UPchieve: CORS origin validation failure

Hi team, I hope you are doing well on the other side. Summary: I found that https://hackers.upchieve.org/ is using cross-origin resource sharing in an insecure way. The web application fails to properly validate the Origin header and returns the header Access-Control-Allow-Credentials: true. This...

Kubernetes: Ingress-nginx annotation injection allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces

I submitted the following report to [email protected]: I've been exploring CVE-2021-25742 and believe I've discovered a variant although it appears there may be many. Most template variables are not escaped properly in nginx.tmpl, leading to injection of arbitrary nginx directives. For...

GitLab: Drive-by arbitrary file deletion in the GDK via letter_opener_web gem

Summary When running gitlab in development, an extra gem used to view emails that have been sent: https://gitlab.com/gitlab-org/gitlab/-/blob/v14.3.0-ee/config/routes/development.rbL14 ruby mount LetterOpenerWeb::Engine, at: '/rails/letteropener' One of the routes it adds is to delete a letter:...

Mail.ru: Subdomain Takeover

Hi team, Actually team this bug is similar to my previous bug which I submitted-██████ Issue details:- Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker...

Nextcloud: Cards in Deck are readable by any user

Sensitive deck card contents were readable by any user, allowing unauthorized access to the information...

U.S. Dept Of Defense: [CVE-2020-3452] on ███████

The following subdomain is vulnerable to CVE-2020-3452, which is an unauthenticated file read in Cisco ASA & Cisco Firepower. URL: https://████/ Vulnerable URL: https://███/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portalinc.lua&default-language&lang=../ ██████████ Resources:...

Nextcloud: Ratelimits do not apply to OCS DataResponse

Using $response-throttle on a DataResponse doesn't work as it is being transformed by BaseResponse into a OCS response. This response does not propagate any throttled setting. Impact Ratelimits on OCS DataResponse not functional...

CS Money: Blind Based SQL Injection in 3d.sc.money

Greetings, Hope Y'all good and fine! Summary: I found a Boolean Blind based SQL Injection in your website = 3d.cs.money It's a URI path injection. The vulnerability tested on the Original IP behind the CloudflareWAF and I've already reported this in my other report 1105673 The Affected URI :...

U.S. Dept Of Defense: Reflected XSS on https://█████

Summary: Reflected xss can use to steal user information because it is coming from trusted website. an user can easily trust it and attacker can easily steal user information Steps To Reproduce: 1. go to https://████?profileid=%22%3E%3C/script%3E%3Cscript%3Ealert%27xss%27%3C/script%3E 2. you will...

GitHub Security Lab: [Java] CWE-522: Insecure LDAP authentication

This bug was reported directly to GitHub Security Lab...

TikTok: Lack of rate limitation on careers site allows the attacker to brute force the verification code

An attacker could have potentially attempted to brute force the verification code needed to reset a candidate's password by leveraging a lack of rate limiting on the TikTok careers portal. We thank @iambouali for reporting this to our team and confirming the resolution...

Mail.ru: Access User Tickets via IDOR in [widget.support.my.games]

IDOR vulnerability in widget.support.my.games allowed to disclose the user tickets...

Concrete CMS: Fetching the update json scheme from concrete5 over HTTP leads to remote code execution

Hi, I noticed that concrete5 fetches the update JSON scheme from www.concrete5.org over HTTP. The fetched json defines the download URL, so we can simply tamper with this JSON in order to make the update URL point to a server controlled by us. Combining this with the possibility to set an arbitra...

Mail.ru: Path traversal lead to LFR via [CVE-2019-3394]

Path traversal lead to Local File Read via CVE-2019-3403 in confluence.plazius.ru...

pixiv: Open Redirect at https://oauth.secure.pixiv.net

Summary: Hello @pixiv security team, i hope you are well, i noticed you can redirect users to another domain if you send an invalided scope. Vulnerable Url...

Kubernetes: secret leaks in vsphere cloud controller manager log

Report Submission Form Summary: When create k8s cluster over vsphere and enable vsphere as cloud provider. With logging level set to 4 or above, secret information will be printed out in the cloud controller manager's log. Kubernetes Version: 1.18.6 Component Version: legacy cloud provider Steps ...

Ruby: Potential HTTP Request Smuggling in ruby webrick

function readbody in file /lib/webrick/httprequest.rb use expression /chunked/io to decide transfer-encoding whether or not. that is not rigorous. When using webrick as a http server, a attacker may use a Transfer-Encoding: AAAchunkedBBB header to fake a legal header. than can make a HTTP Request...

IBM: CVE-2020-3452 Cisco ASA / Firepower Read-Only Path Traversal Vulnerability - https://esccvc.de.ibm.com

A vulnerability in the interface of Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense FTD was reported to IBM, analyzed and have been remediated. Thank you to Khaled 0xelkomy...

LY Corporation: Spring Actuator endpoints publicly available, leading to account takeover

Due to insufficient access controls, it was possible to access the Spring Boot Actuator endpoints /heapdump and /env. The /heapdump endpoint leaks data from the Java Virtual Machine, leading to disclosure of admin credentials, user tokens and a combination of other data. This endpoint was not...

Ruby on Rails: ActiveStorage direct upload fails to sign content-length header for S3 service

When a user makes a direct upload using ActiveStorage, the browser makes a request to the DirectUploadsController containing the directupload parameters filename, contenttype, bytesize, and checksum. These are used to generate a presigned url that is then passed back to the browser, allowing the...

Internet Bug Bounty: Squid as reverse proxy RCE and data leak

Summary: This was a very difficult experience as Squid maintainers took a long time to answer. I tried getting help from HackerOne support, Dropbox support and the Internet Bug Bounty never e-mailed me back to no avail. What could have taken a few days took months. The vulnerability concerns a...

Internet Bug Bounty: Tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option() (CVE-2018-16229)

Tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccpprintoption. This vulnerability was disclosed to the tpcdump maintainers and was fixed in version 4.9.3 and disclosed as CVE-2018-16229. I was credited with finding and disclosing this vulnerability:...

New Relic: Host Header Injection

Reproduction 1- open reset link https://login.newrelic.com/passwords/forgot 2- Enter the victim's email address and click Reset and Email Password 3- Intercept the HTTP request in Burp Suite & add X-Forwarded Host Header and write attacker.com/.newrelic.com link will be like...

VLC (European Commission - DIGIT): Access Violation Reading in libfaad_plugin

1 Basic info of application 1.1 Info of application Application Name VLC media player for Windows Application Version 4.0.0-dev Otto Chriek Download Address http://nightlies.videolan.org/ Testing OS Windows 8 2 Info of test file 2.1 Test file info Normal file name normal.mkv Normal file type...

Notepad++: Insufficient sanitizing can lead to arbitrary commands execution

Information: Summary: Notepad++ is vulnerable to a command injection attack. Debug Info: Notepad++ v7.6.3 32-bit Build time : Jan 27 2019 - 17:20:30 Path : C:\Program Files x86\Notepad++\notepad++.exe Admin mode : ON Local Conf mode : OFF OS : Windows 10 64-bit Plugins : none Description: Let's...

Starbucks: unuse domain still in using at wechat by Starbucks East China

Summary: spcc.mobi is still using at wechat offical account by Starbucks East China. but this domain is on sale. Description: I had reported this at reportid=433843，bu your gays had ignored, because they said the domain is unused. In fact, spcc.mobi still having an interface using at wechat offic...

Mail.ru: Открытая панель

Non-production dashboad with random testing data was available on tarantool.org subdomain...

WordPress: CSRF to HTML Injection in Comments

Simon discovered a CSRF vulnerability that led to RCE. More details are available on the RIPS blog...

Nextcloud: HTML injection with AutoComplete suggestions

As user1 set your displayname to Name 2. As user2 autocomplete the name in the comments input or Talk chat input 3. Click on the user name you just autocompleted User2 is redirected to https://nextcloud.com Only works with HTML, not with script Impact User1 can trick user2 to render any html...

Mail.ru: [e.mail.ru] XSS в поиске

Reflected XSS in e.mail.ru via GET paramters Multiple reflected XSS in the mailbox via the search param Timeline: Friday, July 6 2018, 23:26 – reported Saturday, July 7 2018, 01:13 – triaged Saturday, July 7 2018, 11:12 – temporary fix Monday, July 23 2018, 14:25 – resolved...

Starbucks: PHPinfo page

GET /test.php HTTP/1.1 Host: 52.90.193.152 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.21 KHTML, like Gecko Chrome/41.0.2228.0 Safari/537.21 Accept: / Impact This file may expose sensitive information that may help an maliciou...

Zomato: [www.zomato.com] SQLi on `order_id` parameter

@saltedfish found that a parameter orderid was vulnerable to SQLi. POC for everyone to learn from this disclosed report - There was an endpoint which had orderid as one of the parameters. - Requesting '-if1=2,'0','1'-' in orderid parameter changed the Response Length and upon further investigatio...

Valve: Aapp name leakage on economy history page

App name leakage on economy history page Partners with authorization to view economy logs for their own titles could be presented with a list of all game titles that have used economy features...

Node.js third-party modules: The react-marked-markdown module allows XSS injection in href values.

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report XSS in...

HackerOne: Extra program metrics disclosed via /PROGRAM_NAME json response

Summary: The response to www.hackerone.com/PROGRAM.json includes slamissedcount slafailedcount and researchercount. Description: Viewing the response from a program's json endpoint includes the values for slamissedcount, slafailedcount and researchercount. With regards to the SLA metrics, these a...

U.S. Dept Of Defense: SSRF on █████████ Allowing internal server data access

Summary: An end point on ██████ allows an internal access to the network thus revealing sensitive data and allowing internal tunneling Description: OAuth Plugin allows you to provide a url that gives a snap shot of the web page. We can pass internal URLS and conduct SSRF. Impact Critical...

VK.com: Просмотр любого видео из частной группы и кто загрузил

Просмотр некоторых видеозаписей из закрытых групп...

VK.com: Просмотр приватных видео записей у Пользователей

Просмотр некоторых приватных видеозаписей. VK решил заплатить 100$ , но я переубедил.... ███████████████████████████ ███████▀▀▀░░░░░░░▀▀▀███████ ████▀░░░░░░░░░░░░░░░░░▀████ ███│░░░░░░░░░░░░░░░░░░░│███ ██▌│░░░░░░░░░░░░░░░░░░░│▐██ ██░└┐░░░░░░░░░░░░░░░░░┌┘░██ ██░░└┐░░░░░░░░░░░░░░░┌┘░░██...

Nextcloud: twofactor_auth bypassable if provider fails to load

Just want to preface this by saying that this is probably not a significant vulnerability, as it requires that the server either have recently been incorrectly upgraded or otherwise misconfigured. However in the administration of my own personal NextCloud instance I have hit this several times...

RubyGems: Delete directory using symlink when decompressing tar

In 2.7.6, the safety of symlink is confirmed with mkdirpsafe, Before that FileUtils.rmrf destination is running. Therefore, if tmp/dir is specified after tmp - /tmp, the following /tmp/dir is deleted. Proof of concept builder.rb ruby require 'rubygems/package' class GemBuiler def initialize spec,...

Mail.ru: CSRF on lootdog.io

CSRF vulnerability for phone/email change action. On the time of reporting, lootdog.io clientside vulnerabilities were not covered with bug bounty...

Informatica: [http://www.informatica.com]- info disclosure

Researcher has identified and reported an sensitive information leakage in one of our domain. He helped us in resolving the issue...

WordPress: Open Redirect on the nl.wordpress.net

Description Hello. I discovered an Open redirect vulnerability on the nl.wordpress.org. Root cause The 301 Redirect contains full hostname, followed with @ without trailing slash, when using: GET /@google.com HTTP/1.1 Host: nl.wordpress.net User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64;...

ownCloud: OS Command Injection via tainted PATH environment variable in findBinaryPath

The PATH environment variable is passed to the find command in owncloud/core/blob/master/lib/private/legacy/helper.php on line 543 is not sanitized for input. If an adversary is able to taint the PATH environment variable, OS command execution is possible utilizing the find command's execute -exe...

Ubiquiti Inc.: Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300

In AirOS 6.1.5 and prior, due to lack of validation is possible to bypass the CSRF in certain web pages. If an authenticated user access an attacker controlled web page, it could trigger the CSRF and the resulting request could modify the device configuration and creating stored-XSS, with the XSS...

AlienVault : SSRF bypass for https://hackerone.com/reports/285380 (query AWS instance)

Description The SSRF fix can be bypassed, using domain, pointed to the AWS IP 169.254.169.254, like metadata.nicob.net. POC https://www.threatcrowd.org/domain.php?domain=metadata.nicob.net F237437 Suggested fix While there is no 100% way to validate the domains using only string-based checks, you...

International Islamic University Chittagong: Improper error handler

during the analysis it was found that when we submit the form and try to upload a txt file then it show a error page with internal path disclosure...

International Islamic University Chittagong: Full Path Disclosed

Hi, i want to say that you have not fixed the previous report properly i can still find the path fix it properly the paths should be hidden text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://119.18.148.140/hrd/login.php? Cookie:...

New Relic: Captcha Bypass on SignUp Form

The g-recaptcha-response parameter was not validated on the server side when submitting a form to the /signups endpoint. Any or no value could be provided for this parameter...

Grab: www.drivegrab.com SQL injection

Summary: The website uses a WordPress plugin called Formidable Pro. I found an SQL injection in the plugin code. Description: The plugin allows the site admin to create forms to be filled by users. For this end it implements some AJAX functions, including one to preview or actually just view a...