VK.com: Доступ к администраторским faq

Просмотр некоторых закрытых статей FAQ. Уязвимость позволяла получить доступ к талмудам vk.com/tlmdXXX в которых хранится информация для администраторов и модераторов социальной сети ВКонтакте... Получение доступа к адм. информации... @ 500$...

Upserve : Insufficient validation of sides/modifiers quantity

Summary: The Upserve Online Ordering OLO application does not properly verify on the server side the number of sides/modifiers that have been added Description: Certain items allow for selection of a limited number of sides/modifiers, and the application restricts the number of sides/modifies tha...

Vanilla: Vanilla SQL Injection Vulnerability

Summary: There is a SQL injection vulnerability in the vanilla, an attacker can use this vulnerability to obtain database information. Description: We download the program from https://github.com/vanilla/vanilla and install. In applications/dashboard/controllers/class.profilecontroller.php:274 ph...

HackerOne: Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profile

Hi Team, Summary: First of all, i am not sure if a private program or any program have the capability to not show their response efficiency, but i assume they have because i saw some private programs that do not show response efficiency percentage on their public page. Description: Below list of...

Mail.ru: api.icq.com / возможность отредактировать текст любого пользователя или группы переслав его.

Нашёл лютую дырку дело в том что при пересылке сообщения пользователя группы текст стоит в параметре конечно же я пробовал его отредактировать и послать пакет но никак не выходило и тут я использовал один старый метод, обычно же идёт GET запрос его мы и меняем, но после идёт POST запрос который...

U.S. Dept Of Defense: Remote Code Execution (RCE) in a DoD website

SUMMARY: ==================== The DoD https://██████/psc/EXPROD1/ Web System uses the Oracle PeopleSoft platform which is vulnerable to Remote Code Execution RCE and Denial of Service Attacks DoS over a Java Object Deserialization CWE-502 in the “monitor” service. Thus an attacker can generate an...

LocalTapiola: Securemail server used to internal spam and resource exhaustion

Basic report information Summary: Confidential message systems fails to restrict large amount of receivers. This might lead to hardware exhausting and/or attacking localtapiola internal employees as securemail recipient. Description: Despite https://secure.lahitapiola.fi/ is designed to send...

ownCloud: OS Command Injection via tainted PATH environment variable in findBinaryPath

The PATH environment variable is passed to the find command in owncloud/core/blob/master/lib/private/legacy/helper.php on line 543 is not sanitized for input. If an adversary is able to taint the PATH environment variable, OS command execution is possible utilizing the find command's execute -exe...

Internet Bug Bounty: Exim use-after-free vulnerability while reading mail header involving BDAT commands

Original article is here Use-after-free in receivemsg leads to RCE Vulnerability Analysis To explain this bug, we need to start with the memory management of exim. There is a series of functions starts with store such as storeget, storerelease, storereset. These functions are used to manage...

Internet Bug Bounty: Mailsploit: a sender spoofing bug in over 30 email clients

Mailsploit is a collection of bugs in email clients that allow effective sender spoofing and code injection attacks. The spoofing is not detected by Mail Transfer Agents MTA aka email servers, therefore circumventing spoofing protection mechanisms such as DMARC DKIM/SPF or spam filters. Bugs were...

Inflection: Unsubscribe Any User

Researcher reported that HubSpot's "unsubscribe" feature allows any user to unsubscribe from marketing emails without having to confirm their email address. Inflection does not consider this a vulnerability, as we want to make it as easy as possible for users to stop receiving marketing emails th...

Internet Bug Bounty: Heap Use After Free in unserialize()

ext/standard/varunserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data, related to the zvalgettype function in Zend/zendtypes.h. Exploitation of this issue can have an unspecified impact on the integrity of PHP. This...

Unikrn: ssh: unprivileged users may hijack due to backdated ssh version open port found(███.unikrn.com)

Summary: Vulnerabilities in OpenSSH Session Hijacking Vulnerability is a Medium risk vulnerability that is one of the most frequently found on networks around the world. This issue has been around since at least 1990 but has proven either difficult to detect, difficult to resolve or prone to bein...

WakaTime: No redirect uri for Twitter Oath resulting in token leak

Good afternoon, There's an opportunity to steal Oath tokens upon the return uri in the following redirect. https://wakatime.com/oauth/twitter/authorize?reason=tweet&next=/share/embeddable/5e22456d-9aae-4267-b1a9-4315c2605d89/0ed2e4de-f479-4e03-a8db-464a0696c08f.svg/tweet If I change the &next= to...

WakaTime: Leaking password reset token via referrer from external Twitter share button

Hi Team, Description It has been identified that the application is leaking referrer token to third party sites. In this case it was found that the pasword reset token is being leaked to third party sites which is a issue knowing the fact that it can allow any malicious users to use the token and...

Weblate: Option method enabled

Description HTTP OPTIONS method is enabled. Affected URL : https://demo.weblate.org/ https://weblate.org/en/ https://hosted.weblate.org PoC curl -X OPTIONS https://hosted.weblate.org -vv Output aku@galau:$ curl -X OPTIONS https://hosted.weblate.org -vv Rebuilt URL to: https://hosted.weblate.org/...

Weblate: Rate Limit Bypass on login Page

Hi, Your web authentication endpoint, https://demo.weblate.org/accounts/login/ POST, currently protects against credentials brute-force attacks only by requests rate-limiting based on IP. It was found that if an attacker sends login requests faster than every 4 seconds from the same IP address, i...

Ruby: sprintf combined format string attack

In a ticket that was also reported to "shopify-scripts" regarding "MRuby", I reported in details a combined attack against the sprintf gem: Information leak Heap buffer underflow The full ticket details can be found in: Ticket 212239 The ticked was opened several minutes ago but I add it in case ...

Automattic: Cross Domain leakage of sensitive information - Leading to Account Takeover at Instagram Brand

Product / URL https://instagram-brand.com/register/reset/?email= Description and Impact After a user clicks on the password reset link obtained in inbox, the page for password resetting functionality opens. If you monitor the HTTP Requests that are done while that page is loaded, you will come to...

Internet Bug Bounty: CVE-2017-5341 The OTV parser in tcpdump before 4.9.0 has a buffer overflow in print-otv.c:otv_print()

Reported to the project maintainers in 2016. The function sigprint did receive a correct caplen parameter value but didn't use it correctly which could cause a read outside of buffer. Fixed by https://github.com/the-tcpdump-group/tcpdump/commit/409ffe94529df3d8bb8258bf99586f821756cb29...

Zomato: Unauthorised Access to Anyone's User Account

When we do Login with Facebook on the Zomato app, you're doing zero authentication of the user. I'm able to hack into the targeted user's accounts by just using the Facebook ID. Affected API raw request: POST...

Pornhub: Account hijack via deleted PH account

The researcher identified a faulty Oauth implementation allowing YouPorn accounts to be hijacked. The researcher exploited a feature which links Pornhub and YouPorn accounts together by leveraging old accounts which were previously deleted, or where username was changed. A faulty Oauth auth...

Discourse: Stored XSS in posts because of absence of oembed variables values escaping

Hello! Steps to reproduce: 1. Paste this payload URL in the post: http://89.223.28.48/oembedvideo.html?uncache 2. Save the post and you will see the XSS will fire. F151922 The vulnerability exists because of absence of oembed variables values escaping. There is the oembed link in the payload page...

Uber: IDOR on partners.uber.com allows for a driver to override administrator documents

An IDOR in the /p3/drivers/uploadDocument endpoint on partners.uber.com allowed a driver to upload and overwrite documents for other drivers on a multi-driver account. In addition to this, there was an access control issue where a driver account could also upload and overwrite documents for the...

Uber: Reflected XSS in lert.uber.com

Due to a lack of input validation from the search field on lert.uber.com, it was possible to obtain a Reflected XSS from the URL path, e.g. https://lert.uber.com/s/search/All/Home"PAYLOAD. Thanks, @hussain0x3c!...

OLX: Multiple vulnerabilities in http://blog.dubizzle.com/uae

http://blog.dubizzle.com/uae/ uses outdated Yoast Seo plugin which has following vulnerabilities: ! Title: Yoast SEO = 3.2.4 - Subscriber Settings Sensitive Data Exposure Reference: https://wpvulndb.com/vulnerabilities/8487 ! Title: Yoast SEO = 3.2.5 - Unspecified Cross-Site Scripting XSS...

Pushwoosh: Administrator Access To Management Console

Malicious user had the administrator access to RabbitMQ...

OLX: XSS and Open Redirect on https://jobs.dubizzle.com/

Hi, I found an interesting vulnerability.With this one we can redirect someone to a malicious site,or we can trigger XSS. STEPS TO REPRODUCE --------------------- 1-Go to that link https://jobs.dubizzle.com/en/pricing/?return=javascript:prompt31 2-Click the "Continue placing your ad" button. 3-XS...

Boozt Fashion AB: xss in Theme http://bztfashion.booztx.com

Researcher reported XSS vulnerability in Wordpress theme that we were using for our corporate site. Which in turn brought our attention to more available vulnerabilities within that Wordpress installation. Action taken - removed the installation completely and rebuild a more secured version of th...

Trello: File access using image tragick

While Trello had patched our image libraries to prevent the RCE vulnerability in ImageMagick, we had not applied a patch to prevent arbitrary file reads via labels in mvg files. After resolving the issue, we were able to determine that no files had actually been accessed using this vulnerability,...

Nextcloud: Uploading files to a folder where invited user don't have any EDIT privilege

Hi, Any invited user to a shared folder with no edit privilege can create files in it through copy feature of Nextclod android app. Steps to reproduce it + Create any folder and invite a user in it without any edit privilege. + Now login from invited user account through android app. + Copy any...

Nextcloud: Server side request forgery (SSRF) on nextcloud implementation.

An admin of nextcloud server can add other trusted nextcloud server in his own installation. The following request passes when a new add request is processed: http POST /nextcloud/index.php/apps/federation/trusted-servers HTTP/1.1 Host: myown.nextcloudserver.com User-Agent: Mozilla/5.0 Macintosh;...

Nextcloud: Nextcloud server software: Content Spoofing

In Nextcloud the "dir" parameter is vulnerable to content spoofing attack. If anyone puts a valid directory name in dir parameter then it goes that directory other wise it redirects to the home directory / By putting ../../ in dir parameter I was able to stop the redirect then I had put some...

Ruby: SMTP command injection

Net::SMTP is vulnerable to RCPT TO/MAIL FROM injection due to lack of input validation and conformance to the SMTP protocol. Publicly disclosed already: http://www.mbsd.jp/Whitepaper/smtpi.pdf People are wrongly assigning this to the mail gem http://rubysec.com/advisories/OSVDB-131677/ and thinki...

Sucuri: CRLF/HTTP header injection www.sucuri.net

I would like to report a security vulnerability on www.sucuri.net. The domain appears to be vulnerable for CRLF or HTTP header injection. This allows attackers to construct a URL that injects HTTP headers in the server's response. One of the things an attacker can do is injecting a "Set-Cookie"...

Internet Bug Bounty: EVP_EncryptUpdate overflow (CVE-2016-2106)

https://github.com/openssl/openssl/commit/3f3582139fbb259a1c3cbb0a25236500a409bf26...

Zomato: Reflected XSS on Zomato API

First of all here https://hackerone.com/reports/115402 is another report looks like this report. Zomato using APIs for developers to create their restaurant search etc. You are using ressearchwidget which is can be seen right here https://www.zomato.com/widgets/ressearchwidget.php. In the report...

Uber: Dom Based Xss

Hi. found dom xss on this subdomain eng.uber.com. you are using a vulnerable plugin prettyPhoto.. This XSS will work in Firefox,Chrome - Google and IE last version ! And this is very dangerous! POC Firefox vector http://eng.uber.com/prettyPhotoi/x,/x POC Google and IE...

Mail.ru: bgplay.mail.ru

Potential RCE via Java object deserialization in out-of-scope service...

Vimeo: Legacy API exposes private video titles

Hi, I have discovered Vimeo's legacy API vimeo.com/api exposes private video titles. Example URL: https://vimeo.com/api/oembed.json?url=https%3A//vimeo.com/152133387 Vimeo provides the uploader with 5 privacy options for viewing videos: 1. Anyone 2. Only me 3. Only people I follow 4. Only people ...

Informatica: [rev-app.informatica.com] - XXE via SAML

Request: POST /sso HTTP/1.1 Host: rev-app.informatica.com Connection: keep-alive Content-Length: 8669 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Origin: https://infapassport.okta.com Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5....

Slack: Stored XSS in Slack (weird, trial and error)

Hi slack. I found a weird, trial and error Stored XSS in Slack... I hope you can get clear of this and get it too.. and I hope you can find the XSS too. Anyway here it is according to what I did: 1. Go to your Slack or create a new Slack team. 2. In slackbot.. enter this payload: 3. Then, Create ...

Ruby on Rails: Potential XSS on sanitize/Rails::Html::WhiteListSanitizer

Possible XSS vulnerability in rails-html-sanitizer There is a possible XSS vulnerability in the white list sanitizer in the rails-html-sanitizer gem. This vulnerability has been assigned the CVE identifier CVE-2015-7580. Versions Affected: All. Not affected: None. Fixed Versions: v1.0.3 Impact...

HackerOne: Internal bounty and swag details disclosed as part of JSON response

Hello Hackerone team !!!! If Some company take option like this : Show minimum bounty on the program page? Do not display the minimum bounty on the program page. for example : https://hackerone.com/███████████ Private bounty details "basebounty":10 https://hackerone.com/████ Private swag details...

Internet Bug Bounty: Internet-based attacker can run Flash apps in local sandboxes by using special URL schemes (PSIRT-3299, CVE-2015-3079)

Some of the sandbox logic of Flash Player can be circumvented on most web browsers by using special URL schemes. A website can deploy an SWF file via the data: or blob: URL schemes perhaps others. An app started in this way runs in the "local with files" or "local with networking" sandbox,...

Shopify: [www.*.myshopify.com] CRLF Injection

CRLF Injection via Request-URI PoC: http://www.myshopify.com/xxcrlftest%0aSet-Cookie:test=test3;domain=.myshopify.com; https://www.blackfan.myshopify.com/xxx%0aSet-Cookie:test=test2;domain=.myshopify.com; HTTP Response: HTTP/1.1 302 Moved Temporarily ... Location: http://myshopify.com/xxcrlftest...

Coinbase: Two-factor authentication (via SMS)

Hello Coinbase Security Team I just found a problem in Two-factor authentication mechanism, here is the details and how to reproduce this issue: I have two accounts with two emails on coinbase.com i active 2FA on the both of two emails with this phone number +201066462288. From Chrome i will try ...

Mail.ru: http://fitter1.i.mail.ru/browser/ торчит Graphite в мир

http://fitter1.i.mail.ru/browser/ Он тут. Если верить: http://fitter1.i.mail.ru/version/ Версия: 0.9.10 У нее RCE через PICLE. http://www.rapid7.com/db/modules/exploit/unix/webapp/graphitepickleexec...

Mail.ru: store-agent.mail.ru: stacked blind injection

store-agent.mail.ru purchases db admin auth bypass + blind sql injection...

Internet Bug Bounty: Double free vulnerability in Flash Player Settings Manager (CVE-2015-0346)

This was patched by https://helpx.adobe.com/security/products/flash-player/apsb15-06.html , described as a "double-free vulnerability that could lead to code execution"...