Valve: Add any depot to your app and access its contents without decryption key; via /apps/setcommonredists

The summary is: A parameter-validation error on an endpoint used to configure redistributable depots allowed external depots to be added to an existing app without the required decryption key...

Shopify: Customer's full name disclosure via Shopify Chat (by email lookup)

By making use of the Shopify Chat Application, it is possible to retrieve a customer First Name and Last Name by providing its email. Steps to reproduce 1. Having a shop with Shopify Chat installed, open up https://shop.myshopify.com/?chat in Incognito mode 1. Click on I need an update on my orde...

U.S. Dept Of Defense: CSRF to account takeover in https://█████/

Hi DoD team, I found a CSRF to account takeover in https://███████/ NOTE: Try to open the site in firefox because chrome sometimes is not allowing to open the site. Summary: There is no protection against CSRF in changing email which lead to CSRF to account takeover on https://██████/. Step-by-st...

Nextcloud: Potential DDoS when posting long data into workflow validation rules

A missing input validation in Nextcloud Server 20.0.1 allowed users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules...

Shopify: Staff Member can Get POS Access Without User Interaction

Hi, I found that it is possible for a staff member to grant themselves POS access without user interaction from admin. Steps to reproduce - Login as a staff member with Manage Locations permission only, in a shop that has POS channel up and running Could be Lite - Make sure your staff member...

Basecamp: a very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of service

Summary : ========= after trying to change my initial name to something long i found out that their are no limits to how long it can be , so i directly changed it to something very long F1050497 which caused my account to really slow down when accessing it and in the android app , it just keeps...

Shopify: Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation

It came to my attention that the Shopify Chat application allows a customer to retrieve its order status by only providing the order email and number. Noticing that it results in being provided the order status page link, I started playing a bit with both parameters and I found out that it is...

U.S. Dept Of Defense: Blind Stored XSS on https://█████████ after filling a request at https://█████

Description: When you submit a request at https://██████████, the content is being sent to the administrators of the application, and you will be presented with your request status at https://████ The Description field at the request status page is prone to stored xss and blind stored XSS...

Basecamp: Remote Code Execution in Basecamp Windows Electron App

The Windows application for Basecamp, allows a "Download" feature for images in your posts. Under certain restrictions, those files are downloaded and sometimes even automatically opened executed. The file will be executed if it's a download from an internal URL and the mimetype is text/calendar...

Mail.ru: This Github Repository Seems Leaking Samokat Django Project

Source code and application configuration data related to Samokat promo site was leaked on github.com...

Open-Xchange: Guard WKS lookup: Evil WKS server forces connections to last forever

Any logged-in user can cause denial of service against the AppSuite server by asking Guard to fetch keys from a badly-behaving WKS server. This WKS server's response never ends, tying up a java process and TLS connection forever. Any logged-in user can cause denial of service against the AppSuite...

Glassdoor: Reflected XSS at https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true via PATH

Summary: The endpoint https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true is vulnerable to reflected XSS. Injecting any input in path will be reflected back without any sanitisation. Affected URL or select Asset from In-Scope:...

Mail.ru: This Github Repository Seems Leaking Incoming Samokat Project

Source code and application configuration data related to Samokat was leaked on github.com...

U.S. Dept Of Defense: SQL Injection in www.██████████

Description: SQL Injection is a vulnerability which allows interference with the queries performed on a database, to obtain sensitive information which could be really useful to attackers. A web application database is often queried using user-requests parameters, which when are not properly...

X (Formerly Twitter): The Deleted Polls is Still Accessable after 30 Days

A vulnerability was found in Twitter that allowed users to access a deleted Poll beyond the 30-day limit set by Twitter. The Poll was not visible or accessible via the user interface, but it could still be accessed for an extended period of time. This could compromise the privacy of the user's...

Shopify: Bypass For #997350 your-store.myshopify.com preview link is leak on third party website Via Online Store

Hi Security Team, Description Full Description in 997350 The owner of that website can perform a security compromise by grabbing those links. Solution: The solution is very very SIMPLE. Just include the following HTML code in the following in code between tags of the html of the page: This will n...

U.S. Dept Of Defense: CSRF to Stored HTML injection at https://www.█████

Description: I have found out that on the https://www.███████ domain, you initiate POST request in order to look up for case studies, the parameter keyword on the request, allows the usage of bad characters such as Click here to win 1000$!" 3. Save the POST request and craft CSRF payload. HTML...

Rocket.Chat: Stored XSS in any message (leads to priv esc for all users and file leak + rce via electron app)

Persistent XSS flaw using nested markdown tags allows remote attacker to inject arbitrary JavaScript to message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app. Patched on 3.11, 3.10.5, 3.9.7, 3.8.8...

Mail.ru: Получение локального пути до файла [geekbrains.ru]

Verbose error output was enabled on lms-beta.geekbrains.ru...

U.S. Dept Of Defense: Reflected XSS www.█████ search form

Description: Reflected XSS vulnerabilities arise when the application accepts a malicious input script from a user and then this is executed in the victim's browser.Since the XSS is reflected, the attacker has to trick the victim into executing the payload, usually using another website. In this...

GitHub Security Lab: Java: CWE-749 Unsafe resource loading in Android WebView leaking to injection attacks

This bug was reported directly to GitHub Security Lab...

Informatica: Improper Sanitization leads to XSS Fire on admin panel

Summary Because the HTML is not sanitized when taking the input on https://accounts.informatica.com/registration.html, the input is vulnerable to XSS. When a payload such as " is put into the form under company it triggers a blind xss. When the payload successfully is loaded, it dumps information...

Yelp: X-Forward-For Header allows to bypass access restrictions

Summary: If the "X-Forward-For: 127.0.0.1" header is used, it allows to bypass restrictions of the web application and access endpoints that are restricted otherwise. This allows for example to access the "Business Owner App backend API". The responding server thinks, he is accessed by an interna...

VK.com: XSS Reflected in m.vk.com

XSS on the wall in m.vk.com...

Status.im: HTTP Parameter Pollution with semicolons in iframe allows loading external Greenhouse forms

Summary: Status.im uses Greenhouse for job applications, specifically the older Greenhouse integration which relies on iframes. The ghjid URL parameter is used to load the correct form in the iframe. HTML characters are escaped, but using semicolons you can inject URL parameters into the iframe v...

Acronis: XSS Stored in Cacheable response

XSS was possible on https://www.acronis.com due to improper error handling...

OPPO: Information Disclosure at https://portal.finzfin.com/1.txt

Leaking internal network information Summary: While performing recon work on websites owned by oppo i came up with finzfin website which is leaking sensitive information. Description: The above website is leaking information , This is a high severity issue and requires immediate fixation. I look...

Mail.ru: XSS in message e.mail.ru

XSS in e.mail.ru on message replying / forwarding...

Acronis: Web cache poisoning at www.acronis.com

Summary I found the problem of cache poisoning in www.acronis.com. A poisoned web cache can potentially be a devastating means of distributing numerous different attacks, exploiting vulnerabilities such as XSS, JavaScript injection, open redirection, and so on. Steps To Reproduce 1. Use...

Shopify: Low Privileged Staff Member Can Export Billing Charges

Details I'm not 100% sure about this because i don't have billing transactions on my account. However, from my experience on how Shopify backend respond, i think this is a valid finding just need confirmation from Shopify's security team. A GraphQL mutation billingChargesExport can be used by a...

Automattic: [tumblr.com] CSRF in /svc/user/filtered_content

Summary: Hello, I have found a Cross-site request forgery in https://tumblr.com/svc/user/filteredcontent allow an attacker to add filtered content to a target/victim account. The custom HTTP Header X-tumblr-form-key used for the protection CSRF is not validate. Steps To Reproduce: 1 Logging into...

Uber: Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII

The hacker identified a registration page on a website ran by a 3rd party for Uber for managing Uber Eats devices, for example devices' returns when they stop working. Due to the authentication not being integrated with Uber's central authentication, the website was interesting. Although the...

Acronis: DLL Hijacking when creating Rescue Media Builder leading to Privilege Escalation

Vulnerability description not provided...

TikTok: [CSRF] TikTok Careers Portal Account Takeover

A missing CSRF protection and open redirect vulnerability was reported in the TikTok Careers portal single sign on flow which is used by applicants to apply for TikTok positions. This flaw was quickly remediated and does not impact TikTok.com or mobile application. We thank @lauritz for reporting...

CS Money: Blind XSS on image upload

Summary: - The CSRF vulnerability make a request for support.cs.money/uploadfile; This uploadfile does not have csrf token/ origin/ reference verification! - The XSS allows to execute JS. The payload of the XSS stay in the param 'filename' of the CSRF request. Steps To Reproduce: XSS - use a prox...

Internet Bug Bounty: [CVE-2020-27194] Linux kernel: eBPF verifier bug in `or` binary operation tracking function leads to LPE

CVE-2020-27194 is a eBPF verifier bug that allows an unprivileged attacker to create BPF socket filter programs that can read and write Out of Bounds, trough which an arbitrary kernel read write can be achieved. I'm taking the root cause explanation from the patch email: Simon reported an issue...

U.S. Dept Of Defense: Reflected XSS on https://████/ (Bypass of #1002977)

Hello DoD team, Third time a charm :- I really cannot explain what is going on with this ██████████ website, You just locked the report so i can't comment there, but it seems it works right now and i have proof of a video with time stamp. I am talking about 1002977, i hope you will see this fast...

Basecamp: Possible DOM XSS on app.hey.com

Summary: Hello Team, While testing it was observed that on https://app.hey.com/, on Search box there is a possibility of XSS. Although the payload is reflected in the DOM but the CSP blocks the execution of the script, the XSS can happen if the CSP is somehow bypassed. The Subject parameter is...

Stripo Inc: Able to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/]

Summary: Hi Team, I had found a way to use Premium Templates with FREE PLAN only. As generally Premium Templates can be only used by PAID USERS. So this will lead to heavy loss in Business. It is also possible to use components in DEMO EDITOR which are only available after registration, by just...

Engel & Völkers Technology GmbH: Debug information at the /sapi endpoint

Summary: Sending a GET request to www.engelvoelkers.com/sapi and the server responds with a 500 Internal Server Error which yields a stack trace. Steps To Reproduce: - Enter www.engelvoelkers.com/sapi into your web browser and you can see the stacktrace. https://bugpoc.com/pocbp-VPZDeo2Z I will...

GitHub Security Lab: Java: CWE-918 - Server Side Request Forgery (SSRF)

This bug was reported directly to GitHub Security Lab...

Ubiquiti Inc.: Camera adoption DoS - UniFi Protect

A vulnerability was found in UniFi Protect v1.13.7 and earlier that would allow an attacker to use spoofed cameras to perform a denial-of-service attack that could cause the UniFi Protect controller to crash. This vulnerability is fixed in UniFi Protect v1.17.1 and later versions. Affected...

Acronis: DLL Hijacking when sending feedback and crash report leading to Privilege Escalation

Vulnerability description not provided...

Acronis: Large Amounts of Back-End Acronis Source Code is Publicly Accessible

Vulnerability description not provided...

Automattic: Able to comment/view in others support ticket at https://en.instagram-brand.com/requests/dashboard

Summary: I reported the vulnerability to Facebook, and they have said to report it here for the bounty. Platforms Affected: https://en.instagram-brand.com/requests/dashboard Steps To Reproduce: 1. Create two account User A, User B at https://en.instagram-brand.com/ 2. Apply for Instagram brand fr...

U.S. Dept Of Defense: Local File Inclusion In Registration Page

Summary: When registering on https://████████ it is possible to use path traversal characters in a parameter allowing an attacker to read local files. Description: The registerUserInfoCommand.nextPageName parameter within the registration form is vulnerable to file path manipulation, where it is...

U.S. Dept Of Defense: PII Leak of USCG Designated Examiner List at https://www.███

Hello Dod Team, Summary: PII Leakage of approx 750 personal is being disclosed through the pdf at https://www.██████ which had been uploaded at the 7th of October, this includes Personal phone number and email address. Description: The list presented at the "dereport.pdf" contains personal info...

HackerOne: 2020-10-09 Credential Stuffing Attack

Executive summary On October 4, 2020 and October 5, 2020, an attacker launched two credential stuffing attacks against HackerOne.com. On October 9, 2020, HackerOne’s Security team noticed the attack during their weekly audit of anomalies in their log aggregation platform, leading to the Incident...

Uber: RCE via npm misconfig -- installing internal libraries from the public registry

The hacker spotted some orphaned references to Uber-branded Node.js library packages and claimed them on the public NPM registry to run their own proof-of-concept code. Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies...

DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Security Configurability - Notification message not sent when account is deleted

Email notifications are not sent when account is deleted. Email notifications are not sent when account is deleted. Best Practices As recommended practices, For security reasons, users should be able to be notified via email notification of changes to important operations such as account deletion...