UPchieve: Session Hijacking leads to full control of account by attacker

Hi Team , I am Samprit Das MCEH Metaxone Certified Ethical Hacker and a Security Researcher I just checked your website and got a critical vulnerability please read the report carefully. Description:- The Session Hijacking attack consists of the exploitation of the web session control mechanism,...

Slack: Remote Code Execution in Slack desktop apps + bonus

Summary With any in-app redirect - logic/open redirect, HTML or javascript injection it's possible to execute arbitrary code within Slack desktop apps. This report demonstrates a specifically crafted exploit consisting of an HTML injection, security control bypass and a RCE Javascript payload. Th...

Revive Adserver: Reflected XSS on www/delivery/afr.php

At line 4381, $SERVER'QUERYSTRING', which is an untrusted user input, is assigned to the $dest variable. Then at lines 4386-4387 $dest is printed into HTML code in two separate places. PoC: curl "domain.com/www/delivery/afr.php?refresh=10000&"',10000000;alert1;setTimeout'alert"" Advertisement --...

Internet Bug Bounty: Apache Airflow Sql injection by authenticated user

Apache Airflow versions 2.10.5 were affected by a vulnerability that allowed an attacker to manipulate query construction, leading to an SQL Injection vulnerability. The vulnerability was present in the SQLColumnCheckOperator, which could result in remote code execution...

Nord Security: Hard-coded API keys at NordVpn Android App

Hello NordVpn, APK Version : 4.6.2 API'S at res/values/strings.xml Google googleapikey = AIzaSyBySEqk7WWee9bxpw5BM1eJeUx1TWdHE Stripe stripepublishableapikey = pklivej1Mt911wyZwAhATA9TYdA8q2 Referance; https://stripe.com/docs/keys Impact Cleartext Storage of Sensitive Information...

h1-ctf: ctf walkthrough

Hi, finally managed to solve all challenges, this was my first h1ctf, some challenges were pretty nice, some others had some frustrating guessing parts, but overall it was fun. Here goes day1 to day12 walkthroughs: Day 1 we have only one asset in scope hackyholidays.h1ctf.com the main page at...

Kubernetes: Half-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service.

Hello, Who we are : We’re two French security researchers and our respective names are Brice Augras and Christophe Hauquiert, we worked and found the vulnerability together. Brice Augras from https://www.groupe-asten.fr/ company - https://hackerone.com/reeverzax Christophe Hauquiert -...

Chaturbate: No rate limit in affiliate statsapi endpoint

Brute force at affiliate statsapi Steps To Reproduce: 1. The affiliate stats api link is vulnerable to brute force https:// chaturbate.com/affiliates/apistats/?username=hackeronetestchat&token=vulnerable I've used my profile and and my token to check brute force The correct token returned with 20...

Reverb.com: Race Condition allows to redeem multiple times gift cards which leads to free "money"

Hello team! I've found a Race Condition vulnerability which allows to redeem gift cards multiple times. This how a s/he can easily buy stuff just bying one gift card and redeem it over and over again. Steps to reproduce Preparations - Burp Suite Pro - Turbo Intruder Note: This also can be...

X (Formerly Twitter): Potential pre-auth RCE on Twitter VPN

Hi, weOrange Tsai and Meh Chang are the security research team from DEVCORE. Recently, we are doing a research about SSL VPN security, and found several critical vulnerabilities on Pulse Secure SSL VPN! We have reported to vendor and patches have been released on 2019/4/25. Since that, we keep...

U.S. Dept Of Defense: Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://███

Description Hello. Some time ago, researcher Orange Tsai from DEVCORE team had a talk on Defcon/BlackHat regarding Pulse Secure SSL VPN vulnerabilities fixed on 2019/4/25: CVE-2019-11510 - Pre-auth Arbitrary File Reading CVE-2019-11542 - Post-auth Stack Buffer Overflow CVE-2019-11539 - Post-auth...

8x8: Outdated Coturn is vulnerable to known vulnerabilities (High)

Jitsi had several CoTurn servers that needed improvements to their access configurations and updated...

Internet Bug Bounty: Apache HTTP Request Parsing Whitespace Defects

Apache HTTP Server, prior to release 2.4.25, accepted a broad pattern of unusual whitespace patterns from the user-agent, including bare CR, FF, VTAB in parsing the request line and request header lines, as well as HTAB in parsing the request line. Any bare CR present in request lines was treated...

Yelp: Object Level access control leads to reading user's full requests, sessions, and error messages

The summary is as follows: A vulnerability was discovered in the Yelp internal administration tool called "Tailored Mail" hosted on the subdomain https://proze.yelp.com/. The vulnerability allowed unauthenticated attackers to read the internal admin's full HTTP requests, sessions, and other...

U.S. Dept Of Defense: ███ vulnerable to CVE-2022-22954

I found that one of the targets belongs to DOD vulnerable to CVE-2022-22954 where an attacker may be able to execute any malicious code like escalating Remote code execution is also possible Technical Summary: CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspac...

Nextcloud: Allows any user to share their "Root" level folder by sharing "."

There seems to be a bug in the "File to Share" feature of Nextcloud Talk. This allows any authenticated user/admin to share their "root" level folder by manipulating the "path": parameter in the JSON body request to the remote API /nextcloud/ocs/v2.php/apps/filessharing/api/v1/shares Steps to rep...

Respondly: DNS Misconfiguration

Hey !! Daksh Here !! This time i would like to report DNS Misconfiguration in your site . I have noticed your http://localhost.respond.ly/ has address 127.0.0.1 and this may lead to "Same- Site" Scripting. Here is detailed description of this minor security issue by Tavis Ormandy:...

HackerOne: Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)

Hi there, I noticed when we hit the /userssignin endpoint too many times it will give us HTTP/1.1 429 Too Many Requests Date: Mon, 19 Sep 2016 01:52:19 GMT Content-Type: text/plain However, this can be "reset" although I struggle to get it to work EVERYTIME on /users/signin. This however, does wo...

Mozilla: IDOR: Account Deletion via Session Misbinding – Attacker Can Delete Victim Account

A critical vulnerability was identified in the Firefox Accounts API that allowed an authenticated attacker to permanently delete any user's account by sending a POST /v1/account/destroy request using the attacker's session, but including the victim's email and password hash in the JSON payload. T...

U.S. Dept Of Defense: Password Reset link hijacking via Host Header Poisoning leads to account takeover

Description: ████████ uses the Host header when sending out password reset links. This allows an attacker to insert a malicious host header, leading to password reset link / token leakage. References http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html...

MTN Group: CVE-2018-6389 exploitation - using scripts loader

Issue Description Unauthenticated attackers can cause a denial of service resource consumption by using the large list of registered .js files from wp-includes/script-loader.php to construct a series of requests to load every file many times. The vulnerability is registered as CVE-2018-6389 76172...

Node.js: Potential HTTP Request Smuggling in nodejs

Summary: Potential HTTP Request Smuggling exists in nodejs. Attacker can use two same header field make TE-TE HTTP Request Smuggling attack. Description: nodejs allow same header field in a http request. for example, we can send two Transfer-Encoding header field, even if one of them is false...

U.S. Dept Of Defense: Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)

RCE is possible thanks to unsafe Java deserialization in the Jato framework used by OpenAM. Supporting Material/References - https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464 Impact An unauthenticated, 3rd-party attacker or adversary can execute remote code System...

Sifchain: Subdomain Takeover At the Main Domain Of Your Site

Hello, I Know that isn't in the Scope But this The Only Way I can Report With And This Issue Is Very High It Belongs to the Main Domain this is pretty serious security issue in some context, so please act as fast as possible. overview the Main Domain sifchain.finance is pointing to wix.com, which...

ZeroBounce: API tokens and Emails leaked lead to sensitive information Disclosure

Summary: "Salam alikoum " Hi team i hope you are well t is a pleasure to work in your program. I will begin to present the vulnerability that I found it: Information Disclosure via ?email parameter and ?apikey Steps To Reproduce: 1. waybackurls zerobounce.net | grep gmail Response :...

U.S. Dept Of Defense: Local File Read vulnerability on ██████████ [HtUS]

Kindly check screenshot ███████: In case if scope question. Because i picked this site from DOD website list under 'dod sites'. Lets move on to the bug now : Summary: Local File Include vulnerability on ███. Oracle Ebs Bispgrapgh is prone to a directory traversal vulnerability that can be exploit...

h1-ctf: Wholesome Hacky Holidays: A Writeup

Flag 1 Warm-up: flag48104912-28b0-494a-9995-a203d1e261e7 Checking the robots.txt the flag can be found. Also a path is revealed: /s3cr3t-ar3a Flag 2 It's right in front of you: flagb7ebcb75-9100-4f91-8454-cfb9574459f7 With the previously found path /s3cr3t-ar3a, the flag was hidden in plain sight...

HackerOne: Reflected XSS on www.hackerone.com via Wistia embed code

Summary: The HackerOne marketing site uses Wistia to host and embed videos using html snippets similar to the following: html The issue is that the E-v1.js script is vulnerable to prototype pollution when setting up the logging, via both the url and the document referrer: javascript...

Shopify: Theme editor `oseid` parameter is leaked to third-party services through the `Referer` header which leads to somekind of storefront password bypass.

Hello Shopify, Summary While reading @danishalkatiri's report 997350, I remembered a report that @francisbeaudoin shared with me some time agomid-February 2021 about leaking the theme editor oseid parameter and being able to exploit it to a point where he was able to somewhat bypass the storefron...

Yelp: Email flooding using user invitation feature in biz.yelp.com due to lack of rate limiting

Summary: Hello everyone, The feature to invite users to manage your business has no rate limiting or captcha implemented. Therefore, a malicious user can use this to mail bomb any email's inbox with invitation requests. Platforms Affected: biz.yelp.com Steps To Reproduce: This is a pretty straigh...

Slack: Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookies

Hi Slack Security Team! My name is Evan and I'm a first time bug hunter to your platform : Because you guys were running a month long bounty promotion I decided to take a little of my time and gently perform recon on your platform. Specifically the area of interest I focus in is HTTP Request...

U.S. Dept Of Defense: RCE in ██████ subdomain via CVE-2017-1000486

Summary: The application at ████████/ftn-Website/ uses primefaces 5.3 but not 5.3.8, making it vulnerable to unauthenticated RCE CVE-2017-1000486. Step-by-step Reproduction Instructions 1. Get the publicly available POC for this vulnerability here: https://github.com/pimps/CVE-2017-1000486 2...

Lichess: Server-Side Request Forgery (SSRF) via Game Export API

The Lichess game export API was found to be vulnerable to Server-Side Request Forgery SSRF due to insufficient input validation of the "players" parameter. This allowed an attacker to make the Lichess server send arbitrary HTTP requests to external URLs, potentially exposing sensitive information...

Internet Bug Bounty: CVE-2024-43398: DoS vulnerability in REXML

The CVE-2024-43398 vulnerability was a denial-of-service issue in the REXML library due to poor performance when parsing specially crafted XML. This vulnerability was addressed with a patch released by the Ruby team...

Ubiquiti Inc.: Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com

Summary This is not a standard vulnerability, but a chain of two more exotic vulnerabilities leading to a full authentication bypass of your SSO login system at sso.ubnt.com via account.ubnt.com. The root cause of this authentication bypass is two-fold: 1. Subdomain ping.ubnt.com was pointing to...

AWS VDP: Bedrock Guardrails Evasion with Prompt Formatting

Description Greetings, my name is ██████ and I am a Director here at NR Labs. We recently completed disclosure of this vulnerability by working with ████ and the AWS Security team. We are submitting this issue to the AWS VDP to create an official record of the issue with AWS in preparation for a...

Pornhub: [xss] pornhubpremium.com, /redeem?code= URL endpoint

The researcher discovered an XSS at the redeem route via the code parameter...

AWS VDP: Amazon Pinpoint SMS and Voice, version 2 Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints

The Amazon Pinpoint SMS and Voice, version 2 service was found to incorrectly report the user-agent and network information as "AWS Internal" for five specific API endpoints that are FIPS endpoints. This issue was discovered to be similar to a previous bug reported for the Comprehend Medical and...

Valve: Modify in-flight data to payment provider Smart2Pay

I have found vulnerability which allows attacker to generate steam wallet balance. Firstly you will have to change yours steam account email to something like I will explain why in next steps, amount100 is the important part: brixamount100abc@█████ Then go to...

MyEtherWallet: PIN bypass

Summary: MEW apk has improper rate limit. When we try to brute force the PIN, we are rate limited for 5 minutes after 5 or 6 attempt. In my testing I found that it was checking the device's local time so by changing it we can brute force the PIN. Steps To Reproduce: 1.Install MEW app from play...

h1-ctf: hackyholidays CTF Writeup

Summary: As per the referenced blog entry, the Grinch has gone hi-tech this year with the intentions of ruining the holidays. The challenge was about infiltrating the Grinch's network and take it down. As outlined on https://hackerone.com/h1-ctf, the domain hackyholidays.h1ctf.com was in scope. I...

curl: CVE-2025-5399: WebSocket endless loop

The function curlwssend in libcurl contains an infinite loop that can be triggered by a malicious server under specific circumstances. The loop is caused by a condition in the code that is not properly handled, leading to the function failing to terminate. This vulnerability was discovered in the...

Flickr: Flickr Account Takeover using AWS Cognito API

Flickr uses Amazon Cognito to implement its login functionality. Furthermore, Flickr does not allow users to change their registered e-mail address via the user interface. This restriction can be bypassed via direct communication with the Amazon Cognito User Pool API. Consider we have the followi...

Shopify: subdomain Takeover at blog.exchangemarketplace.com

Hi , I believe that exchangemarketplace.com is belong to shopify it was vulnerable to Subdomain Takeover so I takeover it to my shopify store Poc : goto blog.exchangemarketplace.com Suggested fix : clear your subdomain dns Impact Subdomain Takeover...

Internet Bug Bounty: Use After Free Vulnerability in unserialize() with SplObjectStorage

https://bugs.php.net/bug.php?id=70365...

Mail.ru: [geekbrains.ru] CVE-2019-5418 Ruby on Rails File Content Disclosure

Unpatched CVE-2019-3396 in geekbrains.ru...

Starbucks: http://digital.starbucks.com/ Creation of Google G Suite Account on Behalf of starbucks.

On Dec 14, 2016, @muhammadkhizerjaved submitted a report to Starbucks via the HackerOne platform. In the report @muhammadkhizerjaved identified that the DNS entry for digital.starbucks.com had a CNAME record that resolved to ghs.google.com. The researcher attempted to takeover the subdomain as pa...

Node.js: Prototype pollution via console.table properties

Summary: Attacker control of the second properties parameter of console.table may lead to prototype pollution. Description: Due to the formatting logic of the console.table function it is not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing...

Veris: Captcha Bypass enable login bruteforce

HI There is captcha bypass, which can lead to login credentials bruteforce attack. Just remove &g-recaptcha-response from request, and the server accepts your request. Please check the screenshots...

Nintendo: [Xenoblade Chronicles X: Definitive Edition] Improper validation of names allows injecting formatting tags and bypassing profanity filter

The vulnerability in Xenoblade Chronicles X: Definitive Edition allowed improper validation of names, enabling the injection of formatting tags and bypassing the profanity filter...