U.S. Dept Of Defense: Reflected Xss in [██████]

Description: Reflected XSS in █████████ due to unsanitized single quote '. Impact An attacker could execute arbitrary javascript, and perform malicious actions ! Step-by-step Reproduction Instructions 1. Used payload: simo%27onfocus=%27confirmdocument.domain%27name=%27simo%27simo 2. Visit the url...

Node.js: DNS Max Responses for DOS

See Github my issue: https://github.com/nodejs/node/issues/36063 When i try to fetch the A Dns records of following domain: ticbrasil.com.br I dont get any response. I think thats the case because there are over 1300 responses. Version: v12.18.4, v14.15.0 Platform: 64-bit Windows 10 Pro &...

X (Formerly Twitter): Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking links

Summary: A chain of two open redirects on analytics.twitter.com and twitter.com, coupled with the use of an Ideographic Full Stop allows an attacker to defeat Twitter's approach to blocking links. Description: Twitter maintains a deny list of domain names and prevents users from tweeting direct o...

X (Formerly Twitter): Read-only application can publish/delete fleets

Summary: Twitter released Fleet yesterday. This feature is working with few APIs, and these APIs are missing permission checks. Description: In /fleets/v1/create of https://api.twitter.com, there is no check to whether if the application has permission to write to the account. /fleets/v1/delete h...

Kubernetes: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC

Report Submission Form I was asked by Kubernetes Product Security and H1 Employee @turtleshell to open a new report with the same details as report 995699. Summary: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Kubernetes Version: 1.19 Component Version:...

Engel & Völkers Technology GmbH: CSS-Reflected

Summary: Cross Site Scripting reflected Steps To Reproduce: This POC is on how to redirect user to the malicious website to steal credentials or any sensitive information. 1.How the request has been intercepted F1074840 2.What was the ResponseRendered F1074843 or F1074850 3.Which tools are used: ...

Lyst: DOM XSS on http://talks.lystit.com

Description DOM XSS can be achieved via a postMessage due to an insecure postMessage handler being registered. POC 1. Visit https://gamer7112.com/lyst1.html 2. Click the link 3. View alert Vulnerable Code Located at http://talks.lystit.com/data-saloon-presentation/plugin/notes/notes.html javascri...

Rocket.Chat: CSS Injection in Message Avatar

The custom message avatars in the Meteor.method "sendMessage" can contain inline CSS that influences the resulting HTML element rendering. Escaping the input with "none;" allows further CSS to be applied to the elements inline styles, without requiring certain characters such as whitespace...

Rocket.Chat: User Impersonation through sendMessage options

The Meteor call "sendMessage" allowed clients to use custom avatar and alias parameters, which could be used to impersonate other chat room members. This vulnerability has been patched...

U.S. Dept Of Defense: https://██████ vulnerable to CVE-2020-3187 - Unauthenticated arbitrary file deletion in Cisco ASA/FTD

Hi @U.S. Dept Of Defense, I found a host which is running on the web services interface of Cisco ASA/FTD and it is vulnerable to CVE-2020-3187 - Unauthenticated arbitrary file deletion in Cisco ASA/FTD. An attacker could exploit this vulnerability by sending a crafted HTTP request containing...

X (Formerly Twitter): Github Account hijack through broken link in developer.twitter.com

Description A link in https://developer.twitter.com/en/docs/twitter-api/tools-and-libraries was broken and anyone could create that account which leads to account impersonate Steps To Reproduce 1 Visit https://developer.twitter.com/en/docs/twitter-api/tools-and-libraries 2 Scroll down to...

Dropbox: `account_info.read` scope OAuth app access token can change token owner's account name.

Previously, Dropbox API was split between App Folder and Full Dropbox apps. After the recent introduction of Scoped Access apps, which use OAuth scopes, a number of routes meant specifically for internal use were neither restricted to internal apps nor were they annotated with required scopes. A...

Engel & Völkers Technology GmbH: XSS reflected

Summary: Cookie input nbu2 was set to "alert9536" and the input is reflected inside a tag between single quotes. Steps To Reproduce: 1. go to https://www.engelvoelkers.com/en/search/ 1. change parameter nbu2 in Cookie to :- "alert9536" 1. now check the response alerting 9536 in popup window...

GitHub Security Lab: Java: Detect remote source from Android intent extra

This bug was reported directly to GitHub Security Lab...

BugPoC: XSS PoC for the wacky.buggywebsite.com challenge

Summary: https://wacky.buggywebsite.com/frame.html is vulnerable to DOM-based XSS. Steps To Reproduce: 1. Navigate to https://oembed.dev.ipwnedyour.net/wacky.buggywebsite.com.xss.html 1. Verify the document's origin is displayed in an alert box. PoC code details: The PoC page at...

Malwarebytes: No SPF/DMARC records on mb-cosmos.com

The domain mb-cosmos.com lacked SPF and DMARC records, allowing email spoofing. Emails appeared to originate from the domain without authentication. This vulnerability was reported as a security issue...

Mail.ru: Account takeover on [support2.ucs.ru]

Password at support2.ucs.ru was not sufficiently protected against bruteforce...

Stripo Inc: No rate limiting for subscribe email + lead to Cross origin misconfiguration

Summary: I found bypass no rate limiting using Access-Control-Allow-Origin: and look the response as 200 vulnerable No rate limit means their is no mechanism to protect against the requests you made in a short frame of time. If the repetition doesn't give any error after 50, 100, 1000 repetitions...

Shopify: Self xss in product reviews

1、install app Product Reviews F1070556 2、Open a product and write a review 3、Press F12 on the keyboard，Change the type of email to text. 4、Write in email"[email protected]. F1070565 5、Write other required fields，then submit. F1070566 Impact Self xss...

Rockstar Games: RDR2 game service method allows adding any player to a new Posse without consent

In this report, the researcher discovered a game service method in Red Dead Online that could be manipulated into allowing an attacker to create new Posses and add any Social Club account to it, without their knowledge or consent. We have resolved this by updating the service method to prevent th...

VK.com: Нет флуд-контроля на функции "Запрос денег" в VK Pay. Флуд уведомлениями и сообщениями пользователю, находящемуся в друзьях.

Широкий флуд-контроль при запросе денег в VK Pay. Да...

Mail.ru: [com.icq.mobile.client] Любое стороннее приложение может угнать сессию, а также другие файлы приложения

Insufficient validation of sharing activity parameters for ICQ application on Android allowed access to sensitive application's files...

U.S. Dept Of Defense: Reflected XSS on https://███/████via hidden parameter "█████████"

Hi everyone : I found a Reflected XSS on https://█████/█████████via hidden parameter "██████████". Steps To Reproduce: - Use your favorite web browser - Go to : https://█████/████████&██████=XXX%22%3E%3Cscript%3Ealert%27Reflected%20XSS%20here%27%3C/script%3E An XSS is triggered ! The initial page...

U.S. Dept Of Defense: Reflected XSS in https://███████ via hidden parameter "████████"

Hi everyone : I found a Reflected XSS on https://███████ via hidden parameter "████████" on the following authentication page : https://███████/██████████ Steps To Reproduce: - Use your favorite web browser - Go to :...

Imgur: Bypass subscription

Hello team! You can bypass avatar subscriptions. Thus, without connecting a subscription - it's free. A list of all avatars is available at the address below, with a GET request: :method: GET :authority: api.imgur.com :scheme: https :path: /account/v1/accounts/me/avatars?clientid=YOU CLIENT ID...

Acronis: Blind Stored XSS in https://partners.acronis.com/admin which lead to sensitive information/PII leakage

Blind XSS was possible on partners.acronis.com Tier 3 via several contact form fields. We have seen no signs of the exploitation of this vulnerability...

HackerOne: Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml

@nagli found a reflected Cross-Site Scripting XSS, Server-Side Request Forgery SSRF, and XML External Entity XXE vulnerability in a 3rd party vendor that was used by HackerOne. This system did not contain any data related to reports submitted and stored on hackerone.com. HackerOne worked with the...

Acronis: CVE-2020-6287 https://redapi2.acronis.com

Hi team. Summary CVE-2020-6287 https://redapi2.acronis.com https://nvd.nist.gov/vuln/detail/CVE-2020-6287 SAP NetWeaver AS JAVA LM Configuration Wizard, versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute...

BugPoC: Reflected XSS at wacky.buggywebsite.com/frame.html

Summary: I solved that CTF to pop alert1 Steps To Reproduce: https://bugpoc.com/pocbp-HoQPW64U PoC ID: bp-HoQPW64U Password: AptBeAGlE03 Supporting Material/References: https://imgur.com/a/ZD7rOvH attachment / reference Impact General XSS impacts. Also, I mistakely used document.domain instead of...

HackerOne: Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io

@nagli found an open redirect vulnerability in a 3rd party vendor that was used by HackerOne. This system did not contain any data related to reports submitted and stored on hackerone.com. HackerOne worked with the vendor to remediate the vulnerability. The report is partially disclosed to...

HackerOne: Stored XSS on https://events.hackerone.com

@nagli found a stored Cross-Site Scripting vulnerability in a 3rd party vendor that was used by HackerOne. This system did not contain any data related to reports submitted and stored on hackerone.com. HackerOne worked with the vendor to remediate the vulnerability. The report is partially...

BugPoC: Solution for XSS challenge wacky.buggywebsite.com

Summary: Found a HTML injection in https://wacky.buggywebsite.com/frame.html?param=Injected Bypasswing CSP : CSP : script-src 'nonce-txjohfomwjdo' 'strict-dynamic'; frame-src 'self'; object-src 'none'; Then found a vuln code in https://wacky.buggywebsite.com/frame.html js window.fileIntegrity =...

Mail.ru: reflected xss on learn.city-mobil.ru via redirect_url parameter

Reflected XSS in learn.city-mobil.ru via GET parameter redirecturl Назад...

Exodus: Exposed Configuration Files at https://www.exodus.io/keybase.txt

Summary: Username, uid information is present in txt file. Steps To Reproduce: 1. Open This link https://www.exodus.io/keybase.txt 2. Search for username, uid 3. You will get some usernames with uid. Impact This information may help attacker in further attacks...

BugPoC: XSS Challenge

Hello, ID: bp-oJelDA6b Password: PLEAsEdYAk24 Impact The attacker can steal any user session data...

Shopify: Ability to potentially hit internal NGINX locations on *.myshopify.com by making use of the `X-Accel-Redirect` header via a configured App Proxy

By making use of the Shopify App Proxy and the X-Accel feature of NGINX, it is possible to hit any configured internal NGINX location as your current configuration is not ignoring the X-Accel-Redirect header response from an upstream service. The way it works is that NGINX allows internal...

Starbucks: Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sg

ko2sec discovered an .ashx endpoint on mobile.starbucks.com.sg intended for image files permitted unrestricted file type uploads which could lead to a potential RCE. ko2sec's thorough analysis provided additional endpoints on other out of scope domains that shared this vulnerability. @ko2sec —...

Mail.ru: Clickjacking Vulnerability via https://www.donationalerts.com/help/support leads to bypass for widget.support.my.games X-Frame Options

Clickjacking protection bypass on widget.support.my.games via donationalerts.com...

Mail.ru: Disk-o Cloud application (Windows) does not validate server certificate on a TLS connection

A debugging/staging functionality disabling TLS certificate check was accidentally enabled in production code for Disk-O 20.10.0133, fixed in version 20.11.0006. 21.04 version adds integrity check for update process...

BugPoC: [BugPOC and Amazon XSS CTF writeup] A CSP Bypass Story

Summary/Description: There were quite multiple restrictions imposed while executing JavaScript on the website. I have divided them into three segments which are explained below Bypassing the iframe loading restriction The URL https://wacky.buggywebsite.com/frame.html?param=Hello,%20World when...

BugPoC: csp bypass leads to xss on wacky.buggywebsite.com

Summary: report will be uploaded later - need some sleeps █████████ ███ Steps To Reproduce: PoC above Thanks for the challenge. I tried to use bugpoc for everything but ended up using aws to host the js file - seemed fitting as well and served the purpose. F1065889 Impact taking over all the whac...

BugPoC: Solution to the XSS Challenge

Summary: This challenge is very tricky and advanced. I have reached a part where I can execute my JS code, but that payload is blocked as of now by "allow-modals" missing value in the "sandbox" attribute. Following is a better explanation of where I am right now. Steps To Reproduce: 1. Keep the...

BugPoC: XSS :D

Great summary found here https://medium.com/bugbountywriteup/wacky-xss-challenge-with-amazon-by-bugpoc-d10d43d7707c This is the accepted solution of wacky xss ctf by bugpoc that amazon sponsored. Here is the write up for the same...

U.S. Dept Of Defense: Unauthenticated Arbitrary File Deletion "CVE-2020-3187" in █████

Summary: A vulnerability in the interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files. Description:...

GitHub Security Lab: [Java] CWE-927: Sensitive broadcast

This bug was reported directly to GitHub Security Lab...

Basecamp: Information Disclosure of Garbage Collection Cycle 'Again'

A diagnostic subdomain was still available publicly after being reported https://hackerone.com/reports/981796 and remediation. Subsequently a researcher was able to access the subdomain. Disclosure has been limited as the report contains low sensitive information, but sensitive none the less...

U.S. Dept Of Defense: Unauthorized access to admin panel of the Questionmark Perception system at https://██████████

Summary: Due to the lack of access control, an anonymous attacker can compromise the administrator account on the Questionmark Perception system. Description: By using the service description which publicly accessible on the internet, and by bypassing the access control, an anonymous attacker can...

Lark Technologies: Accessing/Editing Folders of Other Users in the Orginisation.

A vulnerability was found where users without Primary admin privileges were able to view/modify the directory structure of other users in their organization. This would occur after those users were invited to view/modify their folders by a Primary admin. We thank @snapsec for reporting this to ou...

Node.js third-party modules: Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDN

I would like to report possible cache poisoning in Fastify It allows an attacker to perform an cache poisoning when Fastify is used in combination with a http cache / CDN. Module module name: Fastify version: 3.x npm page: https://www.npmjs.com/package/fastify Module Description Fast and low...

Stripo Inc: Stored XSS at Template Editor in "Section Name" Field of Block element 'Accordion'.

Summary: Hi Team, There is "Stored XSS" in Template Editor. When creating Accordion, "Section Name" field does not properly sanitize the input provided by the User leading to Stored XSS. See the Proof Of Concept below. Thank You. Steps To Reproduce: A. Open Template Editor and insert element...