U.S. Dept Of Defense: Reflected XSS at https://████████/███/...

Summary: According to DOD Websites, the ███████ is a potential in-scope target, and where I discovered an unauthenticated GET based reflected cross-site scripting vulnerability on the ██████████ subdomain. Steps to Reproduce: Visit the following URL;...

CS Money: Site-wide CSRF on Safari due to CORS misconfiguration (not localhost)

Description Hello there, on new.cs.money or cs.money, there is anti-CSRF mechanism, which is Referer header check. However, I discovered that regex logic for checking Referer header is flawed. I found that adding or at the end of the domain pass the validation. Therefore, if a request comes from...

Automattic: Permanent DoS with one click.

Summary: Hello Team, messages of a user who deletes their account leave DoS effects on another user. Platforms Affected: website/mobile app/service Steps To Reproduce & PoC: Before you start testing, create two accounts. [email protected] [email protected] Confirm e-mails to sen...

New Relic: IDOR - User is able to download charts/dashboards from cross accounts

@k3ne described an issue where a user on an account could access data concerning dashboards for another user on the same account. While this appeared to be a cross-account access issue, both users on the account have access to the same data by design...

Mail.ru: Broken twitter link hijacking at https://games.mail.ru/pc/search/

Link on https://games.mail.ru/pc/search/ page was pointing to invalid twitter account...

Brave Software: Arbitrary file download due to bad handling of Redirects in WebTorrent

Summary: Previously I reported 963155 how an attacker can trick user into downloading malicious files using ".save torrent" feature, In this report I am going to reproduce the same behavior but by abusing a different feature. Description While I was testing webtorrent on brave I noticed that...

LY Corporation: Use of unreleased features in programming education service (https://entry.line.me)

LINE entry is a service that provides programming education for children https://entry.line.me. Sharing creations was a feature that was previously only available to admins, and the feature was still under development before creators users were allowed to use it. The vulnerability was a case in...

Valve: Access to microtransaction sales data for lots of apps from 2014 to present at /valvefinance/sanity/

The Steamworks Product Data web site had an URL route with insufficient access controls, which would allow an authenticated partner to view data for games which they might not otherwise have permissions to view. After mitigation, an audit of accesses to this URL route showed no accesses by partie...

Shopify: User sensitive information disclosure

1、open shopify指南 Applets 2、click 个人中心 3、click 编辑资料 微信图片20200905123248.png 4、https://api-wechat.shopify.cn/api/sp/customer/id 1.png 5、Modify the ID value to traverse the user information Impact User sensitive information disclosur...

U.S. Dept Of Defense: Reflected XSS in https://███████ via search parameter

Summary: Reflected XSS in https://█████████ Description: I noticed I got an error when visiting https://███.mil stating The provided hostname is not valid for this server I pinged the site to see that it resolves to https://██████ ██████ Based on the content of the site I believe this asset is a...

Helium: Race Condition of Transfer data Credits to Organization Leads to Add Extra free Data Credits to the Organization

Description i found an way to add data credits for free by doing race condition of transfering data credits using turbo intruder of burpsuite when created an account with only default 10000 data credits but i managed it to add for free without buying or purchasing POC Steps if Confused refer POC...

Mail.ru: [api.my.games/social/chat/multi/add] Privilege escalation on adding new members to group chat

Privilege escalation in chat management functionality on store.my.games...

Mail.ru: Account Takeover possibility via https://awards.donationalerts.com using login with twitch.tv

Authentication procedure with twitch.tv oAuth allowed account takeover on awards.donationalerts.com...

BugPoC: Reading arbitrary files via running arbitrary python code

Summary: Reading arbitrary files via running arbitrary python code Steps To Reproduce: 1. Go to Python POC and execute arbitrary code to read arbitrary files Recording: F976069 I have stopped testing further. Users can run arbitrary python code. Please do let me know If anything is unclear. Impac...

Mail.ru: [my.games, lootdog.io] XSS via MCS Bucket

Proxy pass for the path in my.games and lootdog.io domains was misconfigured to point to the root of public S3 storage, allowing to place static content in the domain path leading to XSS possibility...

GitHub Security Lab: [CATENACYBER]: [CPP] CWE-476 Null Pointer Dereference : Another query to either missing or redundant NULL check

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Query to find TLS configurations supporting hardcoded insecure versions of the protocol and cipher suites

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query to detect XSLT injections

This bug was reported directly to GitHub Security Lab...

Automattic: Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - Bypass

Hello there, I hope all is well! I found a stored xss on https://app.crowdsignal.com/ Steps: Go to https://app.crowdsignal.com/dashboard Create a survey. Go to https://app.crowdsignal.com/quizzes/survey-id/question Add Multiple Choice Click Add media button. Select Embed Media Paste this:...

Automattic: IDOR leads to Edit Anyone's Blogs / Websites

Hello there, I hope all is well! Steps: 1. Go to https://intensedebate.com/signup and create 2 accounts. 2. Login as victim and go to https://www.intensedebate.com/edit-user-profile 3. Click Add Blog / Website text and fill the form click Save Settings button 4. Go to...

Agoric: Dependency on private SSH keys in public github

Summary: As i am searching for the some information i came through one of the https://github.com/Agoric/agoric-sdk/blob/8a8136533220a862bf87d319e821858c8b7ba3b3/vagrant/Dockerfile as i am looking at the content i came through github link for ssh private key...

Mail.ru: Clickjacking Vulnerability via https://profile.my.games/gamecenter/profile/ can lead to sensitive cross site actions (Bypass X-Frame-Options)

Clickjacking attack could allow to force user to change profile settings on profile.my.games...

Mail.ru: Multiple SQL Injections and constrained LFI in esk-static.3igames.mail.ru

SQL Injections in esk-static.3igames.mail.ru due to unsafe usage of GET parameters...

Mail.ru: the same as #948259 - XSS at jsgames.mail.ru

Reflected XSS in jsgames.mail.ru via GET parameter backurl found it in under 1 minute , thanks for sharing @yukusawa18 ;...

Mail.ru: This Github Repository Seems Leaking "nino.samokat.ru" Source Code

nino.samokat.ru promo site source code was leaked on github.com...

Node.js third-party modules: [curling] Remote Code Execution

I would like to report RCE in curling I can bypass the security check for special characters, read / overwrite file Module module name: curling version: 1.1.0 npm page: https://www.npmjs.com/package/curling Module Description A node wrapper for curl with a very simple api. Module Stats 156 weekly...

Node.js third-party modules: [imagickal] Remote Code Execution

I would like to report RCE in imagickal It allows to execute arbitrary commands on the victim's PC Module module name: imagickal version: 4.2.0 npm page: https://www.npmjs.com/package/imagickal Module Description node wrapper for ImageMagick commands Module Stats 42 weekly downloads Vulnerability...

BlockDev Sp. Z o.o: A specially crafted value for the 'Cache-Digest' header causing crash in chat.makerdao.com

A specially crafted value for the 'Cache-Digest' header causing crash...

pixiv: Open Redirect at https://oauth.secure.pixiv.net

Summary: Hello @pixiv security team, i hope you are well, i noticed you can redirect users to another domain if you send an invalided scope. Vulnerable Url...

Kubernetes: kubeadm logs tokens before deleting them

Report Submission Form Summary: kubeabdm's delete command takes as input either a bootstrap token ID, or a full token. Before determining whether the input is just an id or a full token, kubeadm logs the input using klog. If the deletion fails, the token would remain valid. An attacker who has...

Mail.ru: Возможность создать канал в группе, в которой пользователь не является админом [my.games]

Privilege escalation in chat management functionality on store.my.games...

GitLab: Able to leak private email of any user given his/her username via graphql

Summary Graphql query user is leaking private email of users query userusername:"" email username Steps to reproduce Step-by-step guide to reproduce the issue, including: Have a account with private email settings Use graphql query to access the private email query userusername:"" email username...

Valve: Add apps to packages 0, 61, 62 with /store/ajaxpackagemerge

The ajaxpackagemerge API incorrectly allowed partners to add their own apps to certain Valve administrative packages. This can be further leveraged to generate CD key ranges for these administrative packages. The API access control was corrected...

Node.js third-party modules: [arpping] Remote Code Execution

I would like to report RCE in arpping It allows to execute arbitrary commands on the victim's PC Module module name: arpping version: 2.0.0 npm page: https://www.npmjs.com/package/arpping Module Description Discover and search for internet-connected devices locally using ping and arp Module Stats...

Acronis: No brute force protection on web-api-cloud.acronis.com

There was no brute force protection on https://web-api-cloud.acronis.com/api/idp/v1/token endpoint...

Lark Technologies: Stored xss on helpdesk using user's city

A stored XSS cross-site scripting was found on the internal larksuite helpdesk, which an attacker could have potentially used to obtain access to the internal helpdesk. We thank imrannisar for reporting this vulnerability and confirming its resolution...

Acronis: Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 - Acronis Scheduler2 Service

Vulnerability description not provided...

Shopify: damage to the timeline so that comment fields cannot be displayed or not available to all members in the store

see https://a-alert-b-y000-b-finda.myshopify.com/admin/discounts/416981811222 I tried to make a discount code with a product name and a discount code like: ± ± when I havehtag the product name on the timeline comment and I get a "server error" reply and it causes crashes to the timeline, so...

Sony: SSRF on http://www.███████/crossdomain.php via url parameter

The researcher reported that a Sony endpoint was vulnerable to Local File Inclusion LFI and Server-Side Request Forgery SSRF vulnerabilities. The researcher used the LFI vulnerability to read sensitive files such as /etc/passwd from the web server. The researcher also demonstrated using the SSRF...

Mail.ru: IDOR смена email пользователя через Ситимобил Бизнес

It was possible to change e-mail address of the user via corporate.city-mobil.ru. An award for this report was distributed evenly between 956791 and 971422. Report 956791 demonstrated the vector for corporate.city-mobil.ru, 971422 demonstrated this vulnerability may have higher impact besides the...

U.S. Dept Of Defense: Reflected XSS on ███████

Summary: Reflected Cross site Scripting XSS on████leaving.html?url=%22%3E%3Cscript%3Ealertdocument.domain%3C/script%3E Steps To Reproduce: 1. Navigate to███leaving.html?url= 2. Enter a crafted XSS payload like "alert"xss by nagli" 3. Alert will pop :- █████████ How can the system be exploited wit...

Glassdoor: Reflected XSS at https://www.glassdoor.co.in/Job/pratt-whitney-jobs-SRCH_KE0,13.htm?initiatedFromCountryPicker=true&countryRedirect=true

Summary: There is a reflected XSS vulnerability in https://www.glassdoor.co.in/Job/pratt-whitney-jobs-SRCHKE0,13.htm?initiatedFromCountryPicker=true&countryRedirect=true Vulnerability Type: Reflected XSS Browsers tested: Chrome, Firefox Payload:...

Acronis: Clickjacking on cas.acronis.com login page

Steps To Reproduce: Create a new HTML file Source code: I Frame Clickjacking Vulnerability Save the file as whatever.html Open document in browser Reference: https://hackerone.com/reports/591432 FIX- The vulnerability can be fixed by adding "frame-ancestors 'self';" to the CSP...

Mail.ru: CSRF Delete chat invitation link.

CSRF vulnerability in api.my.games allowed to delete chat invitation link with crossite request...

Acronis: Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/

Summary Hello, There is possible to inject arbitrary HTML constructions on the page /admin/su/. The problem is in the insufficient escaping of special characters like for the Error parameter. If this parameter contains a specially crafted vector, the application will return the page that will...

GitLab: Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances

NOTE: I am still researching whether there is a possibility to deploy the exploit without user interaction. Summary GitLab provides a rich representation for Jupyter Notebooks .ipynb. In turn, Jupyter Notebooks provide the possibility for rich output via HTML. Although most tags and attributes ar...

Glassdoor: Account Takeover

A user's access token from a Facebook/Google app was found to be accepted by the target application, allowing for account takeover. The token was not properly validated, enabling the use of any previously obtained user token to log in to the application...

CS Money: Pixel Flood Attack leads to Application level DoS

Summary: Hello Team, I had gone through your policy and I saw that DoS is out of scope but I am not sure about Application level DoS. The another reason to report this attack because it affects real customers who want to chat with your support team. I had tested this with two accounts 1. From...

Acronis: Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 installer

Vulnerability description not provided...

Kubernetes: exposed Git Repo at http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io/.git/

Dear Security team, If this report is out of scope, please let me know and I will close the report myself I found a git repository on http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io/.git/.git. This endpoint allows an attacker to retrieve much of the source code and git history for this...