Lucene search
+L
HackeroneMost viewed

15523 matches found

Hacker One
Hacker One
added 2019/06/14 9:52 a.m.54 views

Mail.ru: XSS при загрузке изображения на [games.mail.ru]

Do-it-yourself XSS self-XSS via crafted file name in support request on games.mail.ru Insufficient filtering of dangerous tags when uploading images on games.mail.ru in technical support tickets...

2.6AI score
SaveExploits0
Hacker One
Hacker One
added 2019/05/07 8:29 a.m.54 views

Node.js third-party modules: [serve-here.js] List any file in the folder by using path traversal.

I would like to report Path Traversal in serve-here.js. It allows to list any file in another folder of web root. Module module name: serve-here.js version: 1.1.3 npm page: https://www.npmjs.com/package/serve-here.js Module Description Serve static files over HTTP Vulnerability Vulnerability...

5CVSS0.6AI score0.01502EPSS
SaveExploits1
Hacker One
Hacker One
added 2019/04/16 5:04 p.m.54 views

TomTom: CSRF allows attacker to manage customer's shopping cart.

The following endpoint https://www.tomtom.com:443/enus/store/basket-add.html had no CSRF checks / tokens .. whatsoever , which allows a malicious user add massive amounts of a any product to a victim's cart or empty the cart. the CSRF POC file included adds 50 items of the giving product the a...

1.3AI score
SaveExploits0
Hacker One
Hacker One
added 2019/03/28 8:35 p.m.54 views

Mail.ru: Rails application running in development mode

autodiscover.staging.geekbrains.ru was running Ruby on Rails in development mode...

1.8AI score
SaveExploits0
Hacker One
Hacker One
added 2019/03/25 2:28 a.m.54 views

50m-ctf: $50 million CTF Writeup

Summary: For a brief overview of the challenge you can take a look at the following image: F451370 Below I will detail each step that I took to solve the CTF, moreover all the bad assumptions that led me to a dead end in some cases. Twitter The CTF begins with this tweet: F451371 What is this...

9.3CVSS8.7AI score0.98452EPSS
SaveExploits35
Hacker One
Hacker One
added 2019/03/05 4:55 p.m.54 views

Internet Bug Bounty: DOS in stream filters

see bug report https://bugs.php.net/bug.php?id=76249 as simple as one process running in an endless loop Impact DOS, process ends up in an endless loop, CPU or available php processes or both of affected system get easily exhausted...

5CVSS8AI score0.10228EPSS
SaveExploits0
Hacker One
Hacker One
added 2019/03/03 10:08 a.m.54 views

50m-ctf: CTF write-up: c8889970d9fb722066f31e804e351993

So the CTF starts with this tweet. F434370 The first image is about the 50 million in bounties but the second one looks related to the CTF. The first thing that comes to mind when relating CTFs and images is "steganography". Using the all purpose steg tool zsteg as our first resort, we discover...

9.3CVSS8.7AI score0.98452EPSS
SaveExploits35
Hacker One
Hacker One
added 2019/02/18 5:53 p.m.54 views

Upserve : Open redirect on https://hq-api.upserve.com/

The returnto parameter on https://hq-api.upserve.com/auth/auth0?prompt=none&returnto= was not validated and allowed an open redirect...

0.2AI score
SaveExploits0
Hacker One
Hacker One
added 2018/12/03 5:57 p.m.54 views

Mail.ru: [e.mail.ru] Stored xss in Mpop cookie

XSS on e.mail.ru domain via cookie content XSS in cookie via mitm. Good article - https://habr.com/en/post/460101/ by @w2w...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2018/10/28 9:18 p.m.54 views

Infogram: Stored XSS in infogram.com via language

The stored XSS was found in the language profile parameter. POC: Change profile settings with following request: http PUT /api/users/me HTTP/1.1 Host: infogram.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:63.0 Gecko/20100101 Firefox/63.0 Accept: / Accept-Language: en-US,en;q=0.5...

5.6AI score
SaveExploits0
Hacker One
Hacker One
added 2018/10/04 9:07 a.m.54 views

Zomato: Reflected XSS on developers.zomato.com

There is a vulnerability in https://developers.zomato.com/documentation due to an old version of Swagger UI Step to reproduce: - Create an endpoint containing : json "swagger":"2.0","info":"description":"This is a sample server Petstore server. You can find out more about Swagger at...

7.2AI score
SaveExploits0
Hacker One
Hacker One
added 2018/09/27 8:27 a.m.54 views

h1-5411-CTF: Flag WriteUp

Hello everyone , here is my writeup : Intro First I decoded the QR Code of the tweet , decoding to Here you go: 68747470733a2f2f68312d353431312e68316374662e636f6d . Decoding the hex value we get the challenge URL : https://h1-5411.h1ctf.com Path traversal + local file read On the website I found...

0.3AI score
SaveExploits0
Hacker One
Hacker One
added 2018/09/22 7:06 a.m.54 views

Khan Academy: Creating Unlimited Fake Accounts.

Hello @khanacademy, Anyone can create unlimited fake accounts using temp mails. i,e https://temp-mail.org/en/ 1- Go to https://temp-mail.org/en/ 2- Select an mail 3- Enter that mail while creating an account in khanacademy 4- You will get confirm mail from khanacademy on https://temp-mail.org/en/...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2018/09/15 1:52 p.m.54 views

Tor: Expose user IP if TOR crashs

Greetings, I have noticed that for unpredictable reason a TOR relay can exposes the IP of an user. I noticed this by going to the server http://195.176.3.24/ and getting information about the headers. I arrived to this header who is : "X-Your-Address-Is" . How : -- - So I went to this tor-relay...

0.5AI score
SaveExploits0
Hacker One
Hacker One
added 2018/09/05 1:49 a.m.54 views

Node.js third-party modules: [apex-publish-static-files] Command Injection on connectString

I would like to report a command injection vulnerability in the apex-publish-static-files npm module. It allows arbitrary shell command execution through a maliciously crafted argument. Module module name: apex-publish-static-files version: 2.0.0 npm page:...

10CVSS0.6AI score0.06991EPSS
SaveExploits1
Hacker One
Hacker One
added 2018/09/01 10:44 a.m.54 views

Khan Academy: SignUp With Fake Email

Hello KhanAcademy Security Team, I'm rootbakar, I found an oddity that allows a user to register with Khanacademy using an invalid or fake email. In this trial I used the email '[email protected]' and after pressing the SIGN UP button it will automatically enter the user dashboard pag...

0.3AI score
SaveExploits0
Hacker One
Hacker One
added 2018/08/21 12:53 a.m.54 views

Uber: Stored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account Takeover

By getting an authenticated victim to visit a malicious link, an attacker can cause that victim to execute arbitrary JavaScript in the context of the login.uber.com or auth.uber.com domains...

3.5AI score
SaveExploits0
Hacker One
Hacker One
added 2018/07/22 9:07 a.m.54 views

Chaturbate: Homograph attack on redirect URL (https://chaturbate.com/external_link/?url)

Hi There, Hope you are doing good, As i was just playing around with chaturbate.com and found that you guys does not have proper configuration for malicious script injection in website. In Homograph attack basically attacker may able to inject some malicious script with URL. Here i made homograph...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2018/07/13 3:38 a.m.54 views

Slack: SSRF in api.slack.com, using slash commands and bypassing the protections.

Bypassing the reports 61312 and 356765 Tutorial: Go to api.slack.com and create an application with your own slash command. F320014 Enter your own domain: in your own domain: index.php location: http://:::22/ F320019 And save. Go to your Slack and type /youslash Try with my server...

0.2AI score
SaveExploits0
Hacker One
Hacker One
added 2018/06/22 10:40 a.m.54 views

Mail.ru: Вывод значений переменных Nginx в теле страницы

При обращении к url вида: https://biz.mail.ru/$имяпеременнойnginx Значение этой переменной попадет в страницу ответа 404, во все места вида: e.mail.ru/login?lang=ruRU&Page=https%3A%2F%2Fbiz.mail.ru%2Fзначениепеременнойnginx Примеры запросов: 1 https://biz.mail.ru/test$realpathroot в ответе:...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2018/05/04 5:16 p.m.54 views

Zomato: XSS in "explore-keywords-dropdown" results.

It seems that people have exploited this vulnerability before on this website, however, it remains unpatched, so here I am reporting the vulnerability. A XSS vulnerability exists when a restaurant or dish is created with a malicious name. The title of the dish or restaurant is not properly filter...

0.3AI score
SaveExploits0
Hacker One
Hacker One
added 2018/05/03 12:04 a.m.54 views

Mail.ru: LFI in beta.mail.ru

Local file read via file:// URI in report's image in beta.mail.ru. beta.mail.ru is not currently covered by bug bounty program. Чтение произвольных файлов сервера путем недостаточной проверки прикрепленных изображений...

1.3AI score
SaveExploits0
Hacker One
Hacker One
added 2018/05/01 7:54 p.m.54 views

GitLab: Persistent XSS - Selecting users as allowed merge request approvers

Summary: When using the dropdown that selects the users that are allowed to approve a merge request, it is possible to trigger a XSS with a malicious user name string. Description: This vulnerability is similar to the recently announced CVE-2018-10379 and another vulnerability I recently reported...

4.3CVSS0.3AI score0.00888EPSS
SaveExploits0
Hacker One
Hacker One
added 2018/04/18 6:24 p.m.54 views

Node.js third-party modules: Command injection in 'pdf-image'

I would like to report command injection in pdf-image It allows executing commands on the server Module module name: pdf-image version: 1.0.5 npm page: https://www.npmjs.com/package/pdf-image Module Description Provides an interface to convert PDF's pages to png files in Node.js by using...

10CVSS0.8AI score0.04568EPSS
SaveExploits2
Hacker One
Hacker One
added 2018/01/30 3:14 p.m.54 views

Node.js third-party modules: Prototype pollution attack (defaults-deep)

As discussed in 309391, here's the separate report for each of the library. This one is the information for the defaults-deep library. Module: https://www.npmjs.com/package/defaults-deep Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object"...

6.5CVSS8.9AI score0.02036EPSS
SaveExploits1
Hacker One
Hacker One
added 2017/12/26 4:17 p.m.54 views

VK.com: Монипулирование на страницах пользоватлей значением "Подсказывать стикеры в полях ввода"

Отсутствовал hash в запросах при изменении настроек стикеров. Ошибочка в репорте включить на конце 1 Включить https://m.vk.com/attachments?ajax=1&act=stickershintsenabled&value=1 CSRF - ОТСУСТВИЕ HASH дает возможность совершать переключение в мобильной версии ВК , подсказок в полях ввода ! Тем...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2017/12/12 7:44 a.m.54 views

Deriv.com: Leaking Referrer in Reset Password Link

On 12th Dec flex0geek reported that binary.com was leaking password reset tokens through referer headers . At first this sight the report was closed as we had fixed this earlier and our code base seemed fine . Later on the researcher sent a video POC which did show that we were leaking password...

7.3AI score
SaveExploits0
Hacker One
Hacker One
added 2017/12/07 4:44 a.m.54 views

RBKmoney: Open Redirection on auth.rbk.money

An open redirect vulnerability was found in KeyCloak. Find writeup soon in my website ; Edit , Write is here : http://abartandhakal.com.np/main/2018/01/27/open-redirection-on-rbk-money/...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2017/11/29 11:11 a.m.54 views

HackerOne: Query parameter reordering causes redirect page to render unsafe URL

Hello hackerone team I want to report I bypass w/c lead to XSS but limited only for IE due to CSP block on chrome Here is the POC ------------------ https://hackerone.com/redirect?signature=c9304cadaeabca0bfb7b92503c0318da5c42a86b&url=http%3A%2F%2Fbuglabs.me&url=JAVASCRIPT:alert%09document.domain...

6.2AI score
SaveExploits0
Hacker One
Hacker One
added 2017/10/04 10:47 a.m.54 views

Legal Robot: cross site web socket hijacking

In the below web-socket request successful 101 protocol handshake is working with the origin:https://app.legalrobot.com, but if you place the malicious origin in the place of https://thisdata.com which is http://evil.com or any page containing the malware, the web socket server is still giving 10...

SaveExploits0
Hacker One
Hacker One
added 2017/09/28 5:15 a.m.54 views

Aspen: No Rate Limit (Leads to huge email flooding/email bombing)

Dear sir, At first,i want to say that this sensitive action definitely should be set with rate limit. Note:-This is about huge bombing/brute force on any endpoints. Vulnerability:- -No rate limit has been set for generating account confirmation emails for accounts on above selected domain which i...

7.1AI score
SaveExploits0
Hacker One
Hacker One
added 2017/09/22 8:33 p.m.54 views

GitLab: [Markdown] Stored XSS via character encoding parser bypass

Hi @briann and team, A carefully crafted injection used against the Markdown input parser can be leveraged to store and execute arbitrary JavaScript on GitLab 10.0 hosts. Given the nature of this injection, which makes use of a rather esoteric filter bypass, the scope for exploitation may vary...

7.5AI score
SaveExploits0
Hacker One
Hacker One
added 2017/09/18 10:11 a.m.54 views

Hiro: Weak crossdomain.xml

The e-mail list management service used by Blockstack operated by MailChimp has a lenient cross-domain flash policy -- this is not a vulnerability, however, the crossdomain.xml used by the mailing service is more lenient than used by normal web services...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2017/08/19 1:13 p.m.54 views

Rockstar Games: dom based xss in http://www.rockstargames.com/GTAOnline/ (Fix bypass)

The researcher was able to bypass a previous fix for a DOM-Based XSS vulnerability 254343 by hashing part of the payload. This showed that our previous fix was insufficient, so we updated it to a more thorough solution...

0.4AI score
SaveExploits0
Hacker One
Hacker One
added 2017/07/01 3:24 a.m.54 views

WakaTime: No notificatoin sent on email after account deletion.

Hi again, Description: I've just noticed that there's no email notification received after successfully removal of account. Fixation: User should be notified by email notification at his email after removal of an account. Cheers Mansoor...

1.4AI score
SaveExploits0
Hacker One
Hacker One
added 2017/06/19 1:42 p.m.54 views

Automattic: woocommerce - prevent_caching() bug / bypass

As guest visit the following links and look at the headers. Yup there are not caching headers in the response. https://woocommerce.com/.cart/https://woocommerce.com/.cart/ https://woocommerce.com/+cart/https://woocommerce.com/+cart/ https://woocommerce.com/-cart/https://woocommerce.com/-cart/...

SaveExploits0
Hacker One
Hacker One
added 2017/05/26 11:03 p.m.54 views

U.S. Dept Of Defense: Remote Code Execution (RCE) vulnerability in a DoD website

A remote code execution RCE vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. Thank you @peuch for notifying us of this vulnerability!...

6.4CVSS1.8AI score0.50837EPSS
SaveExploits10
Hacker One
Hacker One
added 2017/05/20 8:15 a.m.54 views

Paragon Initiative Enterprises: Full directory path listing

STEP: ==================== 1. goto https://bridge.cspr.ng/login and enter your username,password 2. click "LogIn" and intercept the request 3. change the value in cookie header and add 'single quote in PHPSESSID field eg: PHPSESSID=kn7e21dpp2ocai2ckn1v147qev' 4. Forward the packet and see full pa...

0.9AI score
SaveExploits0
Hacker One
Hacker One
added 2017/05/03 5:34 a.m.54 views

HackerOne: Insecure SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com

Hello, I just found some minor issue with RSA 2048 bits SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com thru Qualys SSL Labs and wanted to report it. Proof of Concept https://www.ssllabs.com/ssltest/analyze.html?d=b5s.hackerone-ext-content.com Result: SHA1withRSA...

0.1AI score
SaveExploits0
Hacker One
Hacker One
added 2017/04/18 2:34 p.m.54 views

Homebrew: Host header Injection

HI SECURITY TEAM Here is host header injection. Request changing host to www.google.com GET / HTTP/1.1 Host: www.google.com User-Agent: Mozilla/5.0 Windows NT 6.1; rv:24.0 Gecko/20100101 Firefox/24.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language:...

7AI score
SaveExploits0
Hacker One
Hacker One
added 2017/03/01 10:55 p.m.54 views

Ruby: Arbitrary heap exposure in JSON.generate

Running this snippet can expose arbitrary memory: ruby require 'json' state = JSON.state.new state.space = "\0" 1024 puts JSON.generatea: :b, state "a": psych/handlers/recorder.rb tensi0 reeze Gem::Specification.new do |s| to objects of the same type as the original delegate...

7.5CVSS0.2AI score0.09445EPSS
SaveExploits1
Hacker One
Hacker One
added 2017/02/02 5:21 p.m.54 views

Internet Bug Bounty: CVE-2017-5341 The OTV parser in tcpdump before 4.9.0 has a buffer overflow in print-otv.c:otv_print()

Reported to the project maintainers in 2016. The function sigprint did receive a correct caplen parameter value but didn't use it correctly which could cause a read outside of buffer. Fixed by https://github.com/the-tcpdump-group/tcpdump/commit/409ffe94529df3d8bb8258bf99586f821756cb29...

7.5CVSS8.6AI score0.05333EPSS
SaveExploits0
Hacker One
Hacker One
added 2017/02/02 12:44 a.m.54 views

VK.com: Missing Server Side Rate Limiting can Lead to VK Account Take over

Insufficient flood control...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2017/01/12 4:42 p.m.54 views

Nextcloud: User Information Disclosure via REST API

Hello, I found out that you are using WP 4.6.2 on your domain which is outdated. https://nextcloud.com/readme.html Description:- WordPress versions 4.7 and earlier are affected by multiple security issues. Kindly check https://wpvulndb.com/wordpresses/462 for the vulnerabilities and in detailed...

1.1AI score
SaveExploits0
Hacker One
Hacker One
added 2016/12/15 11:41 a.m.54 views

X (Formerly Twitter): CRLF and XSS stored on ton.twitter.com

Hey, 1 CRLF: It's similar to 52042 but weaker to reproduce go to: https://ton.twitter.com/1.1/ton/data/dm/x/%E5%98%8A%E5%98%8Dset-cookie%3A%20test%3Dtest%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC you will find that test cookie with the val...

6.6AI score
SaveExploits0
Hacker One
Hacker One
added 2016/12/04 9:03 p.m.54 views

OLX: Multiple vulnerabilities in http://blog.dubizzle.com/uae

http://blog.dubizzle.com/uae/ uses outdated Yoast Seo plugin which has following vulnerabilities: ! Title: Yoast SEO = 3.2.4 - Subscriber Settings Sensitive Data Exposure Reference: https://wpvulndb.com/vulnerabilities/8487 ! Title: Yoast SEO = 3.2.5 - Unspecified Cross-Site Scripting XSS...

SaveExploits0
Hacker One
Hacker One
added 2016/11/29 10:17 p.m.54 views

Pornhub: Stored XSS on the http://ht.pornhub.com/widgets/

The researcher found a stored XSS in the HubTraffic widgets section. I found Stored XSS in the Hubtraffic widgets section. The team was very responsible and fixed the issue fast. Many thanks to the PornHub security team for the bounty and swag i received it already, very cool!...

5.9AI score
SaveExploits0
Hacker One
Hacker One
added 2016/11/14 7:35 p.m.54 views

Internet Bug Bounty: libtiff 4.0.6 segfault / read outside of buffer (CVE-2016-9297)

segfault and read outside of buffer in libtiff 4.0.6 and possibly earlier. This library is baked into web browsers used by millions and also devices like the PlayStation Portable and the iPhone. http://bugzilla.maptools.org/showbug.cgi?id=2590 Reported to the vendor on 7 November 2016: ASAN:SIGSE...

5CVSS8AI score0.06471EPSS
SaveExploits0
Hacker One
Hacker One
added 2016/11/01 4:29 p.m.54 views

VK.com: Новый 2FA Bypass

Частичный обход проверки сессии. Косяк в функции смены пароля...

6.9AI score
SaveExploits0
Hacker One
Hacker One
added 2016/09/28 2:23 a.m.54 views

Reverb.com: IDOR - Ability to view unlisted products

Hi All, I believe I've found a vulnerability on your sandbox site which allows attackers to view the details of listings that are unpublished. Description While creating a product, I noticed there is a call to https://sandbox.reverb.com/api/listings/65905/productbundle which returns json details...

6.7AI score
SaveExploits0
Total number of security vulnerabilities5000