GitHub Security Lab: [GO]: CWE-326: Insufficient key size

This bug was reported directly to GitHub Security Lab...

Sifchain: Clickjacking

Bug Bounty ReportVulnerability Report Vulnerability Name: UI Redressing Clickjacking Vulnerability Description: Clickjacking classified as a User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a user into clicking on something different from what t...

Sifchain: Clickjacking misconfiguration bug

Hi team, While performing security testing of your website i have found the vulnerability called Clickjacking. Many URLS are in scope and vulnerable to Clickjacking. What is Clickjacking ? Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of...

Rocket.Chat: Hi! Security Team Rocket.Chat, It's possible to get information about the users emails without authentication

Description: Email enumeration vulnerability. Vulnerable api method: /api/v1/users.2fa.sendEmailCode Releases Affected:: Rocket.Chat up to 3.10.5 Request for existing account: POST /api/v1/users.2fa.sendEmailCode HTTP/1.1 Host: rocket-chat.local:3000 Referer: http://rocket-chat.local:3000/home...

GitHub Security Lab: [javascript] CWE-614: CodeQL query to detect if cookies are sent without the flag secure being set

This bug was reported directly to GitHub Security Lab...

Automattic: [intensedebate.com] SQL Injection Time Based On /js/commentAction/

intensedebate.com SQLi Time Based On /js/commentAction/ Summary: Hello, I have found a SQLI Injection Time Based on /js/commentAction/. When a user want to submit/reply to a comment, a JSON payload was send by a GET request. GET...

Automattic: XSS in Email Input [intensedebate.com]

Summary: I found an XSS in Email input. This input is not sanitized like other inputs allowing user to execute xss payloads. Platforms Affected: https://www.intensedebate.com/edit-user-account Steps To Reproduce: 1. Navigate to your account. 2. In email address, add the below payload next to your...

BugPoC: Reflected XSS at wacky.buggywebsite.com/frame.html

Summary: I solved that CTF to pop alert1 Steps To Reproduce: https://bugpoc.com/pocbp-HoQPW64U PoC ID: bp-HoQPW64U Password: AptBeAGlE03 Supporting Material/References: https://imgur.com/a/ZD7rOvH attachment / reference Impact General XSS impacts. Also, I mistakely used document.domain instead of...

Shopify: Ability to potentially hit internal NGINX locations on *.myshopify.com by making use of the `X-Accel-Redirect` header via a configured App Proxy

By making use of the Shopify App Proxy and the X-Accel feature of NGINX, it is possible to hit any configured internal NGINX location as your current configuration is not ignoring the X-Accel-Redirect header response from an upstream service. The way it works is that NGINX allows internal...

Zivver: Two-factor authentication can be disabled when logged in without 2fa or password confirmation

When a user performed sensitive actions on an account, he/she didn't have to provide his/her password after some inactivity. This issue is now addressed and to perform actions related to account security, the user has to provide his/her password before continuing...

Zomato: Availing Zomato gold by using a random third-party `wallet_id`

We received a report from @pandaaaa wherein he demonstrated a way to avail Zomato Gold membership using random Zomato User's wallet. The report was triaged and rewarded with critical severity with a CVSS score of 9.3. It was considered critical since a random user's wallet could have been used fo...

HackerOne: Uploading large payload on domain instructions causes server-side DoS

This was a DoS vulnerability in a specific endpoint that didn't limit the size of the upload. As explained in the hacker summary, we limited the payload to mitigate the attack. Note : To everyone who sees this report, if a program accepts DoS vulnerabilities please try to try test carefully as it...

Topcoder: Reflected XSS on https://apps.topcoder.com/wiki/page/

Summary: Hi : A reflected XSS occurs on https://apps.topcoder.com/wiki/pages/doeditattachment.action when editing wiki pages attachments. Steps To Reproduce: A user can add attachments on https://apps.topcoder.com/wiki/pages/viewpageattachments.action?pageId=165871793 a wiki page and can edit on...

Mail.ru: SQL LIKE clauses wildcard injection

LIKE clause was misused for session validation in one of https://c-api.city-mobil.ru/v2 API calls, allowing character-by-character session bruterofce. The session validation logic mistakenly allowed wildcards in the authorization token...

Mail.ru: Private files exposed to other apps

Insecure handling of external intent in ICQ for Android allowed another local application to force ICQ private files to be copied to insecure location...

Shopify: *.shopify.com - Authentication bypass

I´ve found a flaw in the authentication process when accessing the website https://upcoming.shopify.com. There seems to be an HTTP Authentication in place to prevent access without authentication. Please follow below POC to get access to https://upcoming.shopify.com without login. The website is...

FileZilla: FileZilla 3.46.3 - 'Scale factor' Buffer Overflow

Summary: FileZilla in has a problem in the "Scale Factor" field is vulnerable to a Buffer Over Flow attack or a denial attack. Adding random characters in an entry that must accept only Float input type values. Steps To Reproduce: A python file of name generatepaste.py was generated for the...

Nord Security: CORS Misconfiguration on nordvpn.com leading to Private Information Disclosure,Account takeover

Summary: An cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of th...

Node.js third-party modules: Filesystem Writes via `yarn install` via symlinks and tar transforms inside a crafted malicious package

I would like to report an arbitrary filesystem write vulnerability in Yarn when installing a malicious package from the default repositories. This vulnerability has the potential for RCE -- even if --ignore-scripts is disabled. It allows a malicious package, upon install, to write to any path on...

Razer: [IDOR] API endpoint leaking sensitive user information

Summary: Hi, the backend on the insider.razer.com website seems to be using XenForo. Some actions on the api.php have been left misconfigured by the developers, which lead to leaking of sensitive information. Steps To Reproduce: 1. Go to a random user's profile, say,...

8x8: Publicly accessible .svn repository - aastraconf.packet8.net

The server contained artifacts from an old SVN repository. The files were removed...

Nextcloud: Only the file extensions are checked, not the MIME types as configured

The tool is not working as hoped. File access control speaks of MIME types that are blocked or not blocked. In fact, only the file extensions are checked. If a user renames an unauthorized file to an allowed file, he can upload and download it. The MIME type of the current file is insignificant,...

GSA Bounty: Information disclosure (system username, server info) in the x-amz-meta-s3cmd-attrs response header on data.gov

Hi Team, I noticed, that the x-amz-meta-s3cmd-attrs response header returns sensitive information, like system username on data.gov x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33184/mtime:1513269652/atime:1513269652/md5:2049644b6b833f5dbb826f60a4721f64/ctime:1513269652 Server:...

Shopify: Inject page in admin panel via Shopify.API.pushState

Summary Shopify.API.pushState call the method handleRoutePushEvent, allows you to change routes to open pages from admin panel: js handleRoutePushEventpathname: e, search: t, state: a, hash: o const adminPath: n, history: i = this.props // adminPath = /admin , s = "".concatn.concate; // // If we...

Paragon Initiative Enterprises: Github wikis are editable by anyone https://github.com/paragonie/password_lock/wiki

submitted a misconfiguration in some of our GitHub repositories to us. Wikis are inherently editable for all users, but for some repositories an organization may want to restrict this access. In some cases it was possible for GitHub users . Github wikis on the following project...

curl: Active Mixed Content over HTTPS

Summary: Resources Loaded from Insecure Origin HTTP Steps To Reproduce: Vulnerability Details detected that an active content loaded over HTTP within an HTTPS page Remedy There are two technologies to defense against the mixed content issues: HTTP Strict Transport Security HSTS is a mechanism tha...

Shopify: XSS on services.shopify.com

Hy security, i Got a stored xss in one of your sub-domain "services.shopify.com" steps: 1- Go to https://yourstore.myshopify.com/admin/apps/expertsmarketplace/servicesmarketplace 2- Then Go to All servicesMarketing and salesemail marketing Design custom email templates click select 3- fill al the...

Shopify: Unpublished Product Images can be disclosed

Hi, This looks like a minor issue but felt like it was something worth reporting. Ideally, a product can be published or remain unpublished on any sales channel. If a product remains unpublished, then no information regarding it must be visible to public including product pictures. But I found an...

Mail.ru: Source code disclosure

PHP configuration file was available for download on few terrhq.ru subdomains...

Mail.ru: phpinfo

phpinfo was available at terrhq.ru subdomain...

Mail.ru: Phpinfo

phpinfo was available at terrhq.ru subdomain...

Phabricator: Issue:Form does not contain an anti-CSRF token

============================= Form does not contain an anti-CSRF token ============================= -------------------------------------------------------------------------------------------------------------------- There are 15 instances of this issue == / /Z1336 /applications/ /auth/start/...

HackerOne: report id is exposed for undisclosed reports in Hacktivity

Summary: This is similar to https://hackerone.com/reports/127620 where the report Id of undisclosed report is visible on graphql query Description: The new hacktivity graphql query includes undisclosed reports, but part of the query result is the report id which is included in private information...

Semrush: XSS Reflected on my_report

Еще раз привет. На этот раз, кроме HTML-инъекции проходит полноценный XSS в дашбоарде пользователя. Payload: https://www.semrush.com/myreports/api/v1/document%22%3E%3Cimg%20src=x%20onerror=alertdocument.cookie%3E/4007861 PoC: На скрине Impact Кража сессионных куков...

Mail.ru: CSRF на загрузку изображения Pandao

Domain, site, application https://pandao.ru/ -- Don't forget to include site address / application name / version information https://pandao.ru/ Testing environment -- OS version, browser information, settings and prerequisites to reproduce vulnerability, testing tools used, etc Parrot OS Steps t...

GitLab: GitLab's GitHub integration is vulnerable to SSRF vulnerability

The GitHub service is vulnerable to a SSRF vulnerability. An attacker may be able to leverage this to make arbitrary POST requests in a GitLab instance's internal network. It can also be used to connect to cloud provider's instance metadata API, which may result in the ability to execute commands...

Phabricator: TOTP Key is shorter than RFC 4226 recommended minimum

mongoose Observed Behavior: When creating a TOTP secret a 16 character base32 encoded string is presented to the user. Expected Behavior: I would expect a 32 character base32 secret to be presented. The RFC recommends 160 bits of entropy, which is 32 character x 5 bits per character in a base32...

Node.js third-party modules: Prototype pollution attack in just-extend

I would like to report a prototype pollution vulnerability in just-extend It allows an attacker to inject properties on Object.prototype. Module module name: just-extend version: 2.1.0, and 3.0.0 npm page: https://www.npmjs.com/package/just-extend Module Description Part of a library of...

Brave Software: Field Day With Protocol Handlers

Summary ===================== When launching a protocol such as mailto:, SEARCH:, or bitcoin:, Brave only asks to allow the protocol to be opened by an external application. You can select on whether or not to remember the decision or not and to allow or deny it. The issue is that upon selecting...

Node.js third-party modules: Command Injection Vulnerability in libnmap Package

I would like to report a command injection vulnerability in libnmap. It allows an attacker to inject arbitrary OS commands instead of a valid network range to be scanned. Module module name: libnmap version: 0.4.11 npm page: https://www.npmjs.com/package/libnmap Module Description API to access...

HackerOne: TeamProfile exposes partially sensitive information through GraphQL

I noticed there is new field teamprofile added and using the graphql below the latest serious report and reports received in three months were exposed "query":"query Dashboardreportseveritybreakdowntable$first0:Int! \n query \n id,\n ...F0\n \n\nfragment F0 on Query \n...

Vanilla: Bypassing the Trusted Link Alert System

Summary: I have discovered a means of bypassing the system that will alert users of an untrusted link utilizing the Right to Left Overrride unicode character. The alert looks like this: https://i.imgur.com/9rp1K7b.mp4 Description: For this demonstration, I have added "facebook.com" to the trusted...

Khan Academy: CSRF token fixation and potential account takeover

Hi Team, Details: I have found that the csrftoken fkey parameter which prevent CSRF attacks is fixed in same browser and didn't changed even user login or logout , a lot of users can use the same CSRFtoken , this can be exploited such 2 ways : Shared computers: - attacker open...

Uber: Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication

Summary Configuration file and/or source code information leakage without Uber OneLogin SSO authentication. Security Impact Misconfiguration on the server results in information leakage without authentication. Reproduction Steps...

HackerOne: GraphQL sessions aren't immediately invalidated when user password is changed

Summary: While changing password, once user clicks on "Change password" button after giving necessary values, on https://hackerone.com/settings/pass/edit, the session expires and the user is redirected to https://hackerone.com/users/signin for logging in again with the updated/changed password. A...

Boozt Fashion AB: Users Unable to login using Gmail/Facebook on https://boozt-stage1.booztx.com/login

Hi Team, when i try to login in this subdomainhttps://boozt-stage1.booztx.com/login using gmail or facebook,the login form does not redirect me to gmail/facebook,it is giving the error message since it is blacklisted by the server. Steps to Reproduce: 1 Goto https://boozt-stage1.booztx.com/login ...

Internet Bug Bounty: Heap Use After Free in unserialize()

ext/standard/varunserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data, related to the zvalgettype function in Zend/zendtypes.h. Exploitation of this issue can have an unspecified impact on the integrity of PHP. This...

Legal Robot: Null Byte Injection in all fields of Profile

Hi Team, Null byte injection is possible in all the fields of Edit Profile functionality. Affected URL: https://app.legalrobot.com/account Description: Possible Injection of control characters, such as Null Byte 0x00, \000, \x00, \z, or the Unicode representation \u0000 into vulnerable fields in...

Mail.ru: The auth token does not expire on logging out and even after logging out all sessions

API token for web.icq.com was not expired after user logout...

Mixmax: Security Vulnerability - SMTP protection not used

Hi, I'm checking your website found SPF record there. You should apply strict SMPT policy to stop spoofed email sending from your domain. An attacker would send a Fake email from [email protected] saying that Please change your password, The victim is aware of phishing attacks, But when he sees...