15691 matches found
BugPoC: Finally , CTF is Solved
Summary: Hey Ryan , Thanks for your hints , I was finally able to get /etc/passwd file , Here's my bugpoc id and password. ID - ████ Pass- ██████████ File:-...
Open-Xchange: SSRF - Unchecked Snippet IDs for distributed files
ManagedFile ManagedFiles are basically just temporary files with some ID used for various purposes. When a managed file is created, it is registered in the local file map, which is just an internal map from StringUUID to ManagedFile, and optionally also in the distributed file map, which is a...
TikTok: CSRF To Add New App In Developer Account And Bypassing Json Format
The researcher found a CSRF issue allowing a malicious user to add arbitrary applications to a developer's account...
TikTok: Bypass "Industry Documents" Validation
The researcher found that the attacker can bypass the review process and mark the document as "approved" when a user adds Industry Documents. The attacker will bypass only the qualification status at frontend, the form status is still under review, and it will be reviewed by an employee...
U.S. Dept Of Defense: XML Injection on https://www.█████████ (███ parameter)
Greetings, I found an XML injection on https://www.███. This kind of vulnerability can be difficult to detect and exploit remotely; you should review the application's response here is the complete link: https://www.███/███████ Payload : ███████= Result : ███ best regards, frenchvlad Impact gaini...
U.S. Dept Of Defense: External Service Interaction (HTTP/DNS) on https://www.███ (██████████ parameter)
Greetings, i've find a External service interaction HTTP/DNS on https://www.███████ External service interaction arises when it is possible to induce an application to interact with an arbitrary external service, such as a web or mail server. The ability to trigger arbitrary external service...
Shopify: your-store.myshopify.com preview link is leak on third party website lead to preview all action from store owner Without store Password.
Hi Security Team, Description It has been identified that the application is leaking Link to third party sites. In this case it was found that the Linkis being leaked to third party sites which is a issue knowing the fact that it can allow any malicious users to use the Link to catch/preview all...
CS Money: Content Spoofing/Text Injection in https://support.cs.money and JS file not minified and uglyfied which makes it clearly readable
Issue 1: Greetings, Hello Team, I have found a Content Spoofing/Text Injection on this domain https://support.cs.money Using the below link the attacker can trick any genuine user to go to the attacker's phishing site. The attacker could craft the URL by providing discounts which will tempt the...
TikTok: Lack of session expiration after password reset on TikTok Careers Portal
A lack of session expiration following a password reset on the TikTok Careers Portal does not automatically log out a user on another device/browser. We thank @gnux for reporting this to our team and confirming the resolution...
Nextcloud: No rate limiting for confirmation email lead to huge Mass mailings
Issue Description No rate limit means their is no mechanism to protect against the requests you made in a short frame of time. If the repetition doesn't give any error after 50, 100, 1000 repetitions then their will be no rate limit set. vulnerable has registred in 297359 774050 922470 URL Effect...
Mail.ru: Disclosure of the account email by phone number on [corporate.city-mobil.ru]
It was possible to obtain e-mail of the user registered in corporate.city-mobil.ru by phone number...
Mail.ru: Subdomain takeover http://promo.instamart.ru/
Unused promo.instamart.ru subdomain was delegated to wix.com and not claimed...
BugPoC: LFI to steal /etc/passwd - Bypass filter in the <meta property="og:image"> tag via redirect and much more
Hey Team, Good &simple challenge. Wasn't able to find time to attempt this initially but was able to go about it today. The explanation of the bug with the POC is hosted on bugpoc.com Here is the id & password as requested - BugPoC ID : bp-wHwB2qAF - Password : dARKlYbAnana89 POC Screenshot using...
Acronis: Local Privilege Escalation using System Clean-up functionality
Vulnerability description not provided...
RBKmoney: Apple Pay cryptogram replay and amount tampering
During Apple Pay in-app or on-site payments the device generates a payment cryptogram, which contains a transaction ID, encrypted payment data, etc. This is an example of the cryptogram which the phone passes to the internet acquiring service on api.transferwise.com: "token": "paymentData":...
U.S. Dept Of Defense: POST based RXSS on https://█████ via frm_email parameter
Good Afternoon DoD team, Summary: I have discovered that on the following domain https://███████ there is Post-Based reflected XSS vulnerability which i can trigger with CSRF and Clickjacking due to unsanitized input inside the frmemail parameter Description The vulnerable path is: https://███ CS...
Stripo Inc: Stored XSS at "Conditions " through "My Custom Rule" Field at [https://my.stripo.email/cabinet/#/template-editor/] in Template Editor.
Summary: Hi Team, There is "Stored XSS" in "Conditions" . When creating "My Custom Rule", you have to provide a name, whereas "My Custom Rule " field does not properly sanitize the input provided by the User leading to Stored XSS. Other fields are properly sanitizing the input. See the video Pock...
Mail.ru: Cross-site Scripting (XSS) - DOM on https://account.mail.ru/user/garage?back_url=https://mail.ru
Reflected XSS in account.mail.ru via backurl parameter...
U.S. Dept Of Defense: SSRF in login page using fetch API exposes victims IP address to attacker controled server
Note: This is similar to my last report 991163. Summary: Server Side Request Forgery Exposes Victims Ip Address to External Server and which made attacker possible to determine physical location of Victim with IP Tracing. Description: Server Side Request Forgery is the critical vulnerability...
Mail.ru: Reflected XSS & Open Redirect at mcs main domain
Reflected XSS in mcs.mail.ru via GET parameter backurl...
Moneybird: Stored XSS on add project
The researcher found a way to store a snippet that was served to him and or other users of his administration. Subsequently the snippet was executed by his browser, making it a viable XSS vulnerability...
Figma: Race condition while removing the love react in community files.
The researcher found that the server-side code for handling the "unlike" function for community pages was vulnerable to a race condition. While logically one person is only allowed to remove the one like they had, a hundred requests at the same time could allow one person to do a hundred unlikes...
U.S. Dept Of Defense: Insufficient Session Expiration on Adobe Connect | https://█████████
Description: Due to lack of password protection and Insufficient Session Expiration I am able to brute force Adobe Connect meeting rooms. Many of the meeting rooms have chat history and files uploaded. Some of the chat history and files contains personal identifiable information. Walkthrough...
Reddit: Image queue default key of 'None' and GraphQL unhandled type exception
Summary: I started testing for unrestricted file uploads and quickly discovered a way to upload a corrupted file into Reddit. I was able to bypass the MIME type of uploaded files first by uploading a normal PNG file to Reddit, intercepting the request with burp, and changing the content type from...
HackerOne: Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com)
The page located at https://sal.██████.com/list/Activity/hour/all/0/ suffers from a Cross-site Scripting XSS vulnerability when a user has set their hostname on their machine to an XSS payload. Vulnerable Page https://sal.██████.com/list/Activity/hour/all/0/ Victim IP Address ███████ Referer...
CS Money: Manipulate Uneditable Messages in Support
Summary: Hello, The support section has a validation on all the posted messages where it doesn't allow you to edit your messages after some minutes from posting them. I was able to bypass this protection and edit successfully the previous messages that can't be edited. After further investigation...
Glassdoor: Reflected XSS at https://www.glassdoor.com/Interview/Accenturme-Interview-Questions-E9931.htm via filter.jobTitleFTS parameter
The endpoint https://www.glassdoor.com/Interview/Accenturme-Interview-Questions-E9931.htm is vulnerable to reflected XSS. Affected Parameter: filter.jobTitleFTS Browsers tested: Chrome, Firefox Payload:...
Kubernetes: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC
Report Submission Form Summary: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Kubernetes Version: 1.19 Component Version: snapshot-controller from external-snapshotter repo ver 3.0.0 https://github.com/kubernetes-csi/external-snapshotter/releases/tag/v3.0.0...
U.S. Dept Of Defense: param allows any external resource to be downloadable | https://████████
Description: The following param allows an attacker to trick people into downloading malicious files, scripts and other payloads. https://██████████?url=https:// PoC 1. I will show you how the page looks normally without any changes. If you directly access https://███ you will be shown the...
Open-Xchange: XSS - Notes - Attribute injection through overlapping tags
The Notes app uses simple markup language to format the content, which is later converted to HTML for display. javascript // frontend/ui/apps/io.ox/notes/parser.js parsePlainText: function text var lines = .escapetext.split/\n/, openList; ... var html = lines.join'' .replace/!\.?/g, ''...
U.S. Dept Of Defense: (CORS) Cross-origin resource sharing misconfiguration on https://█████████
Step-by-step Reproduction : Send this request: GET /██████████ HTTP/1.1 Host: █████ Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close █████████ Origin: http://attacker.com Receive : HTTP/1.1 200 OK Cache-Control:...
U.S. Dept Of Defense: [SQLI ]Time Bassed Injection at ██████████ via referer header
Hi the ████ was vulnerable to time bassed injection via referer header steps 1- copy the request to your burp suite : GET /DNCdb.php?alert= HTTP/1.1 Host: ███████ User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:81.0 Gecko/20100101 Firefox/81.0 Accept:...
Mail.ru: [delivery.city-mobil.ru] Stored XSS into support request comment
Stored XSS in support request comment functionality on delivery.city-mobil.ru Citymobil corporate user could use delivery.city-mobil.ru API for submitting data. It led to bypass input-encoding filters of corporate.city-mobil.ru and stored XSS appeared at corporate.city-mobil.ru...
Informatica: jira discloser information
The ticket raising system used by informatica suffers from an informational vulnerability where in an attacker can view certain details about open bugs or project information of informatica. Details include names and potentially and ticket names which an unauthorized personnel can view without...
Shopify: authenticity token not verfied leads to change business name
Hello security team , while sign up I have noticed that authenticity token is not verified leads to change info like business name Steps to reproduce 1- visit this url https://www.shopify.com/partners and add you mail then click on join now 2- Then fill out your data and click on create new partn...
Stripo Inc: Race condition on my.stripo.email at /cabinet/stripeapi/v1/projects/298427/emails/folders uri
Summary: Hi! I hope you all are pretty good = We have discovered a race condition endpoint Steps To Reproduce: POST /cabinet/stripeapi/v1/projects/298427/emails/folders HTTP/1.1 Host: my.stripo.email Connection: close Content-Length: 23 Accept: application/json, text/plain, / Pragma: no-cache...
Booking.com: Subdomain takeover of ci-support.booking.com (pointing to Zendesk)
Description Host ci-support.booking.com has a CNAME record pointing to ci-support.zendesk.com. Before I created my proof of concept see below, that Zendesk subdomain ci-support was unclaimed, as was the custom hostname ci-support.booking.com on Zendesk. As a result, an attacker could create a...
Node.js third-party modules: [zenn-cli] Path traversal on Windows allows the attacker to read arbitrary .md files
Summary I would like to report path traversal in zenn-cli. It allows the attacker to read arbitrary .md files. Module module name: zenn-cli version: 0.1.39 npm page: https://www.npmjs.com/package/zenn-cli Module Description Manage Zenn content locally 👩💻 Module Stats 885 weekly downloads...
CS Money: Improper authentication in the load sell inventory page
Summary: Hello team, I found an endpoint response all data relate to sell mode inventory that doesn't have improper authentication in the link: https://cs.money/loadsellmodeinventory Steps To Reproduce: add details for how we can reproduce the issue 1. Open directly the link:...
PlayStation: Unrestricted access to quiesce functionality in dss.api.playstation.com REST API leads to unavailability of application
Report Summary ---- Unrestricted access to the quiesce function via a PUT request to https://dss.api.playstation.com/api/application/state makes the application unreachable for an uncertain amount of time. Steps To Reproduce ---- Reproduction method 1 + Burp Suite is the program required for the...
CS Money: Отправка писем с произвольным текстом/кликабельными ссылками любому зарегистрированному пользователю с указанной почтой, зная только steamid
Using a third-party service GetResponse used on the project and the 2FA deactivation functionality combined, a hacker found a way to send arbitrary text to any user, knowing only the victim's SteamID. The vulnerability relied on: 1. Invalid cookie management in request; 1. No additional validatio...
Brave Software: Universal XSS through FIDO U2F register from subframe
A vulnerability was discovered in Brave's FIDO U2F implementation that allowed cross-domain subframe to inject any JavaScript code to the top frame through fake U2F registration process, resulting in Universal XSS. The vulnerability affected Brave iOS Version 1.20 20.09.11.20 and current Nightly...
CS Money: Application DOS via specially crafted payload on 3d.cs.money
Summary: Hello Team, While testing it was observed that on 3d.cs.money a DOS is possible via specially crafted request using only single request from single machine on search bar. Though I am aware of the Out of Scope policy "Any activity that could lead to the disruption of our service DoS", thi...
Open-Xchange: XSS - Search - Unescaped contact job
The function responsible for formatting the contact's job company and position doesn't escape its value, which allows to inject arbitrary HTML content. javascript // master/ui/apps/io.ox/contacts/common-extensions.js // develop/ui/apps/io.ox/contacts/listview.js bright: function baton var text =...
CS Money: Server-side denial of service via large payload sent to wiki.cs.money/graphql
Summary: By sending a large payload to wiki.cs.money, a malicious actor can cause a partial or full denial of service to other users using the graphql part of wiki.cs.money Steps To Reproduce: - Setup burpsuite as a proxy - Go to burpsuite - Proxy - Options - Match & Replace - Click add - ITEM =...
U.S. Dept Of Defense: Improper Access Control - Generic on https://████
Greetings, I found on one of your sub-domains some tickets that are not supposed to be readable by everyone, we even have the possibility to delete the tickets. Link : https://███/█████/latest https://█████/███████/all https://█████/███████ DELETE HEADER METHOD Best regards, frenchvlad Impact a...
Mail.ru: Stored XSS through fileupload
Stored XSS in view uploaded file functionality on static.donationalerts.ru...
Mail.ru: Незащищённый экземпляр Zeppelin
Apache Zeppelin notebook at http://zp.premras2.m.smailru.net was made externally available due to coincidence of multiple misconfigurations...
Zivver: Two-factor authentication can be disabled when logged in without 2fa or password confirmation
When a user performed sensitive actions on an account, he/she didn't have to provide his/her password after some inactivity. This issue is now addressed and to perform actions related to account security, the user has to provide his/her password before continuing...