GitLab: SQL injection in MilestoneFinder order method

The MilestoneFinder is a class used to find milestones based on group or project identifiers. The class is used in multiple controllers. It allows to filter based on state and can be used to order the result set. One of the uses can be found in the Groups::MilestonesController. When the index...

HackerOne: Query parameter reordering causes redirect page to render unsafe URL

Hello hackerone team I want to report I bypass w/c lead to XSS but limited only for IE due to CSP block on chrome Here is the POC ------------------ https://hackerone.com/redirect?signature=c9304cadaeabca0bfb7b92503c0318da5c42a86b&url=http%3A%2F%2Fbuglabs.me&url=JAVASCRIPT:alert%09document.domain...

AlienVault : DNS pinning SSRF bypass

Summary: this issue is a bypass for this report: https://hackerone.com/reports/285380 . It is a SSRF bypass with DNS pinning. Description: We can bypass the SSRF protection with a simple domain that is resolving to 169.254.169.254 , like: ssrf-cloud.localdomain.pw Browsers Verified In: Firefox 56...

International Islamic University Chittagong: Default credentials on http://119.18.148.140/hrd/

Hello, When the mentioned URL is opened, the user is presented with a login form that logs them into the "HR & Payroll" system of the university. The issue here is that the credentials used are the application's default credentials, which are mentioned here...

HackerOne: GraphQL sessions aren't immediately invalidated when user password is changed

Summary: While changing password, once user clicks on "Change password" button after giving necessary values, on https://hackerone.com/settings/pass/edit, the session expires and the user is redirected to https://hackerone.com/users/signin for logging in again with the updated/changed password. A...

Legal Robot: cross site web socket hijacking

In the below web-socket request successful 101 protocol handshake is working with the origin:https://app.legalrobot.com, but if you place the malicious origin in the place of https://thisdata.com which is http://evil.com or any page containing the malware, the web socket server is still giving 10...

Internet Bug Bounty: Perl $ENV Key Stack Buffer Overflow

The CPerlHost::Add method in win32\perlhost.h is vulnerable to a stack buffer overflow. void CPerlHost::AddLPCSTR lpStr char szBuffer1024; LPSTR lpPtr; int index, length = strlenlpStr+1; forindex = 0; lpStrindex != '\0' && lpStrindex != '='; ++index szBufferindex = lpStrindex; szBufferindex = '\0...

Radancy: [Cross Domain Referrer Leakage] Password Reset Token Leaking to Third party Sites.

Domain and URL: https://werkenbijdefensie.nl Summary:: Password Reset Token Leaking to Third party Sites from the link in the footer Description: Hello, I found that the if a user request for a password reset link and open it but don't change the password and click on the Third Parties Sites link...

Upserve : Ability to create own account UUID leads to stored XSS

I found an interesting bug where the system allows a user to create their own UUIDs. There are character length restrictions on this action, however it's not bound to a specific set of characters. Even so, I was able to include an external script that I URL shortened to just hit the character lim...

U.S. Dept Of Defense: Remote Code Execution (RCE) in DoD Websites

A remote code execution RCE vulnerability was found on a Department of Defense DoD website which could have enabled an attacker to execute remote commands on the web server. @joaomatosf was able to demonstrate this vulnerability by developing a custom script that caused the webserver to execute a...

Paragon Initiative Enterprises: Directory Disclose,Email Disclose Zendmail vulnerability

i found three vulnerability Directory information disclose,Email address disclose, and possible Remote code execution in Zendmail during signup your code accept username with ',",/,@ while all of the special character must be forbidden or encoded in username Directory Disclose: 1. goto sign-up pa...

Mapbox: Open Aws Amazon S3 Buckets

Security researcher @saadahmed reported two Mapbox owned S3 buckets with public-read ACL. One of these, mapbox-js, was public-read by design, the other however was not and subsequently was switched to a private ACL. Thank you again @saadahmed, we appreciate you keeping Mapbox security in mind...

Homebrew: Host header Injection

HI SECURITY TEAM Here is host header injection. Request changing host to www.google.com GET / HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 Windows NT 6.1; rv:24.0 Gecko/20100101 Firefox/24.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language:...

Radancy: Possible to view and takeover other user's education and courses @ mijn.werkenbijdefensie.nl

Domain and URL: https://mijn.werkenbijdefensie.nl/instellingen/gegevens/tab2 Summary: IDOR vulnerability in editing education/courses Description: It is possible to view and change courses and education of other users also known as an IDOR. It's also possible to save these, and after saving the...

Ruby: sprintf combined format string attack

In a ticket that was also reported to "shopify-scripts" regarding "MRuby", I reported in details a combined attack against the sprintf gem: Information leak Heap buffer underflow The full ticket details can be found in: Ticket 212239 The ticked was opened several minutes ago but I add it in case ...

Starbucks: Persistent XSS in www.starbucks.com

There is a persistent XSS in https://www.starbucks.com/coffee/espresso/latte-macchiato It is caused by loading scripts from: //starbucksmacchiato-prod.elasticbeanstalk.com/scripts/bn-v1.0.0-Release-min.js Note that starbucksmacchiato-prod.elasticbeanstalk.com is not registered on elastic beanstal...

PortSwigger Web Security: Order-phishing via Payment ID URL

Hello. I discovered the endpoint, which allows the attacker conduct the fishing attack to other users and they can pay for attacker's order. Why this can happen? On the site, order id parameter sends to the https://portswigger.net/CCPayment.aspx as POST, but attacker can append it as GET and it...

Internet Bug Bounty: libtiff 4.0.6 segfault / read outside of buffer (CVE-2016-9297)

segfault and read outside of buffer in libtiff 4.0.6 and possibly earlier. This library is baked into web browsers used by millions and also devices like the PlayStation Portable and the iPhone. http://bugzilla.maptools.org/showbug.cgi?id=2590 Reported to the vendor on 7 November 2016: ASAN:SIGSE...

VK.com: Новый 2FA Bypass

Частичный обход проверки сессии. Косяк в функции смены пароля...

Bumble: No rate-limit in SERVER_SECURITY_CHECK

Hi, When you login in another Ip address Badoo will ask to confirm mobile number to authenticate. The problem is that there is no limit of tries. This make this feature useless since it can be brute forced. In the video you can see at request 56 we found the right number which lead to...

OLX: XSS and Open Redirect on https://jobs.dubizzle.com/

Hi, I found an interesting vulnerability.With this one we can redirect someone to a malicious site,or we can trigger XSS. STEPS TO REPRODUCE --------------------- 1-Go to that link https://jobs.dubizzle.com/en/pricing/?return=javascript:prompt31 2-Click the "Continue placing your ad" button. 3-XS...

Boozt Fashion AB: xss in Theme http://bztfashion.booztx.com

Researcher reported XSS vulnerability in Wordpress theme that we were using for our corporate site. Which in turn brought our attention to more available vulnerabilities within that Wordpress installation. Action taken - removed the installation completely and rebuild a more secured version of th...

Nextcloud: Nextcloud server software: Content Spoofing

In Nextcloud the "dir" parameter is vulnerable to content spoofing attack. If anyone puts a valid directory name in dir parameter then it goes that directory other wise it redirects to the home directory / By putting ../../ in dir parameter I was able to stop the redirect then I had put some...

VK.com: XSS в upload.php

Добрый вечер! Раскрутил интересную xss на upload.php. Демо тут или тут. Как все было? Увидел интересный экшн upload.php?act=transport, который служит для загрузки нарисованного граффити в документы. Глаз зацепился за вызов функции eval в строке 25. Обратите внимание на параметр callback, значение...

Mail.ru: AXFR на plexus.m.smailru.net работает

MacBook-Pro:subbrute isox$ dig @217.69.129.107 plexus.m.smailru.net axfr ; DiG 9.8.3-P1 @217.69.129.107 plexus.m.smailru.net axfr ; 1 server found ;; global options: +cmd plexus.m.smailru.net. 600 IN SOA ns1.mail.ru. hostmaster.mail.ru. 2300425875 900 900 1209600 300 plexus.m.smailru.net. 600 IN ...

GitLab: SSRF when importing a project from a git repo by URL

Fixed in 8.17.4, 8.16.8, and 8.15.8 SSRF when importing a project from a Repo by URL GitLab instances that have enabled project imports using "Repo by URL" were vulnerable to Server-Side Request Forgery attacks. By specifying a project import URL of localhost an attacker could target services tha...

Pornhub: Public Facing Barracuda Login

The researcher identified that the mail.pornhub.com subdomain has a public facing web login for Barracuda Spam & Virus Firewall...

Bime: XXE in the Connector Designer

A XML External Entity XXE vulnerability allowed an attacker to read arbitrary files on the server...

Cloudflare: Clickjacking : https://partners.cloudflare.com/

Hey, The title of submission defines the issue very clearly which is clickjacking at https://partners.cloudflare.com/ this subdomain missing x frame headers. As this subdomain contain a partner login then it is dangerous to have this type of issue. You understand better what i mean ; Attached a...

Coinbase: SPF records not found

There is no TXT record in DNS zone that defines Sender Policy Framework entry for domain api.coinbase.com. These are the best practices and need to be configure in DNS records to protect your mail servers. using SPF records will help in spam filtering as SPF records does helps in verifying the...

VK.com: Недочет в поиске по хештегам

Возможность узнать ID записи с определенным хештегом, если он единственный на стене. Возможность узнать ID записи с определенным хештегом, если он единственный на стене. И СЛОВО В ЭТОМ ПОСТЕ ! тобишь photo значит в после присутствует слово photo и соответсвенно скорей всего есть фотография и с...

Internet Bug Bounty: Internet-based attacker can run Flash apps in local sandboxes by using special URL schemes (PSIRT-3299, CVE-2015-3079)

Some of the sandbox logic of Flash Player can be circumvented on most web browsers by using special URL schemes. A website can deploy an SWF file via the data: or blob: URL schemes perhaps others. An app started in this way runs in the "local with files" or "local with networking" sandbox,...

Shopify: [www.*.myshopify.com] CRLF Injection

CRLF Injection via Request-URI PoC: http://www.myshopify.com/xxcrlftest%0aSet-Cookie:test=test3;domain=.myshopify.com; https://www.blackfan.myshopify.com/xxx%0aSet-Cookie:test=test2;domain=.myshopify.com; HTTP Response: HTTP/1.1 302 Moved Temporarily ... Location: http://myshopify.com/xxcrlftest...

Mail.ru: http://fitter1.i.mail.ru/browser/ торчит Graphite в мир

http://fitter1.i.mail.ru/browser/ Он тут. Если верить: http://fitter1.i.mail.ru/version/ Версия: 0.9.10 У нее RCE через PICLE. http://www.rapid7.com/db/modules/exploit/unix/webapp/graphitepickleexec...

drchrono: XML Parser Bug: XXE over which leads to RCE

Hello security team, I have reported this issue on Feb 6, 2015 and i'm resubmit it here again. I was able to do XXE attack on your site and exposed the /etc/passwd file. Scenario: 1. Login to drchrono site. 2. Click on patients-patient 3. Click on ' Update patient via C-CDA XML.' 4. Select the fi...

Internet Bug Bounty: X509_to_X509_REQ NULL pointer deref

X509toX509REQ NULL pointer deref CVE-2015-0288 =================================================== Severity: Low The function X509toX509REQ will crash with a NULL pointer dereference if the certificate key is invalid. This function is rarely used in practice. This issue affects all current OpenSS...

Adobe: Reflected Cross Site Scripting - 'puser' Parameter in login page

PoC URL:...

Mobile Vikings: Reflected xss in user name thru cookie

Imagine, that we have user A with name - namealert1 And user B User B request a sim card and the Add authorization to user A of course this is not the common way to exploit. As a result we have xss thru user name in flash message thru cookie. And ! we got properly singed cookie with xss payload...

Mail.ru: touch.mail.ru XSS via message id

воспроизводится в IE11 уязвимы элементы принимающие значение id письма. к примеру https://touch.mail.ru/cgi-bin/msglistreadmsg/14112810510000000915"...

Square: CRITICAL Account takeover via AngularJS template injection in connect.squareup.com

Hi! The OAUTH prompt at https://connect.squareup.com/oauth2/authorize?clientid=EXAMPLE prints out the current OAUTH appname without sanitizing it from -style AngularJS templates. This makes it possible for an attacker to add an AngularJS template to his/her appname that calls the $scope.allow...

Slack: SSRF on https://whitehataudit.slack.com/account/photo

During post request to https://whitehataudit.slack.com/account/photo: POST /account/photo HTTP/1.1 Host: whitehataudit.slack.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:29.0 Gecko/20100101 Firefox/29.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8...

Yahoo!: Yahoo! Messenger v11.5.0.228 emoticons.xml shortcut Value Handling Stack-Based Buffer Overflow

Thank you for your submission to Yahoo’s Bug Bounty program. While we recognize the effort that you put into the research and writing of a report for us to evaluate, we will take your report into consideration for any future releases. We appreciate your adherence to responsible disclosure...

HackerOne: Anti-MIME-Sniffing header X-Content-Type-Options header has not been set.

Hi, The following host "profile-photos-user-content.hackerone.com" does not set the x-content-type-options header to nosniff. If a malicious user is able to upload an image with script content Possible within the comments metadata Internet Explorer up till IE8 might render the content as Javascri...

Yahoo!: https://caldav.calendar.yahoo.com/ - XSS (STORED)

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

HackerOne: javascript: and mailto: links are allowed on users' profiles

For user's Profile settings, you accept website URLs like mailto:[email protected] and even javascript:alert1. The Content Security Policy directive in Chrome catches the JavaScript one, but older browsers will almost certainly execute the code, allowing for session stealing or XSS code execution...

8x8: jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofing

A vulnerability was discovered in the Prosody and Jigasi components of Jitsi Meet. The Prosody filter implemented an incomplete blocklist that allowed authenticated users with outbound-call privileges to inject arbitrary SIP headers, enabling Caller ID spoofing on outgoing SIP calls in environmen...

curl: CRLF injection in libcurl's SMTP client via --mail-from and --mail-rcpt allows SMTP command smuggling

Summary: libcurl's SMTP client is vulnerable to CRLF injection via the --mail-from and --mail-rcpt parameters. An attacker can inject newline characters to smuggle SMTP commands like VRFY, potentially enabling user enumeration or protocol abuse. While curl may fail after injection, the injected...

Trellix: Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10

A critical vulnerability was identified in Trellix Enterprise Security Manager ESM version 11.6.10. The vulnerability allowed unauthenticated access to internal API endpoints through path traversal and enabled remote code execution via command injection. The issue stemmed from insecure AJP proxy...

Internet Bug Bounty: CVE-2024-49761: ReDoS vulnerability in REXML

CVE-2024-49761 was a ReDoS vulnerability in the REXML gem. The vulnerability was caused by the parsing of XML input with many digits between "&" and "x...;" in a hex numeric character reference. This issue was resolved by updating the REXML gem to version 3.3.9 or later...

curl: CVE-2024-8096: OCSP stapling bypass with GnuTLS

CVE-2024-8096 was a vulnerability in GnuTLS where the OCSP stapling validation process could be bypassed, allowing the establishment of a connection even when the certificate was revoked. The issue was caused by a flaw in the gnutlscertificateverifypeers2 function, which only returned an error wh...