People Interactive: Origin IP found, Cloudflare bypassed

The vulnerability allowed non-Cloudflare IP addresses to access the origin servers, bypassing Cloudflare's protection and potentially exposing the servers to unfiltered attacks and data retrieval...

Nextcloud: Only the file extensions are checked, not the MIME types as configured

The tool is not working as hoped. File access control speaks of MIME types that are blocked or not blocked. In fact, only the file extensions are checked. If a user renames an unauthorized file to an allowed file, he can upload and download it. The MIME type of the current file is insignificant,...

Grammarly: Can register any mobile number in MFA without current code.

@chackmate identified a vulnerability that allows a user to connect arbitrary phone numbers with their account. No users affected...

Semrush: SSRF In Get Video Contents

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: A SSRF In Get...

QIWI: Обход комиссии на переводы

Доброго времени суток. Не так давно мне на кошелек подключили тариф «Активный пользователь кошелька» Этот тариф подразумевает 2% комиссии на переводы. Меня, соответственно, это крайне не устроило и я решил пойти искать обход. После недолгих поисков удалось найти дыру вот здесь...

VK.com: Бесконечный доступ к аккаунту если мы смогли хотя бы раз зайти на аккаунт.

Временная возможность продлить сессию после получения полного доступа к странице...

Starbucks: Subdomain takeover of mydailydev.starbucks.com

A subdomain of starbucks.com had a CNAME record pointing to an Azure Traffic Manager profile that @0xpatrik was able to claim...

50m-ctf: $50 million CTF Writeup

Summary: For a brief overview of the challenge you can take a look at the following image: F451370 Below I will detail each step that I took to solve the CTF, moreover all the bad assumptions that led me to a dead end in some cases. Twitter The CTF begins with this tweet: F451371 What is this...

MariaDB: smtp service vulnerable to POODLE SSLv3

One of our package servers had an old smtpd service linked with openssl 1.0.1i, which uses nondeterministic CBC padding, making it easy for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. The service has been disabled for the internet, as ...

Monero: (remote) exabyte allocation via load_from_binary() (DoS)

Changes introduced in commit b82efa32e can result in a denial of service if epee::serialization::portablestorage::loadfrombinary is called with untrusted data. The 'reserve' method implemented here:...

Algolia: Web Cache Deception Attack (XSS)

@testingforbugs identified an issue related to web caching which could lead to XSS attacks...

X (Formerly Twitter): url that twitter mobile site can not load

Summary: A url that twitter mobile site can not load, crushes any page containing this url Description: Invalid hex characters crushes twitter mobile site as example go to https://mobile.twitter.com/?%xx twitter won't load. 1 Sending such url on a direct message, twitter will no longer be able to...

U.S. Dept Of Defense: [Critical] Full local fylesystem access (LFI/LFD) as admin via Path Traversal in the misconfigured Java servlet on the https://███/

Description Hello. I discovered a Path Traversal issue on the https://██████████/ I was able to turn it to the local file read, and after series of the test determined that it's possible to reach sensitive system files with administrator rights. POC The next request will read the...

Node.js third-party modules: [serve] Access unlisted internal files/folders revealing sensitive information

I would like to report sensitive information disclosure in serve. Bypass of 308721 in ways. Module module name: serve version: 10.1.1 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page application or just a static file no...

Valve: RCE on Steam Client via buffer overflow in Server Info

Introduction In Steam and other valve games CSGO, Half-Life, TF2 there is a functionality to find game servers called the server browser. In order to retrieve the information about these servers the server browser communicates with a specific UDP protocol called server queries. The protocol is we...

Mail.ru: сервант статус

Apache server status was available at jw-cn-test-1.ext.terrhq.ru...

Mail.ru: Open Redirect In passport.maps.me/logout/?next=//fb.com/

Open redirect on passport.maps.me page...

Shopify: H1514 Bypass Wholesale account signup restrictions

Summary: By default, account registration is disabled on Shopify Wholesale, requiring customers to be manually invited: Wholesale account signup is disabled. Customers need to be manually invited from the Customers page. This can be bypassed due to improper access controls in the invitation...

Mail.ru: Bypass security fixes by downgrading version of application

Version downgrade attack was possible in webagent web application webagent.mail.ru. It could allow attacker to force user to visit an older version of web application with known vulnerabilities...

BOHEMIA INTERACTIVE a.s.: Stealing Users OAUTH Tokens via redirect_uri

Hi, I would like to report an Open redirection on oauth redirecturi which can lead to users oauth tokens being leaked to any malicious user. Detail During the OAUTH flow, the redirecturi on https://accounts.bistudio.com is not properly validating that the URL given is proper, as such a bypass of...

Brave Software: Directory Listing on https://promo-services-staging.brave.com

Summary: Hi Brave team, Hope you are good I have found a directory listing vulnerability at https://promo-services-staging.brave.com Products affected: Brave website page. Steps To Reproduce: Go to https://promo-services-staging.brave.com/swaggerui/ Supporting Material/References: Reference: This...

Reverb.com: Api token exposed in Reverb.com's public github repository

An access token of a user account was available in a public github repo. The token was tied to an experimental project, and the account was only used for that project, so no sensitive information was able to be obtained...

Mail.ru: Открытая информация phpinfo() на сайте https://agent.mail.ru

phpinfo was available on agent.mail.ru. agent.mail.ru is not currently covered with bug bounty program...

GitLab: Persistent XSS - Selecting users as allowed merge request approvers

Summary: When using the dropdown that selects the users that are allowed to approve a merge request, it is possible to trigger a XSS with a malicious user name string. Description: This vulnerability is similar to the recently announced CVE-2018-10379 and another vulnerability I recently reported...

Node.js third-party modules: `https-proxy-agent` passes unsanitized options to Buffer(arg), resulting in DoS and uninitialized memory leak

I would like to report a Buffer allocation vulnerability in https-proxy-agent. In setups where auth argument is user-controlled, it allows to: 1. cause Denial of Service by trivially consuming all the available CPU resources 2. extract uninitialized memory chunks from the server on Node.js This...

LocalTapiola: Malicious file upload (secure.lahitapiola.fi)

Basic report information Summary: Malicious file upload Description: Hello! I noticed that when a user sends new message you have restricted pretty strictly the files which is ok to upload. Like .svg: F254353 How ever if a user impersonate another user just a one example and start the conversatio...

Unikrn: [unikrn.com] Profile updated with error":true,"success":false"

Greetings, We noticed that even if the https://unikrn.com/apiv2/user/updateprofile gave an answer that the code is on error , the post is proceeded : PoC : -- curl 'https://unikrn.com/apiv2/user/updateprofile' -XPOST -H 'Referer: https://unikrn.com/profile' -H 'Content-Type: application/json' -H...

Internet Bug Bounty: Exim use-after-free vulnerability while reading mail header involving BDAT commands

Original article is here Use-after-free in receivemsg leads to RCE Vulnerability Analysis To explain this bug, we need to start with the memory management of exim. There is a series of functions starts with store such as storeget, storerelease, storereset. These functions are used to manage...

Open-Xchange: Adding external participants to unaccessible appointments

Description When making an appointment users are able to invite additional participants which do not have an open-xchange account. However, it appears than any user can invite external participants to any appointment even this appointment is not accessible for him. Additionaly using the same bug...

RecargaPay: IDOR exposes receipts of all users.

@cablej found an insecure direct object reference IDOR that could expose receipts from external users. Thanks for helping us make RecargaPay more secure!...

Brave Software: Download of (later executed) .NET installer over insecure channel

NOTE! Thanks for submitting a report! Please fill all sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty. Summary: Execution of file NDP-KB2901954-Web.exe fetched via...

Razer US: Reflected XSS on the https://deals.razerzone.com/json/translation endpoint

Thanks to SP1D3RS for the great report and working with the team on this one. This was a trivial POST-XSS, caused by using text/html Content-Type on the JSON endpoint, and ability to control the part of the response using unsanitized input. Why I disclosed it if this is a trivial issue? I pretty...

Zomato: Potential server misconfiguration leads to disclosure of vendor/ directory

Hi, Apologies for the weakness label, it was the closest I could find for what appears to be a server misconfiguration. Typically, in MVC frameworks like Slim which I see you are using here, Symfony, Laravel, etc., the front controller is the only thing exposed, leaving vendor/, logs/, and others...

Hiro: Weak crossdomain.xml

The e-mail list management service used by Blockstack operated by MailChimp has a lenient cross-domain flash policy -- this is not a vulnerability, however, the crossdomain.xml used by the mailing service is more lenient than used by normal web services...

Rockstar Games: dom based xss in http://www.rockstargames.com/GTAOnline/ (Fix bypass)

The researcher was able to bypass a previous fix for a DOM-Based XSS vulnerability 254343 by hashing part of the payload. This showed that our previous fix was insufficient, so we updated it to a more thorough solution...

Legal Robot: Null Byte Injection in all fields of Profile

Hi Team, Null byte injection is possible in all the fields of Edit Profile functionality. Affected URL: https://app.legalrobot.com/account Description: Possible Injection of control characters, such as Null Byte 0x00, \000, \x00, \z, or the Unicode representation \u0000 into vulnerable fields in...

Coinbase: Device confirmation Flaw

Devices being auto-confirmed in an unexpected way looked like a security bug but was intended functionality...

shopify-scripts: Null pointer dereference with send/method_missing

The following program triggers a null pointer dereference with mruby b200c747: ruby def methodmissingm ensure begin A rescue break rescue end end send '' ASAN report: text ASAN:DEADLYSIGNAL ================================================================= ==12116==ERROR: AddressSanitizer: SEGV on...

Automattic: woocommerce - prevent_caching() bug / bypass

As guest visit the following links and look at the headers. Yup there are not caching headers in the response. https://woocommerce.com/.cart/https://woocommerce.com/.cart/ https://woocommerce.com/+cart/https://woocommerce.com/+cart/ https://woocommerce.com/-cart/https://woocommerce.com/-cart/...

HackerOne: Insecure SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com

Hello, I just found some minor issue with RSA 2048 bits SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com thru Qualys SSL Labs and wanted to report it. Proof of Concept https://www.ssllabs.com/ssltest/analyze.html?d=b5s.hackerone-ext-content.com Result: SHA1withRSA...

Ruby: Arbitrary heap exposure in JSON.generate

Running this snippet can expose arbitrary memory: ruby require 'json' state = JSON.state.new state.space = "\0" 1024 puts JSON.generatea: :b, state "a": psych/handlers/recorder.rb tensi0 reeze Gem::Specification.new do |s| to objects of the same type as the original delegate...

HackerOne: Able to create basic user account via Google login on HackerOne Drupal CMS

Summary: Hi, I've found that hackerone.com has drupal installed and when I navigated to this URL https://www.hackerone.com/user/password Found "Log in" and "password reset option". When I clicked on login it redirected me to google login Then I login using my gmail account and it redirected to...

Internet Bug Bounty: CVE-2017-5341 The OTV parser in tcpdump before 4.9.0 has a buffer overflow in print-otv.c:otv_print()

Reported to the project maintainers in 2016. The function sigprint did receive a correct caplen parameter value but didn't use it correctly which could cause a read outside of buffer. Fixed by https://github.com/the-tcpdump-group/tcpdump/commit/409ffe94529df3d8bb8258bf99586f821756cb29...

VK.com: Missing Server Side Rate Limiting can Lead to VK Account Take over

Insufficient flood control...

Nextcloud: Email Spoofing

Hi there, Similar to this report submitted to Hackerone itself: https://hackerone.com/reports/575 You also are vulnerable to email spoofing. Steps to reproduce: 1- Go to https://emkei.cz A Fake Mailer 2- Set the from to parameter as [email protected] or any other name, and send it. 3- The ema...

Envoy: Primary Cloning of Envoy web application resulting confidential information disclosure

It is possible to mirror envoy website which exposes internal structure as also client side java-script and CSS . When an attacker makes a copy of your webpages on their local machine, it is possible scan the code for vulnerabilities to exploit without generating additional traffic on your web...

U.S. Dept Of Defense: Remote code execution vulnerability on a DoD website

A remote code execution RCE vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. Thank you @korprit for notifying us of this vulnerability!...

shopify-scripts: SIGABRT, SIGSEGV mspace_free() and mrb_default_allocf()

Sample - 1 --------------------- The following code triggers the bug attached as mirbuseafterfree.rb: def methodmissingm"0000000"end m0=w.instanceevalprependm m0.instanceevalprependm0 Crash - Use After Free --------------------- gdb r useafterfree Starting program:...

LocalTapiola: SQL Injection /webApp/oma_conf ctx parameter (viestinta.lahitapiola.fi)

Vulnerable script: /webApp/omaconf Vulnerable parameter: ctxvarsemail Database: PostgreSQL PoC http POST /webApp/omaconf HTTP/1.1 Host: viestinta.lahitapiola.fi Content-Type: application/x-www-form-urlencoded Content-Length: 1131...

Coinbase: Window.opener bug at www.coinbase.com

Window.Opener Bug Description: When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. Browsers Verified In: Mozilla Firefox Steps To Reproduce: 1. Visit https://www.coinbase.com/ 2. ...