Mail.ru: [performancemarketing.geekbrains.ru] Tilda Subdomain Takeover

Unused subdomain of geekbrains.ru was delegated to tilda.cc and unclaimed...

h1-ctf: [H1-2006 2020] H1-2006 CTF Writeup

Hi! The challenges were really great. I had a lot of fun and I can honestly say I learned a few tricks during this journey. I will be submitting the flag now and will work on a very good writeup until the deadline. My reasoning is that there are two different prizes, one for the first ten and...

Nextcloud: The password of a mail share is not hashed if the password is given when the share is created

Create a new mail share with a password by using the OCS endpoint with something like: curl -u admin:admin -X POST -H "OCS-APIRequest: true" "http://localhost/ocs/v1.php/apps/filessharing/api/v1/shares?path=welcome.txt&shareType=4&[email protected]&password=plainTextPassword" - Check the...

Starbucks: Singapore - Account Takeover via IDOR

ko2sec discovered that an alternate site shared database and cookie credentials with card.starbucks.com.sg. By exploiting an endpoint on the alternate site, ko2sec was able to copy a PHPSESSID cookie value from that site over to card.starbucks.com.sg and then see user information, update the...

Open-Xchange: Pre-auth Denial-of-Service in Dovecot RPA implementation

Hi, Dovecot security team. I am Orange from DEVCORE security team. We just did a little security audit on the authentication mechanism of Dovecot, and found a buffer over-read in RPA implementation. In the mech-rpa.c, the function rpareadbuffer doesn't check that the length could be zero, and pas...

Rocket.Chat: Desktop app RCE (#276031 bypass)

Summary: 276031 fix bypass, two click remote code execution. Description: The security issue is in links preload file https://github.com/RocketChat/Rocket.Chat.Electron/blob/master/src/preload/links.js file. By rewriting RegExp.prototype.test method it is possible to prepare proper answers to get...

Mail.ru: Account takeover through password reset in cups.mail.ru

An IDOR vulnerability in password recovery procedure allowed arbitrary cups.mail.ru account rakeover. Write-up is here. : https://medium.com/kminthein/account-takeover-in-cups-mail-ru-bdab1483f92c...

Node.js third-party modules: [Limited bypass of #793704] Blind SSRF in Ghost CMS

Blind SSRF vulnerability in Ghost allows for internal port scanning, or reading oembed contents from internal network...

Mail.ru: PHP code injection at tz.mail.ru

A chain of bugs involving unsafe usage of PHP unserialize led to possibility of code execution in tz.mail.ru...

Ruby on Rails: ActiveStorage direct upload fails to sign content-length header for S3 service

When a user makes a direct upload using ActiveStorage, the browser makes a request to the DirectUploadsController containing the directupload parameters filename, contenttype, bytesize, and checksum. These are used to generate a presigned url that is then passed back to the browser, allowing the...

Rocket.Chat: API Keys Hardcoded in Github repository

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: API Keys is ha...

Mail.ru: Open Redirect

Hello Team Mail.ru Open Redirect on http://aw.mail.ru/ There is an Open Redirect on http://aw.mail.ru/dynamic/auth/?forumreg= due to the application not checking the value passed by the user to the "forumreg" parameter. User can be redirect to malicious site PoC: Open Redirect...

Ping Identity: Google Maps API key leaked during device pairing

Summary: just on intercepting and going through the request i made from ort-admin.pingone.com . i found that the google map api key was leaking through get request . i was able to validate that the leaked key was a valid one Steps To Reproduce: 1.login to account goto setup tab ping iD device...

Nextcloud: Talk - Leak of password-protected room name via already existent resource addition

CVSS ---- Medium 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Description ----------- Affected: Talk / Spreed 6.0.3 The name of shared but password-protected rooms leaks to low-privileged authenticated users. An attacker does not need to guess room IDs, but can simply iterate over IDs to gath...

QIWI: Обход комиссии на переводы

Доброго времени суток. Не так давно мне на кошелек подключили тариф «Активный пользователь кошелька» Этот тариф подразумевает 2% комиссии на переводы. Меня, соответственно, это крайне не устроило и я решил пойти искать обход. После недолгих поисков удалось найти дыру вот здесь...

Internet Bug Bounty: Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow

PHP upstream bug report: https://bugs.php.net/bug.php?id=78069 Description: In phpiconvmimedecode function in iconv.c, there's an out-of-bounds read due to an integer overflow vulnerability. MIME encoded string is being parsed and decoded in for loop with following condition: for strleft =...

Starbucks: Subdomain takeover of mydailydev.starbucks.com

A subdomain of starbucks.com had a CNAME record pointing to an Azure Traffic Manager profile that @0xpatrik was able to claim...

Mail.ru: Seven DOM-Based XSS Vulnerabilities | Execution in Login Sequence

DOM based XSS in tz.mail.ru tz.mail.ru belongs to extended scope I was able to exploit DOM XSS at the following endpoints. The vulnerability was exploitable on forbidden pages and the root cause lies in jquery. text https://tz.mail.ru/a/ https://tz.mail.ru/a/js/ https://tz.mail.ru/www/...

Notepad++: No SearchEngine sanatizing can lead to command injection

Information: Summary: Notepad++ is vulnerable to a command injection vulnerability. Debug Info: Notepad++ v7.6.3 32-bit Build time : Jan 27 2019 - 17:20:30 Path : C:\Program Files x86\Notepad++\notepad++.exe Admin mode : ON Local Conf mode : OFF OS : Windows 10 64-bit Plugins : none Description:...

Node.js third-party modules: [serve] Access unlisted internal files/folders revealing sensitive information

I would like to report sensitive information disclosure in serve. Bypass of 308721 in ways. Module module name: serve version: 10.1.1 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page application or just a static file no...

Starbucks: unuse domain still in using at wechat by Starbucks East China

Summary: spcc.mobi is still using at wechat offical account by Starbucks East China. but this domain is on sale. Description: I had reported this at reportid=433843，bu your gays had ignored, because they said the domain is unused. In fact, spcc.mobi still having an interface using at wechat offic...

Nextcloud: Retrieval and alteration of exposed media on Android Oreo

Good afternoon. Any media downloaded from the cloud server within the Android app is subject to third party modification and server re-upload without explicit user consent. This happens at least on Android Oreo, as data is automatically stored on shared folder...

RATELIMITED: Server Header disclose The Os and Web server Version

Server header was present and disclosed the version of the web server and OS in HTTP responses. Server header was present and disclosed the version of the web server and OS...

HackerOne: A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately

Summary: Hi team Description: Hacker can request agree-on-going-public publish report Steps To Reproduce 1. Create publish report 2. https://hackerone.com/reports/bulk POST...

Shopify: H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_maps

Description: The /:id/sandbox/googlemaps and /:id/sandbox/googleautocomplete routes on checkout.shopify.com are used to render the Google Map on the "Order Status" page as well as the address prediction on checkout pages. The page performs origin validation on incoming postMessages making sure th...

Mail.ru: Bypass security fixes by downgrading version of application

Version downgrade attack was possible in webagent web application webagent.mail.ru. It could allow attacker to force user to visit an older version of web application with known vulnerabilities...

Chaturbate: Missing CSRF Protection in /stats EndPoint.

EndPoint /affiliates/stats. doesnot verify the CSRF Tokens Steps To Reproduce: 1. Login with the your account 2. Navigate to the URL https://chaturbate.com/affiliates/stats.. 3. Check the stats in default its todays date or this week in select period. 4. Intercept the request and change the...

Brave Software: RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's context

Summary: \395737 has shown that Brave supports chrome://brave/ URLs. The Brave team introduced a patch which blocks navigation to chrome://brave and removed chrome.remote.require to prevent command execution on the machine. Navigation to chrome://brave via shortcut files From my understanding: 1...

Node.js third-party modules: Prototype Pollution Vulnerability in cached-path-relative Package

I would like to report a prototype pollution attack in cached-path-relative. It allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain. Module module name: cached-path-relative version: 1.0.1 npm page:...

Brave Software: Directory Listing on https://promo-services-staging.brave.com

Summary: Hi Brave team, Hope you are good I have found a directory listing vulnerability at https://promo-services-staging.brave.com Products affected: Brave website page. Steps To Reproduce: Go to https://promo-services-staging.brave.com/swaggerui/ Supporting Material/References: Reference: This...

Mail.ru: Stored XSS in api.icq.net

Crossite scripting in api.icq.net domain. icq.net is considered as a sandbox domain, it does not use HTTP authentication or cookies, but XSS could be used to facilitate phishing attack...

Liberapay: A single user can subscribe a community multiple times

There is no proper validation while subscribing for a community. A user can subscribe a single community multiple times. Steps to recreate: Step 1: Open any community Step 2: Click on subscribe button Step 3: Capture the POST request and submit it multiple times Step 4: Check the subscription cou...

Zomato: [www.zomato.com] SQLi on `order_id` parameter

@saltedfish found that a parameter orderid was vulnerable to SQLi. POC for everyone to learn from this disclosed report - There was an endpoint which had orderid as one of the parameters. - Requesting '-if1=2,'0','1'-' in orderid parameter changed the Response Length and upon further investigatio...

Nextcloud: Disclosed Version of PORTS SSH|HTTP|SSL

I found Version of ports are disclosed ,But the intersting that SSH port is open and showing his version == OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 Ubuntu Linux; protocol 2.0 F:302383 Searching I have found that this version has common vulunrablitie https://vuldb.com/?id.89622 So it's not good to disclos...

Mail.ru: Открытая информация phpinfo() на сайте https://agent.mail.ru

phpinfo was available on agent.mail.ru. agent.mail.ru is not currently covered with bug bounty program...

Node.js third-party modules: Insecure implementation of deserialization in cryo

I would like to report code injection in serialization package cryo It allows execute arbitrary code using custom prototype. Module module name: cryo version: 0.0.6 npm page: https://www.npmjs.com/package/cryo Module Description JSON on steroids. Built for node.js and browsers. Cryo is inspired b...

Ubiquiti Inc.: Two Factor Authentication Bypass

The researcher found a method to brute-force the 2FA code request in the www.ubnt.com login page. This method still requires the username/password from the account...

Node.js third-party modules: The react-marked-markdown module allows XSS injection in href values.

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report XSS in...

Mail.ru: lootdog.io XSS

В данной ссылке можно наблюдать опенредирект: 1. https://lootdog.io/register?next=http://mail.ru?https%3A%2F%2Flootdog.io%2F Заполняем эту форму, подтверждаем номер: F290679 Нас перекидывает на http://mail.ru Impact open redirect...

VK.com: Просмотр приватных видео записей у Пользователей

Просмотр некоторых приватных видеозаписей. VK решил заплатить 100$ , но я переубедил.... ███████████████████████████ ███████▀▀▀░░░░░░░▀▀▀███████ ████▀░░░░░░░░░░░░░░░░░▀████ ███│░░░░░░░░░░░░░░░░░░░│███ ██▌│░░░░░░░░░░░░░░░░░░░│▐██ ██░└┐░░░░░░░░░░░░░░░░░┌┘░██ ██░░└┐░░░░░░░░░░░░░░░┌┘░░██...

Ubiquiti Inc.: Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300

In AirOS 6.1.5 and prior, due to lack of validation is possible to bypass the CSRF in certain web pages. If an authenticated user access an attacker controlled web page, it could trigger the CSRF and the resulting request could modify the device configuration and creating stored-XSS, with the XSS...

International Islamic University Chittagong: Improper error handler

during the analysis it was found that when we submit the form and try to upload a txt file then it show a error page with internal path disclosure...

Brave Software: Download of (later executed) .NET installer over insecure channel

NOTE! Thanks for submitting a report! Please fill all sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty. Summary: Execution of file NDP-KB2901954-Web.exe fetched via...

Zomato: SSRF in https://www.zomato.com████ allows reading local files and website source code

@nbsp found a SSRF vulnerability which leads to read local files from the web server source code & system files. We have resolved the issue quickly and rewarded the researcher...

HackerOne: Reading redacted data via hackbot's answers

Summary: Hello, I have found a way to use hackbot's automated duplication answers to reveal redacted data via brute force. This is restricted by the length of the report and number of radacted items. For short report with little content and just 1-2 redacted texts this is rather easy to accomplis...

WakaTime: Clickjacking on authorized page https://wakatime.com/share/embed

Hii, https://wakatime.com/share/embed is vulnerabel to clickjaking. Description: I found the resource on https://wakatime.com/share/embed, which can be vulnerable to the Clickjacking. Impact The resource without X-Frame-Options potentially vulnerable to the Clickjacking. The vulnerability exist...

Automattic: Unauthenticated RCE in Vaultpress

Hitting wordpress instalattion with vaultpress on it with get parameter vaultpress=true attacker is one method away from RCE and that method is validateapisignature. In this method we have the following constraints: 1. Firewall 2. Usage recomended of openssl to validate API call In case of disabl...

Weblate: API Does Not Apply Access Controls to Translations

Summary ======= The /api/ does not enforce access control on the translation files, allowing anyone to download full translation files. See the screenshot for an example project being viewed by an anonymous account that is configured to have no permissions. Description ======= On my local setup...

Paragon Initiative Enterprises: I am because bug

I'm because I hacker found bug because I report this bug I want to report a bug and because want some $$$$ so please because you are telling me how much you pay money so I give you bug. Me because very poor :' want money because father :' F181832 Thank you wish you because pay lots $$$$$$$$...

Dashlane: Throttling Bypass - ws1.dashlane.com

Description The host at ws1.dashlane.com throttles requests based on the IP address of the user after a certain amount of repeated requests. By adding the X-Forwarded-For header, an attacker can bypass the throttling completely, rendering the security measure ineffective against DOS attacks. Proo...