token leak and maybe sandbox escape
In this report, the researcher was able to perform AngularJS Template Injection on our Support site in order to retrieve data, including email address, userid and tokens. Typically, a user is always able to retrieve this information about themselves and on its own, this is known behavior. However...
Roblox: Subdomain Takeover at creatorforum.roblox.com
Hello. A few days ago, I was looking at Roblox subdomains, and I noticed an unusual one called creatorforum.roblox.com. Upon further investigation, I visited it and saw that creatorforum.roblox.com's CNAME was a nonexistant Discourse website. I immediately reported to [email protected], and...
Ubiquiti Inc.: CSRF: Replacing the router configuration backup having an 'operator' user and bypassing the "Referer:' whitelist protection
EdgeOS version 1.9.1 and prior, the researcher was able to bypass the CSRF protection. An attacker with access to an operator read-only account, can lure an admin root user to access the attacker controlled page, doing so will allow the attacker to gain admin privileges in the system...
Cuvva: Session cookie without secure flag on https://underwriter.partner.cuvva.com
Issue detail The following cookie was issued by the application and does not have the secure flag set: csrf=SPncw9jJEynL2b4TYJqybsdc; Path=/; Session; HostOnly; The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of...
U.S. Dept Of Defense: Remote Code Execution (RCE) in DoD Websites
A remote code execution RCE vulnerability was found on a Department of Defense DoD website which could have enabled an attacker to execute remote commands on the web server. @joaomatosf was able to demonstrate this vulnerability by developing a custom script that caused the webserver to execute a...
Paragon Initiative Enterprises: Full directory path listing
STEP: ==================== 1. goto https://bridge.cspr.ng/login and enter your username,password 2. click "LogIn" and intercept the request 3. change the value in cookie header and add 'single quote in PHPSESSID field eg: PHPSESSID=kn7e21dpp2ocai2ckn1v147qev' 4. Forward the packet and see full pa...
Shopify: Stealing users' facebook access tokens - kitcrm.com
Summary: I have found a number of minor security vulnerabilities with no impact that when chained together will lead to an attacker being able to steal the current user's facebook access token provided for kitcrm.com Description: - In kitcrm.com, users register with their shopify account and the...
LocalTapiola: XSS and open redirect in verkkopalvelu.lahitapiola.fi
Summary: Dears, Kindly note that after submitting CSRF vulnerability in the subject subdomain which is still triaged https://hackerone.com/reports/178811 I Noticed After more testing to the subject domain that there is multiple endpoints vulnerable to an XSS and those are the same endpoints i...
Bumble: No rate-limit in SERVER_SECURITY_CHECK
Hi, When you login in another Ip address Badoo will ask to confirm mobile number to authenticate. The problem is that there is no limit of tries. This make this feature useless since it can be brute forced. In the video you can see at request 56 we found the right number which lead to...
LocalTapiola: Oracle WebCenter Sites Support Tools available and Information disclosure (/cs/Satellite)
Oracle WebCenter Sites Support Tools are available in: www.lahitapiola.fi This software is password protected, but some pages are publicly available and reveal internal information. The welcome page is located at: http://www.lahitapiola.fi/henkilo?pagename=Support/Home This page reveal data as th...
Nextcloud: More content spoofing through dir param in the files app
Hi! It's still possible to use an invalid dir param to spoof messages in the directory breadcrumbs area. For example, you can use URL-encoded periods to bypass the directory traversal prevention. By referencing a path that returns a 301, you can add a message in the dir param F108266:...
Nextcloud: Log pollution can lead to HTML Injection.
Hi Team, I was looking around in your app and on the log part accessed by the admin, I noticed that the log file is downloaded as an HTML file. Naturally I started trying to inject code I noticed that when HTML code is inserted, a HTML comment start tag is inserted. But I was able to bypass this...
Internet Bug Bounty: Adobe Flash Player ShimContentResolver.configure Memory Corruption Vulnerability
I. Summary Adobe Flash Player is prone to a vulnerability which leads to memory corruption because of improper validation of ShimContentResolver.configure. ------------------------------------------------------------------ II. Description Adobe Flash is a multimedia and software platform used for...
Internet Bug Bounty: Adobe Flash Player ShimContentFactory class Memory Corruption Vulnerability
I. Summary Adobe Flash Player is prone to a vulnerability which leads to memory corruption because of improper validation of ShimContentFactory.retrieveOpportunityGenerators. ------------------------------------------------------------------ II. Description Normally, retrieveOpportunityGenerators...
VK.com: XSS в upload.php
Добрый вечер! Раскрутил интересную xss на upload.php. Демо тут или тут. Как все было? Увидел интересный экшн upload.php?act=transport, который служит для загрузки нарисованного граффити в документы. Глаз зацепился за вызов функции eval в строке 25. Обратите внимание на параметр callback, значение...
Open-Xchange: Outdated Apache Server in www.dovecot.fi is vulnerable to various attack.
Apache HTTP Server NULL Pointer Dereference Vulnerability CVE 2014-3581. Apache HTTP Server 2.4.10 and earlier is prone to a vulnerability, which can be exploited to cause a DoS Denial of Service. The vulnerability exists because the application contains flaw in the cachemergeheadersout function...
Pornhub: [idor] Profile Admin can pin any other user's post on his stream wall
The researcher discovered a vulnerability where a user may pin and post other users' content to their stream without their authorization...
Mail.ru: [api.login.icq.net] Open Redirect
https://api.login.icq.net/auth/cancel?f=1&k=1&supportedIdType=1&succUrl=http://example.com...
HackerOne: Auto Approval of Invitation to join Team as a Team member
Hi Hackerone, I have found a vulnerability wherein once a Team manager of any team sends out an Invitation to another Hackerone user to join his team, the invited team member gets auto accepted into the team to which he is being invited to join. The choice of "Accept" or "Reject" invitation which...
X (Formerly Twitter): HTML form without CSRF protection at http://try.crashlytics.com/enterprise/
Vulnerability description:- This alert may be a false positive, manual confirmation is required. Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitte...
Mail.ru: e.mail.ru: SMS spam with custom content
Привет! Суть в том, что можно неограниченно ! рассылать на любые номера SMS и контролировать содержание второй части SMS-ки. Таким образом можно слать как фейковые события, так и делать рассылку рекламы/поддельные сообщения, итд. Вида "для подтверждения вашего ящика отправьте полученный код на...
Automattic: logout csrf app.simplenote.com/logout
Proof of Concept:...
Yahoo!: Out of date version
Thank you for your submission to Yahoo’s Bug Bounty program. While we recognize the effort that you put into the research and writing of a report for us to evaluate, but unfortunately this bug has already been reported to us. We appreciate your adherence to responsible disclosure guidelines and...
curl: libcurl upload read callbacks miss recursive API guard, allowing prohibited multi API reentry and ASAN-confirmed UAF
Summary: Several libcurl upload read callback paths invoke the application-provided CURLOPTREADFUNCTION without marking the easy handle as being inside a callback. As a result, recursive multi APIs that are correctly rejected from ordinary callbacks are accepted from these upload read callback...
curl: libcurl 8.20.0 ignores HTTP Digest domain protection space and preemptively leaks Digest auth outside the declared scope
Summary: libcurl 8.20.0 ignores the server-declared HTTP Digest domain protection space for origin authentication and reuses stored Digest state too broadly on the same easy handle. After a successful Digest-authenticated request, a later request on the same easy handle can receive a preemptive...
HackerOne: Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql
The GraphQL query on hackerone.com/graphql allowed authenticated users to execute arbitrary Painless scripts through the sortquery argument, without server-side validation or allowlisting. This was confirmed by submitting requests with different Painless script payloads, and observing that the...
AWS VDP: A potential risk in the experimental-programmatic-access-ccft which can be used to privilege escalation.
The experimental-programmatic-access-ccft application created a function with an associated role that was assigned policies with overly broad "sts:AssumeRole" permissions for "" resources. This could have allowed a malicious user to assume into any AWS Account in the AWS Organization, resulting i...
U.S. Dept Of Defense: Blind Sql Injection in https://████
A SQL injection vulnerability was discovered in the User-Agent parameter of the website "https://██████████/". The vulnerability allowed an attacker to inject SQL commands through the User-Agent HTTP header...
HackerOne: Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA
Vulnerability description not provided...
HackerOne: Able to Create Testimonials for myself using Sandbox
The vulnerability allowed hackers to create and display self-authored testimonials on their public profiles. This was achieved by creating a sandbox program on HackerOne and inviting an alternate account. The alternate account could submit reports to the sandbox program, and the primary account,...
Internet Bug Bounty: CVE-2023-42780: Apache Airflow: Improper access control vulnerability in the "List dag warnings" feature
A vulnerability in Apache Airflow versions prior to 2.7.2 allowed authenticated users to list warnings for all DAGs, revealing dagids and stack traces even for DAGs the user did not have permission to access. Users should upgrade to Airflow 2.7.2 or newer...
Sorare: Operation CreateOrUpdateSo5LineupMutation does not restrict multiple captains
The CreateOrUpdateSo5LineupMutation operation in the Sorare API allowed users to set multiple captains for a football team, which violated the game logic of having only one captain. This vulnerability could be exploited to gain an unfair advantage over other players...
HackerOne: Create miscellaneous support ticket on anyone's account through [email protected] email
A vulnerability was discovered where an attacker could create support tickets on anyone's account by sending a fake email to [email protected]. This allowed the attacker to create tickets on behalf of victims or even HackerOne staff. The issue was resolved internally and the created tickets...
Nextcloud: CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link
Summary It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link. e.g. in an email, chat link, etc This vulnerability was introduced in an attempt to fix 1720043. The patch however can be bypassed and also introduced a CSRF vulnerability...
IBM: Cleartext storage of sensitive information at https://staging.status.ai-apps-comms.ibm.com/env can lead to account takeover of several IBM employees
Cleartext storage of sensitive information was reported to IBM, analyzed and has been remediated. Thank you to zere...
Slack: Bypass invite accept for victim
Vulnerability description not provided...
IBM: Remote Code Execution at https://169.38.86.185/ (edst.ibm.com)
A discovered Gitlab server was running an old version affected by RCE. This vulnerability could have allowed an unauthenticated attackers to compromise the server by public exploit in ExifTool. The issue was reported to IBM and remediated...
Mail.ru: [samokat.ru] PHP modules path disclosure due to lack of error handling
Hi security team @mailru we found a Information disclosure in phpproject in subsamokat.ru On one side of the server samokat.ru generates a full stack error trace instead of an HTTP 500 error. The complete error stack trace reveals the full path of the PHPConfiguration module directory on the...
Sifchain: Clickjacking
Bug Bounty ReportVulnerability Report Vulnerability Name: UI Redressing Clickjacking Vulnerability Description: Clickjacking classified as a User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a user into clicking on something different from what t...
Sifchain: CSRF in newsletter form
Hi, i can perform csrf attack on victim on newsletter to receive updates because you dont have csrf protection "csrf token" in request Request: POST / HTTP/2 Host: sifchain.finance User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:88.0 Gecko/20100101 Firefox/88.0 Accept:...
Ruby: OS Command Injection in 'rdoc' documentation generator
Details: If the removeunparseable function receives a list of files with a command in the name of one of them, it will be executed. Just enough the name to match the pattern. The problem code: ruby def removeunparseable files files.reject do |file, | file =...
GitLab: Arbitrary file read during project import
NOTE! Thanks for submitting a report! Please replace all the parenthesized sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary A mis-usage of json sche...