Lucene search
+L
HackeroneMost viewed

15517 matches found

Hacker One
Hacker One
added 2023/07/12 11:04 a.m.54 views

Internet Bug Bounty: jdbc apache airflow provider code execution vulnerability

A code execution vulnerability was discovered in the Apache Airflow JDBC Provider before version 4.0.0. The vulnerability allowed for privilege escalation by exploiting controllable parameters in the JDBC connection, enabling the execution of arbitrary Java code...

8.1AI score
SaveExploits0
Hacker One
Hacker One
added 2023/07/10 1:29 p.m.54 views

Mars: Html injection

The consultant identified that the show parameter can reflect into the HTML page. An attacker could have crafted a malicious query that resulted in the inclusion of attacker-controlled HTML elements on the web page, changing the content presented to users. The vulnerability was assessed to have a...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2023/07/05 12:45 p.m.54 views

inDrive: Stored XSS on promo.indrive.com

Vulnerability description not provided...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2023/06/08 10:22 p.m.54 views

GitHub Security Lab: JavaScript: Add some new XSS sinks and sources of Next.js (and some extra improvements)

Vulnerability description not provided...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2022/11/17 5:40 p.m.54 views

LinkedIn: Unauthorized access to resumes stored on LinkedIn

Researcher found an IDOR on an endpoint where a recruiter could download resumes without the appropriate access - This security issue was unintentionally introduced in late-October 2022 - The reporter reached out and provided details to LinkedIn on this security issue in November 2022 - LinkedIn...

0.9AI score
SaveExploits0
Hacker One
Hacker One
added 2022/11/11 1:04 p.m.54 views

8x8: Directory Listing at https://█.█.█.█

@shuvam321 reported to us an enabled Directory Listing at https://█.█.█.█/cobbler/ & https://█.█.█.█/cblr/. The directories exposed open source files related to the Spacewalk project. The server instance was initially installed as a preview of a Spacewalk. No sensitive information had been...

0.9AI score
SaveExploits0
Hacker One
Hacker One
added 2022/11/06 2:22 a.m.54 views

U.S. Dept Of Defense: xss on reset password page

target:https://█████/Default.aspx?TabId=81&ctl=SendPassword&returnurl=%252fUOTSHelpDesk When a user goes on the forget password page and enters a username it is reflected onto the page. An attacker could simply enter a username like alert1 and it would execute an alert not to mention there is no...

0.9AI score
SaveExploits0
Hacker One
Hacker One
added 2022/10/18 6:36 p.m.54 views

Nextcloud: CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link

Summary It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link. e.g. in an email, chat link, etc This vulnerability was introduced in an attempt to fix 1720043. The patch however can be bypassed and also introduced a CSRF vulnerability...

6.8CVSS8.7AI score0.00204EPSS
SaveExploits0
Hacker One
Hacker One
added 2022/09/26 5:58 a.m.54 views

GitHub: Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api

An incorrect authorization vulnerability was found in GitHub Enterprise Server that allowed GitHub Apps to gain access to and modify most organization-level resources that are not tied to a repository, regardless of granted permissions. This vulnerability affected all versions of GitHub Enterpris...

9.8CVSS9.6AI score0.01244EPSS
SaveExploits0
Hacker One
Hacker One
added 2022/07/09 10:25 a.m.54 views

Reddit: Can use the Reddit android app as usual even though revoking the access of it from reddit.com

Summary: Hi Team, For the last 4 days, I kept testing reddit web. That time, I revoked app access from the old.reddit.com and i checked my app and as expected i was not able to use the account in my app. After 2 days I was checking the chat invites feature on the web and after some time I turned ...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2022/04/24 6:11 a.m.54 views

Reddit: Reflected xss in https://sh.reddit.com

Summary: Reflected cross-site scripting or XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. Impact: attacker can execute malicious java script and steal cookies Steps To Reproduce: add details for how we can...

1AI score
SaveExploits0
Hacker One
Hacker One
added 2022/04/11 11:50 p.m.54 views

GitHub Security Lab: [Python]: Add Server-side Request Forgery sinks

This bug was reported directly to GitHub Security Lab...

1AI score
SaveExploits0
Hacker One
Hacker One
added 2022/04/09 7:56 p.m.54 views

SMTP2GO BBP: Origin IP found, WAF Cloudflare Bypass

Description: I have discovered that the http://172.105.190.180/login/ site exposed it's IP which could allow bypassing of anti-DDoS mechanisms i.e you are using Cloudflare for protection. For Originate IP address which I found from https://search.censys.io/ By using these IP address as a resolver...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2022/03/09 3:16 p.m.54 views

Kraden: Business Logic Flaw in the subscription of the app

Summary: Hello Security Team Business logic vulnerabilities are flaws in the design and implementation of an application that allow an attacker to elicit unintended behavior. This potentially enables attackers to manipulate legitimate functionality to achieve a malicious goal. Steps To Reproduce:...

0.3AI score
SaveExploits0
Hacker One
Hacker One
added 2022/01/11 8:50 a.m.54 views

U.S. Dept Of Defense: CVE-2021-42567 - Apereo CAS Reflected XSS on https://█████████

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints. CAS is vulnerable to a Reflected Cross-Site Scripting attack, via POST requests sent to the REST API endpoints. The payload could be injected on URLs: /███████/. Malicious scripts can be submitted to CAS via...

4.3CVSS0.9AI score0.08064EPSS
SaveExploits0
Hacker One
Hacker One
added 2021/11/09 4:35 a.m.54 views

Judge.me : The response shows the nginx version

Summary: On visiting the https://cache.judge.me/ .It show the nginx version Steps To Reproduce: ==send :== GET / HTTP/1.1 Host: cache.judge.me Cookie: ga=GA1.2.907415772.1636450777; gid=GA1.2.1767694824.1636450777; fbp=fb.1.1636450778172.127612364; hjid=00598a42-40f4-48cb-84ec-20b9bd4273cd;...

6.7AI score
SaveExploits0
Hacker One
Hacker One
added 2021/08/03 5:49 p.m.54 views

Mail.ru: [185.30.178.57:8080] - Vulnerable to Jetleak

sfpc.euits.dev-my.games contains a vulnerable to JetLeak web server Jetty...

1.5AI score
SaveExploits0
Hacker One
Hacker One
added 2021/05/15 8:12 p.m.54 views

GitLab: Stored XSS in custom emoji

Summary I found Stored XSS with a feature of custom emoji. This feature hasn't been rolled out yet and need to set feature flags in self management installation. https://gitlab.com/gitlab-org/gitlab/-/issues/231317 The problem is the code here...

SaveExploits0
Hacker One
Hacker One
added 2021/05/12 8:15 a.m.54 views

GitLab: Privilege escalation of "external user" (with maintainer privilege) to internal access through project token

Summary An "external user" a user account with the status external which is granted "Maintainer" role on any project on the GitLab instance where "project tokens" are allowed can elevate its privilege to "Internal". An external user with maintainer permissions could create a project token, which...

6.5AI score
SaveExploits0
Hacker One
Hacker One
added 2021/03/22 3:23 p.m.54 views

GitLab: Arbitrary file read during project import

NOTE! Thanks for submitting a report! Please replace all the parenthesized sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary A mis-usage of json sche...

0.1AI score
SaveExploits0
Hacker One
Hacker One
added 2021/02/25 9:27 a.m.54 views

Mail.ru: Reflected XSS on https://deti.mail.ru

Reflected XSS on deti.mail.ru via request header Referer...

1.4AI score
SaveExploits0
Hacker One
Hacker One
added 2021/01/25 9:21 p.m.54 views

GitLab: Stored-XSS on wiki pages

Hello, A Stored-XSS is existing on Wiki pages. It is caused by recent change in show.html.hamlL10 ruby ... "".htmlsafe ... authorurl is defined by committed email in wikipageversion.rb: ruby delegate :message, :sha, :id, :authorname, :authoremail, :authoreddate, to: :commit def authorurl user =...

0.3AI score
SaveExploits0
Hacker One
Hacker One
added 2020/11/30 1:54 p.m.54 views

Internet Bug Bounty: Heap buffer overflow vulnerability while processing a malformed TIFF file.

A heap buffer overflow vulnerability occurs in magick while processing of a malformed TIFF file.Following is the version/build details: $ magick -version Version: ImageMagick 7.0.10-45 Q16 x8664 2020-11-30 https://imagemagick.org Copyright: © 1999-2020 ImageMagick Studio LLC License:...

4.3CVSS6.9AI score0.01204EPSS
SaveExploits0
Hacker One
Hacker One
added 2020/10/10 6:58 p.m.54 views

U.S. Dept Of Defense: IDOR + Account Takeover [UNAUTHENTICATED]

1- Open the burp suite. 2- Switch the "Repeater" tab. 3- Paste the content of the attached request into the repeater. 4- Replace the "UID2 = 4820041" value in the cookie with the ID value of the user to be attacked. Also write the user's email in the "userName" input. 5- Replace the victim user's...

1.7AI score
SaveExploits0
Hacker One
Hacker One
added 2020/10/04 11:56 a.m.54 views

TikTok: CSRF To Add New App In Developer Account And Bypassing Json Format

The researcher found a CSRF issue allowing a malicious user to add arbitrary applications to a developer's account...

3.2AI score
SaveExploits0
Hacker One
Hacker One
added 2020/09/29 9:20 p.m.54 views

Shopify: authenticity token not verfied leads to change business name

Hello security team , while sign up I have noticed that authenticity token is not verified leads to change info like business name Steps to reproduce 1- visit this url https://www.shopify.com/partners and add you mail then click on join now 2- Then fill out your data and click on create new partn...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2020/09/22 12:49 p.m.54 views

Node.js: Node.js: use-after-free in TLSWrap

Node.js: use-after-free in TLSWrap Node v14.11.0 Current is vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method...

6.8CVSS8.4AI score0.09009EPSS
SaveExploits1
Hacker One
Hacker One
added 2020/08/22 6:12 a.m.54 views

Internet Bug Bounty: CVE-2017-13041 The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().

Description: Versions of tcpdump before 4.9.2 are vulnerable to a buffer over-read in print-icmp6.c. This vulnerability was disclosed to the tcpdump maintainers and was recently patched in version 4.9.2 and disclosed as CVE-2017-13041. Patch:...

7.5CVSS9.3AI score0.04598EPSS
SaveExploits0
Hacker One
Hacker One
added 2020/07/20 10:56 p.m.54 views

Nextcloud: Formula Injection vulnerability in CSV export feature

Dear Nextcloud Team – I have identified a formula injection vulnerability 12 in the CSV export feature of the Forms App. I am aware that the Forms app is not part of this bug bounty program but was advised to disclose it via hackerone anyway. Description. When a n Excel-/Calc- formula is sent as...

7.2AI score
SaveExploits0
Hacker One
Hacker One
added 2020/06/22 6:16 a.m.54 views

Node.js third-party modules: Server-side Template Injection in lodash.js

I would like to report Server-side Template Injection in lodash.js .template function It allows the execution of code on the server Module module name: lodash version: 4.17.15 npm page: https://www.npmjs.com/package/lodash Module Description The Lodash library exported as Node.js modules. Module...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2020/03/21 3:41 p.m.54 views

Staging.every.org: Private account causes displayed through API

Summary: Any authenticated user can see which causes a private account user is interested in, by sending a GET request to the API, even though this information is not displayed anywhere on the profile page. In the profile settings, the following message is displayed for "Private Supporter" option...

6.4AI score
SaveExploits0
Hacker One
Hacker One
added 2020/03/04 3:06 p.m.54 views

Razer: Helpdesk takeover (subdomain takeover) in razerzone.com domain via unclaimed Zendesk instance

The tester discovered a Razer subdomain subject to a takeover. Although we do not normally accept these as part of this program, Razer thanks the tester for his report...

1AI score
SaveExploits0
Hacker One
Hacker One
added 2020/01/21 6:10 a.m.54 views

Kubernetes: Compromise of auth via subset/superset namespace names.

Report Submission Form Summary: Use of nginx.ingress.kubernetes.io/auth annotations results in a file named namespace-ingress.passwd. If user knows the namespace and ingress of an ingress they want to compromise they need to be able to create a namespace that is some subset of namespace-ingress...

4.9CVSS1AI score0.00894EPSS
SaveExploits0
Hacker One
Hacker One
added 2019/12/19 11:03 a.m.54 views

MTN Group: Information Disclosure FrontPage Configuration Information /_vti_inf.html in https://www.mtn.co.za/

Hi there i found a information disclosure Microsoft FrontPage configuration in the subdomain https://www.mtn.co.za/ that allows me to see version number and scripting paths off sharepoint using firefox. POC: Go to the following url: https://www.mtn.co.za/vtiinf.html and you will see a blank page...

6.2AI score
SaveExploits0
Hacker One
Hacker One
added 2019/10/03 4:43 p.m.54 views

Mail.ru: Account Takeover at vseapteki.ru

Insufficient protection against SMS code bruteforcing allowed account takeover in vseapteki.ru Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

3AI score
SaveExploits0
Hacker One
Hacker One
added 2019/08/29 9:32 a.m.54 views

GitLab: Stored XSS for Grafana dashboard URL

Hi GitLab Security Team Summary I found a stored XSS vulnerability in the admins page. The administrator can set up a Grafana dashboard. Here, the administrator can either enter a relative URL or an absolute address. However, when adding an absolute URL, the protocol is not checked allowing to ad...

0.1AI score
SaveExploits0
Hacker One
Hacker One
added 2019/07/11 2:55 p.m.54 views

HackerOne: Total bounties paid amount is disclosed because of redesign of the Program Profiles

Description: On July 2 Hackerone redesigned the Program Profiles.After the new program page design, I noticed that it is disclosing total bounties paid amount. For some program total bounties paid amount was hidden ████. It used to show like $4000 if the bounty was $3990.But after the redesign, i...

6.8AI score
SaveExploits0
Hacker One
Hacker One
added 2019/07/03 11:17 p.m.54 views

HackerOne: Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled

The Custom Field feature is currently only available for customers on the Enterprise product edition. A trial period can be given by enabling the custom-fields-trial feature for programs who are not on that product edition yet. However, when enabling this feature, the incorrect ordering of an ACL...

1AI score
SaveExploits0
Hacker One
Hacker One
added 2019/06/14 11:08 a.m.54 views

Zomato: Able to manipulate order amount by removing cancellation amount and cause financial impact

@sjvino identified an issue where it could have allowed to tamper the cancellation amount and pay less than the actual order amount. Steps submitted by the researcher to reproduce the issue maybe it will help new folks in the community to learn something out of it - - Select Items and add them to...

0.6AI score
SaveExploits0
Hacker One
Hacker One
added 2019/06/14 9:52 a.m.54 views

Mail.ru: XSS при загрузке изображения на [games.mail.ru]

Do-it-yourself XSS self-XSS via crafted file name in support request on games.mail.ru Insufficient filtering of dangerous tags when uploading images on games.mail.ru in technical support tickets...

2.6AI score
SaveExploits0
Hacker One
Hacker One
added 2019/05/07 8:29 a.m.54 views

Node.js third-party modules: [serve-here.js] List any file in the folder by using path traversal.

I would like to report Path Traversal in serve-here.js. It allows to list any file in another folder of web root. Module module name: serve-here.js version: 1.1.3 npm page: https://www.npmjs.com/package/serve-here.js Module Description Serve static files over HTTP Vulnerability Vulnerability...

5CVSS0.6AI score0.01502EPSS
SaveExploits1
Hacker One
Hacker One
added 2019/04/16 5:04 p.m.54 views

TomTom: CSRF allows attacker to manage customer's shopping cart.

The following endpoint https://www.tomtom.com:443/enus/store/basket-add.html had no CSRF checks / tokens .. whatsoever , which allows a malicious user add massive amounts of a any product to a victim's cart or empty the cart. the CSRF POC file included adds 50 items of the giving product the a...

1.3AI score
SaveExploits0
Hacker One
Hacker One
added 2019/03/28 8:35 p.m.54 views

Mail.ru: Rails application running in development mode

autodiscover.staging.geekbrains.ru was running Ruby on Rails in development mode...

1.8AI score
SaveExploits0
Hacker One
Hacker One
added 2019/03/25 2:28 a.m.54 views

50m-ctf: $50 million CTF Writeup

Summary: For a brief overview of the challenge you can take a look at the following image: F451370 Below I will detail each step that I took to solve the CTF, moreover all the bad assumptions that led me to a dead end in some cases. Twitter The CTF begins with this tweet: F451371 What is this...

9.3CVSS8.7AI score0.98452EPSS
SaveExploits35
Hacker One
Hacker One
added 2019/02/18 5:53 p.m.54 views

Upserve : Open redirect on https://hq-api.upserve.com/

The returnto parameter on https://hq-api.upserve.com/auth/auth0?prompt=none&returnto= was not validated and allowed an open redirect...

0.2AI score
SaveExploits0
Hacker One
Hacker One
added 2018/12/03 5:57 p.m.54 views

Mail.ru: [e.mail.ru] Stored xss in Mpop cookie

XSS on e.mail.ru domain via cookie content XSS in cookie via mitm. Good article - https://habr.com/en/post/460101/ by @w2w...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2018/10/28 9:18 p.m.54 views

Infogram: Stored XSS in infogram.com via language

The stored XSS was found in the language profile parameter. POC: Change profile settings with following request: http PUT /api/users/me HTTP/1.1 Host: infogram.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:63.0 Gecko/20100101 Firefox/63.0 Accept: / Accept-Language: en-US,en;q=0.5...

5.6AI score
SaveExploits0
Hacker One
Hacker One
added 2018/10/04 9:07 a.m.54 views

Zomato: Reflected XSS on developers.zomato.com

There is a vulnerability in https://developers.zomato.com/documentation due to an old version of Swagger UI Step to reproduce: - Create an endpoint containing : json "swagger":"2.0","info":"description":"This is a sample server Petstore server. You can find out more about Swagger at...

7.2AI score
SaveExploits0
Hacker One
Hacker One
added 2018/09/22 7:06 a.m.54 views

Khan Academy: Creating Unlimited Fake Accounts.

Hello @khanacademy, Anyone can create unlimited fake accounts using temp mails. i,e https://temp-mail.org/en/ 1- Go to https://temp-mail.org/en/ 2- Select an mail 3- Enter that mail while creating an account in khanacademy 4- You will get confirm mail from khanacademy on https://temp-mail.org/en/...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2018/09/15 1:52 p.m.54 views

Tor: Expose user IP if TOR crashs

Greetings, I have noticed that for unpredictable reason a TOR relay can exposes the IP of an user. I noticed this by going to the server http://195.176.3.24/ and getting information about the headers. I arrived to this header who is : "X-Your-Address-Is" . How : -- - So I went to this tor-relay...

0.5AI score
SaveExploits0
Total number of security vulnerabilities5000