RubyGems: Installing a crafted gem package may create or overwrite files

There is no check for name field in metadata.gz. By assigning a maliciously crafted string like ../../../../../any/where to the field, an attacker can create an arbitrary file out of the directory of the gem, or even replace an existing file with a malicious file. Proof of Concept 1: Create a fil...

Ubiquiti Inc.: Privilege Escalation with Session Hijacking Having a Non-privileged Valid User

EdgeOS version 1.9.1.1 and prior, consequence of lack of protection if the file-system, exposing sensitive information, an attacker with access to an operator read-only account, can escalate privileges to admin root access in the system...

HackerOne: Updating payout preference to CurrencyCloud doesn't notify user via email

When change payment method in user's payments, then a notification about Change payment method is sent to the user email. However, user not always gets a notification about change payment method - when change payment method via add payout method on Payout Methods, then such a notification is not...

Weblate: API Does Not Apply Access Controls to Translations

Summary ======= The /api/ does not enforce access control on the translation files, allowing anyone to download full translation files. See the screenshot for an example project being viewed by an anonymous account that is configured to have no permissions. Description ======= On my local setup...

Harvest: [platform.harvestapp.com] Reflected XSS in Error Message via URL parameters

Hi @jorgeleria, I came across a potential reflected XSS vector while exploring platform.harvestapp.com functionality. At present, I have been unable to locate a functional payload, so would like to report this as HTML injection. Proof of Concept Steps to reproduce 1. Visit the below Demonstration...

Paragon Initiative Enterprises: I am because bug

I'm because I hacker found bug because I report this bug I want to report a bug and because want some $$$$ so please because you are telling me how much you pay money so I give you bug. Me because very poor :' want money because father :' F181832 Thank you wish you because pay lots $$$$$$$$...

Dashlane: Throttling Bypass - ws1.dashlane.com

Description The host at ws1.dashlane.com throttles requests based on the IP address of the user after a certain amount of repeated requests. By adding the X-Forwarded-For header, an attacker can bypass the throttling completely, rendering the security measure ineffective against DOS attacks. Proo...

VK.com: Возможность взлома любого пользователя, не использующего двухфакторной аутентификации, через получения кода восстановления на чужой номер.

Уязвимость в библиотеке приложения VK на Android, позволяющая получить на свой номер код для восстановления некоторых страниц. Из-за уязвимости можно было отправить код восстановления любой страницы на чужой номер, спасала только двухфакторная аутентификация...

Algolia: Reflected XSS

XSS triggered by specific search query that needed to be inserted manually into the impacted element. The issue was detected as part of ongoing penetration test and despite this report being later than the initial disclosure, bounty has been awarded. Thanks @Algolia , @adams for Fixing this Bug...

Nextcloud: Group admin can remove user from all his groups via API

Steps 1. As admin make user1 group admin for group1 and group2 2. As user1 create a new user user2 3. As user1 try to remove the user from both groups via the UI 4. Take the first togglegroup.php request and replay it with group2 on curl Expected Should not work Actual The group-admin can escape...

Envoy: Primary Cloning of Envoy web application resulting confidential information disclosure

It is possible to mirror envoy website which exposes internal structure as also client side java-script and CSS . When an attacker makes a copy of your webpages on their local machine, it is possible scan the code for vulnerabilities to exploit without generating additional traffic on your web...

LocalTapiola: Reflected XSS and Open Redirect in several parameters (viestinta.lahitapiola.fi)

Basic report information Summary: Hi, The values within the ctx tag, are not filtered, they are reflected inside a javascript code in http://viestinta.lahitapiola.fi/webApp/APP3242, which can be exploited to perform an XSS Attack. The parameter are: ctxothersDrivingmagallupcount...

Mail.ru: [element.mail.ru] /.svn/entries

В веб директории сайта содержится папка от Subversion. Теоретически это дает раскрытие исходных кодов, но в данном случае файлы с расширением .php.svn-base тоже исполняются веб-сервером. Пример: https://element.mail.ru/.svn/entries 10 dir 14...

Boozt Fashion AB: Email link poisoning / Host header attack

Description ------------- It is possible to poison the link of the password reset email. This is generally done by altering the Host header, but in this case, the WAF is successfully blocking it. The trick here is to add an X-Forwarded-Host header in the request so the server is using this value...

Rockstar Games: DOM based reflected XSS in rockstargames.com/newswire/tags through cross domain ajax request

Hi, I have found a reflected XSS issue in http://www.rockstargames.com/newswire/tags which is , IMO , somekinda tricky. PoC: - URL: http://www.rockstargames.com/newswire/tags/?tags=%2e%2e%2e%2e%2e%2e\commentsdal\users\getGlobalLoginSettings%2ejson?callback=alert%2fxss%2f;%2f%2f - Vulnerable...

Snapchat: Incoming email hijacking on sc-cdn.net

Hey guys! Really interesting find here. Summary These dangling MX records on sc-cdn.net have allowed me to purchase an email account with GoDaddy owner of these servers and send/receive email from an account on this domain. sc-cdn.net. 3599 IN MX 0 smtp.secureserver.net. sc-cdn.net. 3599 IN MX 10...

Khan Academy: Sensitive information/action is stored/done is done using a GET request

Description: The action to remove an email from account is done using a GET request and it has security token. The URL is : https://www.khanacademy.org/settings/unlinkaccount?email=134hackerone%40gmail.com&fkey= It is never a good practice to have sensitive information in URL. Following are the...

Uber: Bruteforce INVITE codes easy way

As soon as i read the vulnerability disclosed on h1 regarding Possibility to brute force invite codes in riders.uber.com "https://hackerone.com/reports/125505" . I have found similar & easy way to bruteforce invite codes but in different manner . Also, 1680 public invites are waiting for...

Dropbox: Possible SQL injection can cause denial of service attack

Hi there, The https://www.dropbox.com// Double slash request returns Internal Server Error 500 Error and doesn't returns 404 so i believe it may be an injection. https://www.dropbox.com//shell.php any text added after the double slash will cause the same thing . It is a valid bug an should be...

QIWI: [rubm.qiwi.com] Yui charts.swf XSS

Yui charts.swf XSS...

InVision: Deleting a Project for which the user is not owner but a normal member

A Project member who is not the owner of the project does not have delete option. But using proxy tool like Burp Suite, a low privilege Project member user can delete the Project, Where only the project owner has the privilege to delete the project. Pre-Requisite: A project where current user is...

Internet Bug Bounty: open redirect in rfc6749

OAuth Providers servers that strictly follow rfc6749 are vulnerable to open redirect. Let me explain, reading 0 If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource...

Automattic: Missing HSTS header in https://app.simplenote.com

Hi, Vulnerable Website: https://app.simplenote.com I tested the website using firefox add-on called: Strict Transport Security Detector https://addons.mozilla.org/en-US/firefox/addon/strict-transport-security-d/ HSTS addresses the following threats: User bookmarks or manually types...

Localize: No Wildcard DNS

The target site has no DNS wildcard, and the contents of http://localize.io differ from the contents of http://www.localize.io...

Yahoo!: Clickjacking at surveylink.yahoo.com

Thank you for your submission to Yahoo’s Bug Bounty program. While we recognize the effort that you put into the research and writing of a report for us to evaluate, but unfortunately this bug has already been reported to us. We appreciate your adherence to responsible disclosure guidelines and...

curl: PRE_PROXY change leaks stale Proxy Digest state across proxy-chain boundary

Summary After a Digest-authenticated HTTP proxy transfer, changing only CURLOPTPREPROXY on the same libcurl easy handle does not clear stale proxy Digest/auth state. If the new SOCKS pre-proxy resolves the same HTTP proxy hostname to a different proxy endpoint, the second proxy receives a...

curl: Bypassing Strict SSH Server Verification via Connection Pool Reuse in libcurl

Summary There is a logic flaw in how libcurl manages its connection pool for SSH protocols SFTP/SCP. When evaluating an existing connection for reuse, sshconfigmatches in lib/url.c fails to compare server identity verification policies. By ignoring CURLOPTSSHKNOWNHOSTS, CURLOPTSSHHOSTPUBLICKEYMD5...

GoCD: Information Disclosure via Logback Configuration Injection in GoCD Agent

Summary The GoCD Agent's logging mechanism Logback allows for property substitution and custom configuration loading. By default, the config directory might not exist in the installation path. However, if an attacker creates this directory and places a specially crafted agent-launcher-logback.xml...

curl: Exposure of Hard-coded Private Keys and Credentials in curl Source Repository (CWE-321)

Multiple private/test RSA keys and example credentials were discovered embedded in the public curl source repository and associated documentation. These sensitive secrets were detected using automated tools gitleaks and manual review. Their presence could allow attackers to impersonate trusted cu...

curl: Arbitrary File Read via file:// Protocol in cURL

cURL’s file:// protocol handler is enabled by default, allowing access to local files on the system. This behavior enables an attacker with the ability to run cURL commands to read arbitrary files on the host by specifying file paths or using directory traversal techniques. Steps to reproduce: 1...

AWS VDP: Amazon Kendra Intelligent Ranking Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints

The AWS Kendra Intelligent Ranking service was found to incorrectly report the user-agent and network information as "AWS Internal" for four API endpoints that are FIPS endpoints. This issue can lead to the obscuring of request information that may be used to track down an adversary...

curl: NULL dereference when encoding DN of x509 certificate

Vulnerability description not provided...

HackerOne: Session Not Expire / 2FA Bypass

Vulnerability description not provided...

HackerOne: Attachment disclosure via summary report

A critical vulnerability was discovered in the HackerOne platform that allowed an attacker to gain unauthorized access to attachments belonging to other users through the report summary editing functionality. By manipulating attachment IDs in the request, an attacker could view sensitive files th...

curl: CVE-2024-2004: Usage of disabled protocol

The usage of the disabled protocol in some circumstances with the --proto option can enable all protocols after being given -all, potentially leading to sending sensitive data over an unencrypted channel. The vulnerability was introduced in version 7.85.0 of curl when the string-based protocol...

Tools for Humanity: IDOR - Leaking of team data (name, email, ID, member ID) via POST /api/v1/graphql `FetchMemberships` operation

The vulnerability allowed individuals no longer associated with the organization to access sensitive team member data due to inadequate validation of user permissions. The information that was potentially accessible included names, email addresses, roles, and IDs of current team members...

HackerOne: Ability to bulk submit reports via query named based batching

A vulnerability was discovered in the GraphQL API of the HackerOne platform. The vulnerability allowed an attacker to bulk submit reports via query-based batching, bypassing the intended limit of 500 reports. This was achieved by leveraging a Python script to generate a large number of reports in...

GitHub Security Lab: [Python] Unsafe Unpacking and TarSlip bug slaying

Vulnerability description not provided...

Automattic: Stored XSS on wordpress.com

A Stored XSS vulnerability was found on WordPress.com via app.crowdsignal.com. An attacker could execute malicious script code in the victim user's browser and redirect them to malicious sites by creating a poll with a specific payload and sharing the link on a WordPress post. The vulnerability w...

Nextcloud: Path traversal allows tricking the Talk Android app into writing files into it's root directory

Vulnerability description not provided...

Ruby: XSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256)

Vulnerability description not provided...

Mattermost: Reset password link sent over unsecured http protocol

A vulnerability was found where the reset password link sent over email after creating a workspace was unsecured http protocol, allowing anyone from intermediate computers through network or sniffer to reset the password if the victim opens the link and forgets to update the password. The...

U.S. Dept Of Defense: Unauthenticated phpinfo()files could lead to ability file read at █████████ [HtUS]

Description: Many PHP installation tutorials instruct the user to create a PHP file that calls the PHP function 'phpinfo' for debugging purposes, and various PHP applications may also include such a file by default. By accessing it, a remote attacker can discover a large amount of information abo...

Nextcloud: Secure view trivial to bypass

The secure view feature in Nextcloud was vulnerable to bypassing, allowing users to download files without watermarks. This was possible by using the richdocuments app and adding "/contents" to the URL. The checkbox indicating that downloading is not allowed was misleading, and a solution could b...

Hyperledger: fix(security):Path Traversal Bug

Unsanitized input from CLI argument flows into io.ioutil.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files. See this fix : https://github.com/hyperledger/fabric/pull/3573 Impact There is a path traversal...

Hyperledger: Remote denial of service in HyperLedger Fabric

How to reproduce 1.Bring up the test network.https://hyperledger-fabric.readthedocs.io/en/latest/testnetwork.htmlbring-up-the-test-network 2.Run the PoC. bash go run poc.go -server=192.168.0.208:7051 go package main import "context" "crypto/tls" "flag" "fmt"...

HackerOne: An attacker can archive and unarchive any structured scope object on HackerOne

Summary: Hello, I have discovered an IDOR vulnerability that allows the scope of any program to be archived. Scopes are used to give information about the valid scopes of a program. For example HackerOne has the following scopes: https://hackerone.com https://api.hackerone.com ... Steps To...

8x8: ████ api key exposed in github.com/███/███

@adnanmalikinfo identified a committed API key of a 3rd party SaaS platform for social marketing. We swiftly escalated to the repository owner, who restricted access...

Recorded Future: Dom Xss vulnerability

Summary: Dom Xss vulnerability Steps To Reproduce: add details for how we can reproduce the issue 1. Go to this link: https://api.recordedfuture.com/index.html 2. Open chrome devtool and go to console tab 3. Type: document.write'...alert1...'; 4. And boom! Alert 1! Impact XSS can have huge...

Judge.me : Error Page Content Spoofing or Text Injection

Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, an attacker can supply conten...