15580 matches found
Mail.ru: Same Origin Policy bypass
Hi, After small investigation I've probably found something that can be exploited to bypass Same Origin Policy on mail.ru services specially your main domain and e.mail.ru. First of all - let's take a look about your crossdomain.xml both for mail.ru and e.mail.ru: After time spent on searching...
HackerOne: Improper way of validating a program
Hello HackerOne, I found out that it's easy to publish a program that isn't yours. January 20, 2015 I created a program named Puffer Bird and I leave the sandbox to prepare to launch the program. Then, I requested for a program review. January 21, 2014 at 1:08 AM I received an email from...
X (Formerly Twitter): Insecure Data Storage in Vine Android App
Hi Twitter, - Vulnerability Class:OWASP M2 : Insecure Data Storage Every application needs to store something secret, like a website username,password, cookies etc. , internal storage is the place to do it, android sandbox prevents other applications from accessing this data but,In vine android a...
HackerOne: Reflected File Download
Info: Reflected File Download is a new web attack vector. It allows an attacker to craft a malicious file and present it to a victim, but there is no file present at the server. It was recently published at the BlackHat Eupore 2014 by Oren Hafif. Link to his presentation is given at the end...
Mail.ru: XSS via .eml file
сначала смотрим скриншот : XSS возможен через .eml вложения, уязвимо имя .eml файла, которое присваивается из названия Темы сообщения строка Subject в eml. JS отыграет на странице превью файлов https://e.mail.ru/attaches-viewer/?... шаги для воспроизведения пересылая письмо: -...
Yahoo!: https://caldav.calendar.yahoo.com/ - XSS (STORED)
Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...
Coinbase: Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response Code
Hi, There's a simple bug here, the Coinbase Android App. "BitCoin Wallet" leaks the OAuth Response Code which can be obtained using adb logcat -s Coinbase command line for testing, and any Android application on the same phone can read the response code for the user by reading the logs. As of now...
Coinbase: Cookie missing the HttpOnly flag
Hello coinbase, Iam saikiran.Iam a security researcher.while i was going through your site i found that your website does not have HTTPOnly flag for the cookies.it is not a vulnerability but it is a new improvement and improves the security of your site. If your not aware of HTTPOnly flag here is...
Liberapay: Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat
A vulnerability was discovered in the unauthenticated team "income/payments" export feature of Liberapay. The vulnerability allowed an attacker to retrieve donor identity, exact donation amount, and donation dates for public donors, bypassing the donor's explicit privacy settings such as...
curl: verify-release rebuilds from the tarball under verification, enabling pre-check command execution and false OK for a malicious curl release tarball
Summary: scripts/verify-release is documented as a way to independently verify a downloaded curl release tarball, but on curl-8.20.0 it extracts the tarball under verification and executes ./configure and ./scripts/dmaketgz before any trust decision is made. This creates a circular trust failure:...
curl: curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download write
Summary: The curl CLI's --skip-existing option performs a separate existence check before the download body is written. In the verified path, curl first calls stat on the target pathname and decides "the file does not exist, so continue", but it does not keep an fd bound to that decision. The...
curl: Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN match
Hi all, Sorry to ruin anybody's day, but we've discovered another issue when it comes to dots. We've found a TLS certificate verification bypass that lets a trailing-dot IPv4 URL -- https://127.0.0.1./ -- pass peer authentication against a wildcard DNS SAN certificate such as DNS:.0.0.1. The IP...
curl: Path Traversal in SFTP QUOTE command leads to Arbitrary File Write and potential RCE
Description Summary libcurl is vulnerable to a path traversal attack when processing SFTP QUOTE commands. The internal function Curlgetpathname in lib/vssh/curlpath.c fails to sanitize user-provided paths for traversal sequences ../. An attacker who can control the SFTP QUOTE commands can leverag...
Automattic: Woocommerce SQL Injection in WC_Report_Coupon_Usage
A SQL injection vulnerability was found in the WooCommerce plugin version 9.9.3. The vulnerable parameter was 'couponcodes' in the '/wp-admin/admin.php?page=wc-reports&tab=orders&report=couponusage' endpoint. The vulnerability required the privilege to view reports...
AWS VDP: A potential risk in the cloudFrontExtensionsConsole which can be used to privilege escalation.
A potential risk was found in the cloudFrontExtensionsConsole when it was deployed in the awslabs repository on GitHub. The functions created by the application had excessive permissions that could be leveraged to escalate privileges...
U.S. Dept Of Defense: IDOR leads to PII Leak
The vulnerability allowed the disclosure of other users' email addresses through Insecure Direct Object Reference IDOR. A user could access other users' profile information by modifying the user ID in the URL...
curl: Denial of Service in curl Request - HTTP headers eat all memory
Vulnerability description not provided...
Internet Bug Bounty: CVE-2024-35200 in nginx
CVE-2024-35200 was discovered in NGINX Plus and NGINX OSS when configured to use the HTTP/3 QUIC module. Undisclosed HTTP/3 requests were found to cause NGINX worker processes to terminate...
Hyperledger: Docker Secret Disclosure via GitHub Actions Cache Poisoning
The vulnerability involved the disclosure of Docker secrets through GitHub Actions cache poisoning. The issue was reported and subsequently resolved...
Internet Bug Bounty: CVE-2024-0853: OCSP verification bypass with TLS session reuse
CVE-2024-0853 was a vulnerability in the cURL library where OCSP verification was bypassed when reusing a TLS session. The vulnerability was caused by cURL inadvertently keeping the SSL session ID in its cache even when the OCSP stapling verification failed. This allowed subsequent transfers to t...
PortSwigger Web Security: CSP bypass on PortSwigger.net using Google script resources
A cross-site scripting vulnerability was discovered on PortSwigger.net. The site's content security policy allowed resources from Google's reCAPTCHA domain, which contains AngularJS. This could be abused to bypass the CSP and load arbitrary scripts from other domains. The issue allowed an attacke...
Node.js: Path traversal by monkey-patching Buffer internals
A path traversal vulnerability was introduced in the experimental permission model in Node.js 20 and 21 by monkey-patching Buffer internals. This allowed modification of the result of path.resolve, leading to traversal beyond the expected path...
GitHub Security Lab: JavaScript: Add some new XSS sinks and sources of Next.js (and some extra improvements)
Vulnerability description not provided...
HackerOne: Asset Inventory Internal Descriptions are leaked in CSV export
An internal asset description in the Asset Inventory feature of HackerOne was leaked in the CSV export, potentially exposing sensitive information stored in the description...
Internet Bug Bounty: Privilege Esacalation at Apache Airflow 2.5.1
A vulnerability was found in Apache Airflow before version 2.6.0 that allowed local Linux users to access sensitive files, such as SSH private keys, owned by the account that operates Airflow. The issue was caused by Airflow setting log files to vulnerable privileges, allowing any Linux user on t...
GitLab: Account takeover due to insufficient URL validation on RelayState parameter
An insufficient URL validation on the RelayState parameter in GitLab allowed attackers to steal Bitbucket access tokens and other third-party access tokens, such as Google, Salesforce, and Twitter. The vulnerability was due to an open redirect while logging in to GitLab via SAML, which saved the...
curl: CVE-2023-28319: UAF in SSH sha256 fingerprint check
Vulnerability description not provided...
Expedia Group Bug Bounty: https://www.wotif.com/vc/blog/info.php script is prone to reflected HTML/CSS injection and COOKIE leak
The info.php script on https://www.wotif.com was vulnerable to reflected HTML/CSS injection and COOKIE leak due to caching of HTTP headers. An attacker could inject malicious HTML/CSS code and steal victim cookies. The vulnerability was reported to the vendor...
Nextcloud: Mail app stores cleartext password in database until OAUTH2 setup is done
A vulnerability was found in the Nextcloud Mail app where the password for XOAUTH2 accounts was stored in clear text in the database during the setup process, until the OAUTH2 setup was completed. This could have allowed a database administrator to read the plaintext password...
Rocket.Chat: Insecure use of shell.openExternal() leads to RCE in Rocket.Chat-Desktop
Rocket.Chat-Desktop passes the parameter url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video chat window must be disabled or a Mac App Store build must be used...
8x8: Directory Listing at https://█.█.█.█
@shuvam321 reported to us an enabled Directory Listing at https://█.█.█.█/cobbler/ & https://█.█.█.█/cblr/. The directories exposed open source files related to the Spacewalk project. The server instance was initially installed as a preview of a Spacewalk. No sensitive information had been...
Nextcloud: Hide download previews are accessible without a watermark
A vulnerability was discovered in Nextcloud that allowed users to access download previews without a watermark, even when the watermark option was enabled. This could potentially compromise the privacy of the document and goes against the intended purpose of the feature...
curl: CVE-2022-35252: control code in cookie denial of service
Summary: I took a look at https://github.com/curl/curl/pull/9048/commits/d7bcbc7d8d4b6d972d3da12d54819169a19c287b a sneak peek on a vulnerability to be announced tomorrow. My guess for that vulnerability is that since cookies are persistent, someone who can trick curl into storing cookies can sto...
Internet Bug Bounty: Undici ProxyAgent vulnerable to MITM
Full GitHub advisory summarizing the issue is here: https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33 The original Node.js HackerOne report is here: https://hackerone.com/bugs?reportid=1583680 This was fixed & disclosed in Undici v5.5.1. This primarily affects Undici, a...
Acronis: unauth mosquitto ( client emails, ips, license keys exposure )
Hi team Summary connect.acronis.com ip 88.99.142.45:1883 has unauth mosquitto mqtt, anyone can connect and read\write messages Steps To Reproduce add details for how we can reproduce the issue 1. https://github.com/bapowell/python-mqtt-client-shell 1. python3 mqttclientshell.py 1. connection 1...
Reddit: Reflected xss in https://sh.reddit.com
Summary: Reflected cross-site scripting or XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. Impact: attacker can execute malicious java script and steal cookies Steps To Reproduce: add details for how we can...
SMTP2GO BBP: Origin IP found, WAF Cloudflare Bypass
Description: I have discovered that the http://172.105.190.180/login/ site exposed it's IP which could allow bypassing of anti-DDoS mechanisms i.e you are using Cloudflare for protection. For Originate IP address which I found from https://search.censys.io/ By using these IP address as a resolver...
Omise: Host Header Injection leads to Open Redirect and Content Spoofing or Text Injection.
Summary: 1. Open Redirection The https://dashboard.omise.co/test/dashboard website is vulnerable to an Open Redirection flaw if the server receives a crafted X-Forwarded-Host header. Description: Open Redirect is a vulnerability in which the attacker manipulates a web page to redirect the users t...
TikTok: Clickjacking Vulnerability Can Leads To Delete Developer APP
A clickjacking vulnerability was found on a TikTok subdomain, where an attacker could trick another user into deleting the Developer App. We thank @rioncool22 for reporting this to our team...
Judge.me : The response shows the nginx version
Summary: On visiting the https://cache.judge.me/ .It show the nginx version Steps To Reproduce: ==send :== GET / HTTP/1.1 Host: cache.judge.me Cookie: ga=GA1.2.907415772.1636450777; gid=GA1.2.1767694824.1636450777; fbp=fb.1.1636450778172.127612364; hjid=00598a42-40f4-48cb-84ec-20b9bd4273cd;...
PortSwigger Web Security: Information disclosure on error message
Hai team, First of all , Thank you creating a wonderful place for learning web app pentesting : . In accessing a lab at the academy , my internet connection suddenly went down, I dont know the problem is on the lab or in academy, But the error message reveals some node codes.I attached a screensh...
UPchieve: No Rate Limiting on /reset-password-request/ endpoint
Summary: Description Hi there ! I noticed when we hit the /reset-password-request/ endpoint too many times via some proxy for e.g:- Burp there is no rate limit on that endpoint and you can spam the email with 100’s of requests and resend even more password reset emails to the users as there is no...
U.S. Dept Of Defense: RCE in ███ [CVE-2021-26084]
A vulnerability in affected versions of Confluence Server and Data Center allowed authenticated users, and in some cases unauthenticated users, to execute arbitrary code. The vulnerability was due to an OGNL injection issue affecting endpoints that could be accessed by non-administrators when use...
U.S. Dept Of Defense: XSS because of Akamai ARL misconfiguration on ████
Hello team, I hope you're doing well & healthy. I found a reflected XSS because of the misconfiguration of Akamai ARL. ███████ References - https://github.com/war-and-code/akamai-arl-hack - https://twitter.com/SpiderSec/status/1421176297548435459 - https://warandcode.com/post/akamai-arl-hack/ -...
Engel & Völkers Technology GmbH: HTML Injection in Email
Description: Hi team I have found a HTML Injection vulnerability in your system. Steps to Reproduce: 1. Navigate to https://seller-pages.engelvoelkers.com/ 2. Go to the bottom of the webpage and click on message box at right corner. 3. Fill out the form and enter the HTML payload in First Name an...
Shopify: A non-privileged user may create an admin account in Stocky
Summary: A non-privileged Stocky user created within Stocky may be able to create a new admin user. Steps to reproduce: 1.Create a non-privileged user in Stocky, don't give admin privileges to that user. 2.Login with the non-privileged user and go to https://stocky.shopifyapps.com/users/me, updat...
Elastic: RCE hazard in reporting (via Chromium)
Summary: Reporting embeds a Chromium that is susceptible to RCEs Description: Reporting uses a headless Chromium to generate PNGs and PDFs. This is invoked at least on Elastic Cloud, ECE and ECK with --no-sandbox to work at all. There are RCEs readily available for Chrome, and at least the versio...
GitLab: Cache poisoning Denial of Service affecting assets.gitlab-static.net
Summary Hi, Gitlab.com is hosting JS and CSS on https://assets.gitlab-static.net/ and uses them on gitlab.com/ The static files seem to be stored on a gcp host, which by default accepts the x-http-method-override header. Since the CDN is using Varnish to cache files, I was able to combine the GCP...
Shopify: Stored XSS in /admin/product and /admin/collections
Hello Security Team, I was going through previous reports of XSS and I have found this, https://hackerone.com/reports/978125 As stated by team on this page even on https://hackerone.com/shopify?type=team under Known issues that we can now report XSS under Rich Text Editor on Product description a...