15579 matches found
Reverb.com: Api token exposed in Reverb.com's public github repository
An access token of a user account was available in a public github repo. The token was tied to an experimental project, and the account was only used for that project, so no sensitive information was able to be obtained...
Nextcloud: twofactor_auth bypassable if provider fails to load
Just want to preface this by saying that this is probably not a significant vulnerability, as it requires that the server either have recently been incorrectly upgraded or otherwise misconfigured. However in the administration of my own personal NextCloud instance I have hit this several times...
Open-Xchange: Adding external participants to unaccessible appointments
Description When making an appointment users are able to invite additional participants which do not have an open-xchange account. However, it appears than any user can invite external participants to any appointment even this appointment is not accessible for him. Additionaly using the same bug...
AlienVault : [www.threatcrowd.org] - reflected XSS
Summary: I have found a reflected XSS in https://www.threatcrowd.org/graphHtml.php, in GET parameter email. Browsers Verified In: Firefox 56.0.1 Steps To Reproduce: 1. Browse to https://www.threatcrowd.org/graphHtml.php?email=%27-alertdocument.domain-%27 2. Click on the embed functionnality in th...
Boozt Fashion AB: Users Unable to login using Gmail/Facebook on https://boozt-stage1.booztx.com/login
Hi Team, when i try to login in this subdomainhttps://boozt-stage1.booztx.com/login using gmail or facebook,the login form does not redirect me to gmail/facebook,it is giving the error message since it is blacklisted by the server. Steps to Reproduce: 1 Goto https://boozt-stage1.booztx.com/login ...
Grab: www.drivegrab.com SQL injection
Summary: The website uses a WordPress plugin called Formidable Pro. I found an SQL injection in the plugin code. Description: The plugin allows the site admin to create forms to be filled by users. For this end it implements some AJAX functions, including one to preview or actually just view a...
Razer US: Open redirect on oauth2.razerzone.com caused by server misconfiguration when using triple slash after hostname
Another solid report form this tester, who helped us nail down the issue when it was only intermittently reproducible. We appreciate the hard work. I discovered the Open Redirect on the oauth2.razerzone.com due to improper handling of multiple/encoded slashes and dots in the URL path. POC link:...
WakaTime: Unsafe Inline and Eval CSP Usage
Hi Team, The HTTP header of the wakatime.com website includes an unsafe CSP parameter for "script-src". Impact: However, the "script-src" parameter is set to "unsafe-inline" or "unsafe-eval", which allows injection of user passed values, which in result can be misused for Cross-Site Scripting...
HackerOne: Insecure SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com
Hello, I just found some minor issue with RSA 2048 bits SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com thru Qualys SSL Labs and wanted to report it. Proof of Concept https://www.ssllabs.com/ssltest/analyze.html?d=b5s.hackerone-ext-content.com Result: SHA1withRSA...
Mail.ru: Cross-Site Request Forgery
CSRF in whiskas.ny.mail.ru "like" feature. whiskas.ny.mail.ru is not currently in the bug bounty scope...
Internet Bug Bounty: libtiff 4.0.6 segfault / read outside of buffer (CVE-2016-9297)
segfault and read outside of buffer in libtiff 4.0.6 and possibly earlier. This library is baked into web browsers used by millions and also devices like the PlayStation Portable and the iPhone. http://bugzilla.maptools.org/showbug.cgi?id=2590 Reported to the vendor on 7 November 2016: ASAN:SIGSE...
Starbucks: Reflected XSS by exploiting CSRF vulnerability on teavana.com wishlist comment module. (wishlist-comments)
User can add comments on their wishlist item. The http request which adds comment on wishlist item, looks like: http POST /on/demandware.store/Sites-Teavana-Site/default/Wishlist-Comments/:id HTTP/1.1 Host: www.teavana.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.12; rv:49.0...
Khan Academy: Sensitive information/action is stored/done is done using a GET request
Description: The action to remove an email from account is done using a GET request and it has security token. The URL is : https://www.khanacademy.org/settings/unlinkaccount?email=134hackerone%40gmail.com&fkey= It is never a good practice to have sensitive information in URL. Following are the...
GlassWire: DLL Hijacking Vulnerability in GlassWireSetup.exe
GlasswireSetup.exe is subject to the attack described here: http://textslashplain.com/2015/12/18/dll-hijacking-just-wont-die/ You can get a simple demo with this harmless DLL: https://bayden.com/dl/shfolder.dll See attached image for proof of execution...
Shopify: [livechat.shopify.com] Cookie bomb at customer chats
When we visit the https://livechat.shopify.com/customer/chats/new page the ref and ssid URL parameters are used to set cookie values the way as follows: var getURLParameter = functionname return decodeURIComponentnew RegExp'?|&' + name + '=' + '^&;+?&||;|$'.execlocation.search||,""1.replace/+/g,...
Coinbase: HTML injection in apps user review
just watch this video https://www.dropbox.com/s/360cytluyiw2ym9/HTMLI.mp4?dl=0 this about full fake login exploit https://www.youtube.com/watch?v=5iRylyJTzWc...
Radancy: Version Disclosure (NginX)
Hi, I found a version disclosure Nginx in the your web server's HTTP response. Extracted Version: 1.8.0 This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Nginx. Impact An attacker...
Mail.ru: XSS in ad.mail.ru
The XSS vulnerability is located here: https://ad.mail.ru/adi/3030 and is triggered by setting referer to: "alert0 The problem is that the referer is being loaded like so: html alert0 " I am aware that this is out of scope, but I am still reporting it since I just happened to spot it while lookin...
OkCupid: XSS Vulnerability Found!
Good Day okcupid Security Team! i just want to report that i found a bug on your website. what i've found out is a xss vulnerability with the use of third party app facebook. at first i upload an image in facebook and name it as " then go to okcupid.com then i click upload image and i click the...
HackerOne: Anti-MIME-Sniffing header X-Content-Type-Options header has not been set.
Hi, The following host "profile-photos-user-content.hackerone.com" does not set the x-content-type-options header to nosniff. If a malicious user is able to upload an image with script content Possible within the comments metadata Internet Explorer up till IE8 might render the content as Javascri...
curl: CURLSHOPT_UNSHARE race can cause UAF in shared SSL session cache during HTTPS transfer
Summary CURLSHOPTUNSHARE can free a shared SSL session cache while another thread is starting a normal HTTPS transfer with the same share handle. The failing transfer reaches the cache through curleasyperform, during the OpenSSL handshake. libcurl appears to try to reject this kind of lifetime...
Yelp: Yelp for Business: locked Email field silently editable via API
The Yelp Biz Android app's Account Information screen was found to have a vulnerability where the email field was presented as read-only with a lock icon, but could be silently modified via the API endpoint POST /account/info/bio/v1. The change was reflected immediately in the app's user interfac...
Monero: Wallet RPC Restricted-Mode Policy Bypass
A vulnerability was discovered in the Monero wallet RPC server that allowed restricted-mode clients to perform non-view-only operations. The issue was caused by inconsistent enforcement of the restricted mode, which allowed clients to bypass the intended view-only access controls and perform...
curl: HSTS accepted from HTTP origin behind HTTPS proxy
curl/libcurl appears to accept and persist Strict-Transport-Security from an http:// origin when the request is sent through an https:// proxy. After that, a later http:// request for the same host is automatically upgraded to https:// due to stored HSTS state. Affected versions 8.12.0 through...
Rocket.Chat: SSRF via improper validation after DNS name resolution in the link-preview feature
The link-preview feature in Rocket.Chat version 7.11.0 did not properly validate the IP address after DNS resolution. This allowed an attacker to obtain a domain that pointed to an internal IP address, triggering SSRF and enabling access to internal hosts that would otherwise be unreachable...
U.S. Dept Of Defense: authentication bypass
An authentication bypass vulnerability was discovered in the login page of a web portal, allowing unauthorized access without providing valid credentials...
Mozilla: Stored Xss on bugzilla.mozilla.org via comment edit feature from non-admin to admin.
A stored XSS vulnerability was discovered on the comment edit feature of bugzilla.mozilla.org. This allowed an attacker to execute malicious JavaScript code when an admin attempted to edit a comment. The vulnerability was reported and a bug report was filed...
GitHub Security Lab: cpp: if (a+b>c) a=c-b is incorrect if a+b overflows
Vulnerability description not provided...
HackerOne: Any one can view collaborater email address via path /reports/<id>/participants
The vulnerability allowed anyone to view the email address of collaborators invited to vulnerability reports through the program's API. Access to collaborator email addresses was not properly restricted...
U.S. Dept Of Defense: Reflected XSS in ██████
A reflected XSS vulnerability was found on one of the subdomains of a system. The vulnerability was located in the emailbody parameter of the PreviewLetterhead.aspx page. An attacker could exploit this vulnerability to execute malicious scripts and steal user's cookies, launch phishing attacks, a...
Nextcloud: Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log]
Hi team , i found wp-content/debug.log endpoint public accessible That lead to full path disclosure Steps : Open : https://nextcloud.com/wp-content/debug.log You can See Internal paths disclosed and date is : 02-Nov-2022 02-Nov-2022 08:50:36 UTC PHP Fatal error: Uncaught Error: Call to undefined...
Nextcloud: Mail app - Blind SSRF via Sierve server fonctionnality and sieveHost parameter
A blind SSRF vulnerability was discovered in the Nextcloud Mail application, allowing an attacker to map the server and internal network by sending a crafted request to an unexpected destination. The vulnerability was found in the sieveHost parameter when adding a filter via a sieve filter server...
Cloudflare Public Bug Bounty: Bypass two-factor authentication
Due to lack of validation, a malicious actor could brute force OTP 2fa and guess a correct number after multiple failures. The issue was fixed by the Engineering team by implementing restrictions on 2FA attempts...
Ruby on Rails: Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style)
Intro The Rails HTML sanitzier allows to set certain combinations of tags in it's allow list that are not properly handled. Similar to the report 1530898, which identified the combinationselect and style as vulnerable, my fuzz testing from today suggests that also svg and style as well as math an...
U.S. Dept Of Defense: SQL injection at [https://█████████] [HtUS]
Hello, Summary while doing test on www.███ I’ve found that the endpoint at /olc/███comments/commentpost.php is vulnerable with SQL injection vulnerability Vulnerable parameters - staffstudent POC - using sqlmap run command jsx python3 sqlmap.py --level=5 --risk=3 --tamper=space2comment...
Rocket.Chat: Regex account takeover
Summary: get admin reset token with authenticated user Description: normal user login can access to admin reset token and set a new password for admin user Releases Affected: 3.18.5 3.0.5 Steps To Reproduce from initial installation to vulnerability: Add details for how we can reproduce the issue...
Phabricator: Global default settings page is accessible to non-administrators
If you go to /settings/, it correctly redirects to /settings/user/username/ and does not give you the option to change global default settings. However if you go straight to /settings/builtin/global/, any user can edit the global default settings. According to https://secure.phabricator.com/D1604...
U.S. Dept Of Defense: Rxss on █████████ via logout?service=javascript:alert(1)
Description: I found open redirect and xss Rxss at the ██████████ logout page, https://████/██████████/logout?service=https://google.com It also allows javascript URIs, leading to Xss Impact Attacker can trick users to visit malicious websites or can lead to phishing and many other type of attack...
Nextcloud: Control character filtering misses leading and trailing whitespace in file and folder names
Summary: It is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. In lib/private/Files/Storage/Common.php, t...
Rocket.Chat: Persistent CSS injection with ’marked’ markdown parser in Rocket.Chat
Summary: Rocket.Chat offers two different markdown parsers out of the box: the ’orginal’ one and the ’marked’ one. Both markdown parsers offer a different set of features with different re- strictions. Due to more loose restrictions in the ’marked’ parser, a persistent CSS injection in the web...
Nextcloud: Cards in Deck are readable by any user
Sensitive deck card contents were readable by any user, allowing unauthorized access to the information...
Reddit: Domain Takeover of Reddit.ru via DNS Hijacking
Summary I discovered that Reddit.ru was vulnerable to DNS hijacking via DNS provider, Reg.ru. This would allow a malicious attacker to control the content on this domain, as well as, create email addresses associated with it... I'm going to be totally honest and say that any of us ethical hackers...
Aiven Ltd: Grafana RCE via SMTP server parameter injection
Summary: This report is similar to 1180653, except with different parameter injection entrypoint. SMTP server password configuration setting accepts new line characters. This can be used to set non-exported configuration variables. Using this CRLF-injection, the renderingargs of grafana image...
U.S. General Services Administration: IDOR at training.smartpay.gsa.gov/reports/quizzes-taken-by-user
Hey, I found an IDOR that allow anyone view other user result by changing USERID parameter. /reports/quizzes-taken-by-user.csv/USERID Step to Produce: Go to the Section quizzes-taken-by-user as Shown in the Screenshot attached. Step 2: Click on Download CSV. Step 3 Intercept the Request using the...
Mail.ru: Reflected XSS https://tracker.my.com
Reflected XSS on tracker.my.com via GET parameter iconUrl...
LY Corporation: Webview address bar spoofing in LINE client for iOS
When navigation to an invalid hostname occurs, the address bar is updated even though the navigation is cancelled. Due to this incorrect timing of updating the address bar and applying URL normalization, it can be recognized as a different hostname from the actual hostname. As a result, attacker...
Informatica: Html injection on ██████.informatica.com via search.html?q=1
hello dear I have found HTML injection on ██████.informatica.com parameters injectable search.html?q=1 URL : https://████████.informatica.com/search.html?q=1%22%3E%3Cimg%20src=https://www.no-gods-no-masters.com/imagesdesigns/anonymous-gandhi-d001001207265.png%3E%E2%80%[email protected]%20%22 payload ; 1"”@x...
Basecamp: stored XSS in hey.com message content
Hi I found a stored xss using messagecontent parameter when forwarding an email or saving it as draft , and when the victim click on the email to view it, it gets executed . I used this payload as the message content : From: "f" To: [email protected] Message-ID: Subject:...
Zomato: [api.zomato.com] Abusing LocalParams (city_id) to Inject SOLR query
Disclosing it as per the request from @zzzhacker13. This report is identical to 844428 but this one was on a different endpoint. POC - - :v2/red/homepage.json?lat=&lon=&cityid=!dismax+df=cityid86&androidcountry=US&lang=en&androidlanguage=en Zomato Security Team...