15403 matches found
X (Formerly Twitter): Bypass Password Authentication to Update the Password
Summary:This additional security measure from twitter provides protection to the victim's account, considering that a victim's session may have been hijacked by a hacker, however, due to this additional layer of security Implemented by twitter the hacker would not be able to change the victim's...
WakaTime: Private leaderboard owner email disclosure when sending invites
Hi , the unVerify email disclosure when invite to any one on Leaderboards . Step .. 1- create account [email protected] . 2- not verify email . 3- go to Leaderboards . 4- check invite any email [email protected] . your friends. 5- your friends look inbox the waketime invite it say [email protected]...
Mail.ru: Пользователь может изменить способ оплаты указав чужой corporation ID
IDOR vulnerability in city-mobil.ru allowed arbitrary organization to be billed for a taxi ride...
LY Corporation: Developer uploaded files missing authentication on LINE GAME Developers site(gdc.game.line.me)
IDOR vulnerability at gdc.game.line.me allowed unauthenticated users to perform brute-force attacks to disclose unauthorized files related to service testing and QA...
New Relic: Getting API access key Through Introspection query Graphql
The introspection query should only be allowed internally and should not be allowed to the general public. If we can fetch the entire back-end API documentation and calls available on a server then that can be very dangerous is many cases what if we could get our hands on some API calls only mean...
U.S. Dept Of Defense: IDOR to Account Takeover on https://████/index.html
Hello Team! Summary: I found when you wish to update your profile on https://███████/ after your login through https://██████████/signIn/signIn.html website due to an IDOR. This IDOR gives you the opportunity to change the origin email for the registered account by changing the ID parameter on th...
LY Corporation: Password reset by malicious input on air.line.me
Due to the bug in the account verification process in the password reset function of air.line.me, it was possible to change other's passwords if a temporary password reset key was set to a space...
Shipt: bypass the [OKTA] login redirect can lead to disclosing limited-information about the sub-domain at [ shiptsec.com ]
A security researcher identified limited and non-sensitive information disclosure for one of our public-facing tools that is used by internal users. While the risk was very low and nothing was directly exploitable, we went ahead and made the quick change to mitigate this behavior. We made the...
Acronis: DOM based XSS in store.acronis.com/<id>/purl-corporate-standard-IT [cfg parameter]
Summary Hi Acronis team, i found a DOM based XSS in store.acronis.com, this vulnerability arise from a missing escape for the \ character. Steps To Reproduce 1. go to:...
Mail.ru: [http://kiwi.youdrive.today/] Information disclosure via Kiwi TCMS vulnerability
Outdated kiwi.youdrive.today Kiwi TCMS instance was vulnerable to information disclosure via JSON-RPC endpoints. Outdated Kiwi TCMS instance was vulnerable to information disclosure via JSON-RPC endpoints. Exploit example dump users info except superuser: curl -i -s -k -X $'POST' -H $'Content-Typ...
Node.js third-party modules: [i18next] Prototype pollution attack
I would like to report a prototype pollution vulnerability in i18next. It allows to modify the prototype of a base object, which may result in DoS, XSS, RCE, etc. depending on the way the library is used. Module module name: i18next version: 19.7.0 npm page: https://www.npmjs.com/package/i18next...
Brave Software: Redirecting users to malicious torrent-files/websites using WebTorrent
Summary: An attacker can redirect a user to a malicious torrent file/website using a reverse tab-nabbbing flaw in WebTorrent. Description WebTorrent allows user to open files after download of while they are being downloaded directly from the browser F965466 An attacker can use this to redirect...
ExpressionEngine: SQL injection at /admin.php?/cp/members/create
SQL injection vulnerability in the control panel. This is limited to users who have access to the control panel, and the ability to create members...
Nextcloud: Stored XSS in collabora via user name
Affected: collabora and nextcloud Ubuntu 18.04.5 LTS Nextcloud 19.0.1 snap version collabora CODE The name of the user is displayed when him joins to edit the document allowing the attacker trigger xss. Impact Set the name of the attacker account to Create a new document → share the document with...
Shopify: Disclose STUFF member name and make actions.
Hello Shopify Security Team! Bug Summary: ============= Based on the report 968165, this also can retrieve the STUFF member name and can send messages using his name. Reproduction steps: ============= - install shopify chat applications. Start Exploit 1 : ============= + Go to targeted store : +...
Shopify: Disclose customer orders details by shopify chat application.
Hello Shopify Security Team! Bug Summary: ============= This bug leads to disclose any store orders details including sensitive informations, through shopify chat app. the chat app can retrieve the orders details for unauthorized user. Reproduction steps: ============= - install shopify chat...
TikTok: Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration
The researcher discovered a URL parameter reflecting its value without being properly sanitized and was able to achieve reflected XSS. In addition, researcher found an endpoint which was vulnerable to CSRF. The endpoint allowed to set a new password on accounts which had used third-party apps to...
Open-Xchange: Buffer overread off by one in `rpa_read_buffer`, incomplete fix for CVE-2020-12674
In function rpareadbuffer, the condition in if p end return 0; len = p++; is not strict enough It should be if p = end return 0; len = p++; The fix from https://github.com/dovecot/core/commit/69ad3c902ea4bbf9f21ab1857d8923f975dc6145 is not enough The ASAN stack trace is...
Nuri: Open Redirect on https://go.bitwala.com/
Hello I found open redirect bug on https://go.bitwala.com. I know that domain is not in scope.I just want to inform a bug. Steps To Reproduce: 1. go to...
Yelp: IDOR in locid parameter allowing to view others accounts Profile Locations
The application transmits in many occasions the locid parameter via URL, which means that this parameter may be being logged in plan text in the Apache server access.log, if not in others also. The fact that this happens, makes this parameter vulnerable not only to be read from this log file, but...
Open-Xchange: Incomplete fix for CVE-2020-12673 : Specially crafted NTML message leads to buffer over read
The vulnerability CVE-2020-12673 got fixed by https://github.com/dovecot/core/commit/fb246611e62ad8c5a95b0ca180a63f17aa34b0d8 adding this check if length datasize error = "buffer length out of bounds"; return FALSE; But this fix seems incomplete with regards to ntlmssptstri The fix should also ad...
Slack: Slack-Corp Heroku application disclosing limited info about company members
@demonia brought it to our attention that two Slack employee email addresses were discoverable in a test application. There was zero risk to customer data. Nothing special, A Heroku Appliction Without Authentication Has Been Discovered On The Linux Application Data Disclosing Limited Information...
New Relic: "Basic user" which can only access a limited subset of the platform can access certain pages which are restricted to the user by the account owner.
@jhimansh described an issue where forced browsing could be used to visit restricted pages as an unprivileged user. As our web application is shipped as client side JavaScript, there is no way to prevent viewing all pages within that code. However, checks are done server-side to ensure that...
Glassdoor: Reflected XSS at https://www.glassdoor.co.in/Interview/BlackRock-Interview-Questions-E9331.htm via filter.jobTitleExact parameter
Summary: There is a reflected XSS vulnerability in https://www.glassdoor.co.in/Interview/BlackRock-Interview-Questions-E9331.htm?filter.jobTitleExact=Portfolio+Management+Group-Fixed+Income+Analyst&countryRedirect=true Affected Parameter: filter.jobTitleExact Browsers tested: Chrome, Firefox...
Acronis: True Image 2021 - LPE via XPC service communication
Summary This is a follow up of 908152. The bug reported there wasn't fixed properly, and as you don't see it, I consider this as new. In the good faith that you will not close this as duplicate submitting this. Also hoping for a bit more bounty than the 200$... The privilege helper tool only...
Kubernetes: secret leaks in vsphere cloud controller manager log
Report Submission Form Summary: When create k8s cluster over vsphere and enable vsphere as cloud provider. With logging level set to 4 or above, secret information will be printed out in the cloud controller manager's log. Kubernetes Version: 1.18.6 Component Version: legacy cloud provider Steps ...
Node.js third-party modules: [bl] Uninitialized memory exposure via negative .consume()
Module module name: bl version: 4.0.2 npm page: https://www.npmjs.com/package/bl Module Description A Node.js Buffer list collector, reader and streamer thingy. Module Stats 8 660 595 weekly downloads Vulnerability Vulnerability Description If user input even typed ends up in consume argument and...
Node.js: `fs.realpath.native` on darwin may cause buffer overflow
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: The libuv's implementation of...
Open-Xchange: Null dereference in `cmd_denotify_operation_execute`
To reproduce, run test suite on following input : require "vnd.dovecot.testsuite"; require "notify"; require "envelope"; test "D Middle" // notify :options "timo@exat"; denotify :is "noot"; if not testresultexecute testfail "fat"; Output is with ASAN enabled stack trace...
Open-Xchange: Assert failed in `edit_mail_istream_read`
To reproduce, run test suite on following input : require "vnd.dovecot.testsuite"; require "variables"; require "editheader"; testset "message" "$mege"; test "" addheader :last "der" "Her-3"; if not testresultexecute Output is with ASAN enabled stack trace testsuite: Panic: file edit-mail.c: line...
Open-Xchange: Failed assert in `mail_index_transaction_lookup`
To reproduce, run test suite on following input : require"vnd.dovecot.testsuite";require "fileinto";require "mailbox";test"" fileinto:create "Folder"; if testresultexecute testmessage:folder "Folder" 2; Output is with ASAN enabled stack trace testsuite: Panic: file mail-index-transaction-update.c...
Open-Xchange: A specifically designed sieve script can cause a DoS in lib-sieve during sieve script compilation via NULL pointer dereference
Reproduction realcrash.sieve is the attached script 1. Build dovecot and pigeonhole 2. Run sievec realcrash.sieve Requirements include and variables extensions should be required. One of the global commands global/export/import without any arguments should be followed by the same command with val...
Azbuka Vkusa: Reflected XSS on av.ru via `q` parameter at https://av.ru/collections/*
Closed...
Shopify: Password protection can be removed for newly created development store
Details Per https://help.shopify.com/en/partners/dashboard/managing-stores/development-storesthe-development-store-password-page, it states that the password can only be removed once the store has been transferred or switch to a paid plan. You can remove the password page only after you transfer...
Azbuka Vkusa: Leak of Google Sheets API credentials
Closed...
Ruby: Potential HTTP Request Smuggling in ruby webrick
function readbody in file /lib/webrick/httprequest.rb use expression /chunked/io to decide transfer-encoding whether or not. that is not rigorous. When using webrick as a http server, a attacker may use a Transfer-Encoding: AAAchunkedBBB header to fake a legal header. than can make a HTTP Request...
Yelp: Clickjacking lead to remove review
Steps To Reproduce: 1. Open iframe F960017 2. You can remove reviews from this iframe Impact Clickjacking lead to remove reviews...
Mail.ru: Access to git & and configuration files on backtoschool.geekbrains.ru via gitfile
Leaking sensitive application data in configuration files at backtoschool.geekbrains.ru...
Internet Bug Bounty: CVE-2017-13041 The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().
Description: Versions of tcpdump before 4.9.2 are vulnerable to a buffer over-read in print-icmp6.c. This vulnerability was disclosed to the tcpdump maintainers and was recently patched in version 4.9.2 and disclosed as CVE-2017-13041. Patch:...
Internet Bug Bounty: CVE-2017-13040 The MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions.
Description: Versions of tcpdump before 4.9.2 are vulnerable to a buffer over-read in print-mptcp.c. This vulnerability was disclosed to the tcpdump maintainers and was recently patched in version 4.9.2 and disclosed as CVE-2017-13040. Patch:...
Shopify: XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.com
Hello team, I found unrestricted file upload via avatar in https://accounts.shopify.com/accounts/, and XSS Stored in PNG IDAT chunks using exiftool , exiftool command exiftool -Comment=""alertprompt'XSS BY ZEROX4'" xsscommentexifmetadatadoublequote.png Payload example : �PNG �...
TikTok: Bypass SMS verification to delete TikTok account
Improper authorization could potentially allow an attacker to bypass SMS verification and delete a TikTok account. This attack would first require the account to be compromised. A fix has been implemented to resolve this issue. We thank @luizviana for reporting this to our team and confirming the...
Kartpay: Admin/Info lekage
The Administrator System was opened in public which can be misused by anyone so to avoid a Security system has been implemented to allow from limited Ip address only...
Mail.ru: Stored Xss
Stored XSS in comment functionality on profile.my.games and community.my.games...
Azbuka Vkusa: IDOR - Other user's delivery address disclosed
Closed...
Dropcontact: Information Disclosure through DEBUG at Subscription [https://app.dropcontact.io/app/subscription?connector=salesforce](CRITICAL)
We were displaying some sytem information in case of app crashing...
GitHub Security Lab: [javascript] CWE-117: CodeQL query to detect Log Injection
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Java: CWE-522 Insecure basic authentication
This bug was reported directly to GitHub Security Lab...
Dropcontact: Django should not have debug mode enabled
We were displaying sensitive information...
Endless Group: XSS on https://fax.pbx.itsendless.org/ (CVE-2017-18024)
Summary: Hello Endless Hosting, I found an XSS on https://fax.pbx.itsendless.org/ . This domain running an AvantFax software 3.3.6 However, the exploit of CVE-2017-18024 for version 3.3.3 is working on that version. Here is the exploit code of CVE-2017-18024 history.pushState'', '', '/'...