Stripo Inc: Stored XSS at Template Editor in "Section Name" Field of Block element 'Accordion'.

Summary: Hi Team, There is "Stored XSS" in Template Editor. When creating Accordion, "Section Name" field does not properly sanitize the input provided by the User leading to Stored XSS. See the Proof Of Concept below. Thank You. Steps To Reproduce: A. Open Template Editor and insert element...

U.S. Dept Of Defense: Apparent ██████████ website is publicly exposed, suggests default account details on page and has expired SSL/TLS cert

Summary: Publicly exposed website ███████ offering default login user/pass with expired SSL Description: https://██████/ is branded as '████' with ██████ branding/logo and links to ██████ homepage, defense.gov & @DeptofDefense Twitter account Impact Publicly exposed service with potentially defau...

VK.com: XSS in vk.link

XSS на vk.link...

U.S. Dept Of Defense: [SQLI ]Time Bassed Injection at ██████████ via /██████/library.php?c=G14 parameter

Step-by-step Reproduction Instructions copy the request to your burp suite : GET /█████████/library.php?c=G14'XORifnow=sysdate,sleep11,0OR' HTTP/1.1 Host: ██████ Accept-Encoding: gzip, deflate Accept: / Accept-Language: en User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36...

Mail.ru: file read on MCS servers via supplying a QCOW2 image with external backing file

Local file read in mcs.mail.ru by providing QCOW2 disk image with backing image pointing to external file Mail.ru Cloud Solutions allows uploading custom images for disks. This functionality supported QCOW2 disk images. A QCOW2 disk image can have a so-called "backing image" - a file to read...

Basecamp: SSL expired subdomain leads to API swap with main and flagged cookies. Unable to log device ids and certain session tokens.

SUMMARY - Replacing the login page of launchpad.37signals.com with subdomain help-basecamphq.37signals.com greats you to a login page in which is unsecure and with header sec-fetch-site: same-origin injected into your headers you can disable cookies such as . STEPS TO REPRODUCE 1. Visit...

Mail.ru: SQL injection delivery-club.ru (ClickHouse)

Some requests to clickhouse in delivery-club.ru were externally available potentially allowing SQL-like requests execution...

curl: Cookie exposure due to unexpected file permission change

Summary: libcurl since 7.72.0 changes file specified in CURLOPTCOOKIEJAR to group and world readable, regardless of prior file permissions of an already existing file assuming typical default umask of 022. This is unexpected as typically file permissions of an already existing file are not change...

Internet Bug Bounty: DOMPurify bypass

A mutation based bypass exists in DOMPurify when sanitizing svg elements using almost the same technique described by Michał Bentkowski @SecurityMB at https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/. A PoC payload with the DOM state before and after parsin...

Brave Software: Brave Browser potentially logs the last time a Tor window was used

Summary: A vulnerability in the Brave Browser allows an attacker to view the last time a Tor session was used in incognito mode. A local, on-disk attacker could read the Brave Browser's "Local State" json file and identify the last time a Tor session was used, affecting the confidentiality of a...

TikTok: RCE on TikTok Ads Portal

The video upload endpoint on the TikTok Ads portal was potentially susceptible to remote code execution RCE due to a ffmpeg misconfiguration. We thank @ bubbounty for reporting this to our team and confirming the resolution. During my research on the TikTok Ads portal I found a RCE thought the...

Mail.ru: [files.ucs.ru] ProFTPd mod_copy Arbitrary Read/Write

CVE-2015-3306 in opened to external network FTP server on files.ucs.ru...

Mail.ru: [api-site.city-mobil.ru] Improper access control leads to information disclosure (bypass of #977597 fix)

Authorization for api-site.city-mobil.ru endpoint was not properly checked, allowing to obtain data about arbitrary corporate.city-mobil.ru orders and users. Find a way to bypass a bad fix for 977597. There are more steps in the new scenario that allows exploiting the issue. An attacker needs to...

Mail.ru: SDC bypass on calendar.mail.ru

SDCS cookie was not properly checked for few calendar.mail.ru endpoints, allowing to bypass SDC secure domain cookies protection for privilege separation between projects...

Mail.ru: Account Takeover on [ls5-dev.ucs.ru]

Login functionality on ls5-dev.ucs.ru was not sufficiently protected against bruteforce...

Stripo Inc: SSRF external interaction

hi team, i found ssrf external interaction on your website which is https://my.stripo.email/cabinet//login?guid=&tn=&locale=en on chatbox description:- the attacker might cause the server to make connection back to it self or to other web services within the organization infrastructure or to...

Ruby on Rails: Regular expression denial of service in ActiveRecord's PostgreSQL Money type

Summary Hello team! The regular expressions used in the Money type to convert strings like -$100,000.00 to 100000 have an execution time with a quadratic growth proportional to the length of the string. Causing the denial of service requires very long strings but if the parameter is in a post bod...

Mail.ru: CVE-2020-3187 на ip адресе 91.231.115.30

CVE-2020-3452 on webvpn.city-srv.ru...

Nextcloud: Stored XSS in markdown file with Nextcloud Talk using Internet Explorer

While editing a markdown file through the text app, users can create link elements that have a javascript URL such as javascript:alert1. Steps to reproduce: While editing a markdown file, select some text and click the "Add Link" button. Using a web proxy, intercept the request and change the hre...

Yelp: password field autocomplete enabled

Summary: Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications that employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local...

Shopify: Staff with no permissions can listen to Shopify Ping conversations by registering to its different WebSocket Events

By registering to a few different Shopify Ping Websocket Events on the wss://argus.shopifycloud.com/graphql?shopid=id endpoint, a staff without any permission can listen to conversions with customers. Steps to reproduce 1. With a staff that doesn't have any permissions, login into the shop admin ...

Mail.ru: Improper Restriction of Excessive Authentication Attempts via https://certification.mail.ru/auth-form/?form=auth_certy (Rate limit Bypass)

Login functionality on certification.mail.ru was not sufficiently protected against bruteforce...

Acronis: [acronis.secure.force.com] - Insecure Salesforce default/custom object permissions leads to information disclosure

Hi there, I know that this domain https://acronis.secure.force.com is not listed in scope but I thought it would be a good idea to share this finding with you because this endpoint is leaking internal information/meetings. Target: The Salesforce instance at https://acronis.secure.force.com...

BugPoC: Strict Transport Security Misconfiguration

Hello I have found security vulnerable The vulnerable URL: https://bugpoc.com/icons/bandage.svg Summary The table below shows the numbers of issues identified in different categories. Issues are classified according to severity as High, Medium, Low or Information. This reflects the likely impact ...

Mail.ru: Exposed Credentials May Leads to Tarantool Infrastructure Leak

Application configuration data related to Tarantool project was leaked on github.com...

TikTok: HTML Injection on Company Name on Email

By changing the company name to any HTML code on the TikTok Creator Marketplace, an attacker could potentially use this to send phishing emails to users containing injected HTML payload. We thank @gnux for reporting this to our team and confirming the resolution!...

Showmax: WordPress admin is accessible without HTTP authentication

The wordpress instance stories.showmax.com is a complementary system of the Showmax platform. We enforce 2FA for all user accounts that have access to the administration and that's why we decided not to require Basic Auth and/or IP whitelisting for it...

Nextcloud: Leaked of Profile Image from URL changing

Chaning the email address of url will show other's profile images. Impact Leakage of Users Profile Pictures if known email...

Semrush: Critically Sensitive Spring Boot Endpoints Exposed

Spring Boot includes a number of additional features to help you monitor and manage your application when you push it to production. Hacker found that actuator endpoints containing potentially sensitive data such as internal tokens and service data were left public. Semrush has a microservices...

Shopify: [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image

Hello Shopify, when testing Shopify Ping share image function, I discovered an Amazon S3 bucket which has public access which allows an attacker to view all the image of other merchant & users. Steps To Reproduce: 1. Install Shopify Ping on your phone then enable Shopify Chat for your store. 2. G...

Basecamp: Bypass of image rewriting / tracking blocker via srcset

CVSS ---- Medium 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N Description ----------- One of the security features of Hey is blocking of tracking pixels to preserve users privacy. As such, img tags and similar are rewritten by the app to point to gopher.hey.com. However, an attacker can bypas...

CS Money: Attacker can generate cancelled transctions in a user's transaction history using only Steam ID

Summary: The API endpoint /create-payment requires only the steam ID of the account to create the payment. When this endpoint is called using the cardpay flow, it returns a transaction ID on the Cardpay system. The attacker can access this transaction, and immediately cancel it or pay it ; , whic...

Lark Technologies: Privilege Escalation to All-staff group

A vulnerability was found where invited admins with only Company Info permissions were able to modify Staff group settings, including edit / access / delete all-staff, within the members and orgs tab. We thank @snapsec for reporting this to our team...

New Relic: Account takeover by using abandoned email id of victim which has already been changed to new by victim himself on one.newrelic.com

@ashmek identified an inconsistency with account mapping between New Relic One and the discussion forum. This resulted in a situation where a user who has changed their email address could have contents of their account displayed to a new user who had access to the original email address...

Mail.ru: "blog.skillfactory.ru" Vulnerable to Directory Traversal

CVE-2020-11738 on blog.skillfactory.ru...

Mail.ru: Improper Restriction of Excessive Authentication Attempts at https://top.mail.ru/edit? for site counter (Rate Limit bypass via IP Rotation)

Password at top.mail.ru counters was not sufficiently protected against bruteforce...

U.S. Dept Of Defense: System Error Reveals Sensitive SQL Call Data

Summary: If you attempt to login at https://███.mil/sso/LoginRequest.do using a very long username, the application will respond showing a stack trace information with sensitive SQL data call information. This reveals too much information about SQL calls to the database. Please see the attached P...

Basecamp: User can upload files even after closing his account

Summary: =========================== Hello @basecamp This is my first report on your program and I hope to end well : . I was testing https://app.hey.com/ and I my account has been closed, so I back to the requests history, and I tried to send these requests even my account closed. and I found th...

MariaDB: Named pipe connection inteception

With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between...

curl: Data race conditions reported by helgrind when performing parallel DNS queries in libcurl

While running binary built from curl git repo file "docs/examples/10-at-a-time.c" under valgrind specifically with the helgrind tool, reports race condition in getaddrinfo calls. Using the latest curl/libcurl from github repo. From the valgrind documentation "Helgrind is a Valgrind tool for...

pixiv: Bypass extension check leads to stored XSS at https://s2.booth.pm

In this report, a hacker identified a stored XSS in the header image upload function at https://manage.booth.pm/design/edit using Content-Type header manipulation. Upon file upload, the server failed to properly validate the provided Content-Type, accepting unintended values such as Content-Type:...

Basecamp: Lack of quarantine macOS attribute(com.apple.quarantine) leads multiple issues including RCE

Hi, basecamp team. HEY macOS client does not properly validate file uploads on its macOS inbox. That is because, by not setting the com.apple.quarantine attribute in the metadata of an executable file when it is uploaded, you allow the file to be executed on macOS without being checked by...

curl: Parallel upload hangs curl if upload file not found

Attempting to upload -T a not found file with parallel -Z flag present, will cause curl to get stuck and never terminate, potentially stalling scripts that make use of this particular flags. curl -T blabla-notexists -Z upload.example.com www.google.com www.cnn.com www.apple.com Same issue occurs ...

Stripo Inc: Memory Dump and Env Disclosure via Spring Boot Actuator

Memory Dump and Env Disclosure via Spring Boot Actuator Spring boot actuator files/endpoints can be accessed via path like stripo.email/██████/actuator/, including a 110 MB heapdump file, which expose source code, private keys and some internal data! The maximum severity of this asset is medium, ...

Acronis: Subdomains takeover of register.acronis.com, promo.acronis.com, info.acronis.com and promosandbox.acronis.com

Summary: The Subdomains https://register.acronis.com, https://promo.acronis.com, https://info.acronis.com and https://promosandbox.acronis.com are vulnerable to takeover due to unclaimed marketo CNAME records. Anyone is able to own these subdomains at the moment. This vulnerability is called...

U.S. Dept Of Defense: [████] SQL Injections on Referer Header exploitable via Time-Based method

Summary: SQL Injections on Referer Header exploitable via Time-Based method Description: https://owasp.org/www-community/attacks/SQLInjection Impact https://owasp.org/www-community/attacks/SQLInjection Step-by-step Reproduction Instructions First, vulnerable points:...

TikTok: Information Disclosure of Advertiser Account on TikTok Ads Portal

In the TikTok Ads portal, if both invited Ad Accounts are part of the same business group, an exposed endpoint could potentially be exploited to view email address, phone number, company, and name of the Ad Account owner. We thank @emanuelharijanto for reporting this to our team and confirming th...

phpBB: Server Side Request Forgery in 'Jabber settings' in Admin Control Panel

Overview The 'Jabber settings' panel inside the Administrator Control Panel can be used to access resources that would otherwise only be accessible by the host machine, including resources/services hosted on the localhost interface. This can be performed by setting the 'jabber server' parameter t...

Shopify: Ability to connect an external login service for unverified emails/accounts at accounts.shopify.com

Hi, Description I have found that it is possible to add external login service even if the email address is not verified. This allows someone to create an account with an email he does not own and create some kind of backdoor accounts that would allow him to get access to shops and more. In the...

Kubernetes: Development Application Credentials + Information Exposed

Issue Description When I browsed through all the JS files on prow.k8s.io I came across a link called /config which contains a configuration disclosure for the development files URL Vulnerabilities https://prow.k8s.io/config Proof On Concept javascript - continuous-integration/travis-ci kubespray:...