Helium: Race Condition of Transfer data Credits to Organization Leads to Add Extra free Data Credits to the Organization

Description i found an way to add data credits for free by doing race condition of transfering data credits using turbo intruder of burpsuite when created an account with only default 10000 data credits but i managed it to add for free without buying or purchasing POC Steps if Confused refer POC...

Mail.ru: [api.my.games/social/chat/multi/add] Privilege escalation on adding new members to group chat

Privilege escalation in chat management functionality on store.my.games...

Mail.ru: Account Takeover possibility via https://awards.donationalerts.com using login with twitch.tv

Authentication procedure with twitch.tv oAuth allowed account takeover on awards.donationalerts.com...

BugPoC: Reading arbitrary files via running arbitrary python code

Summary: Reading arbitrary files via running arbitrary python code Steps To Reproduce: 1. Go to Python POC and execute arbitrary code to read arbitrary files Recording: F976069 I have stopped testing further. Users can run arbitrary python code. Please do let me know If anything is unclear. Impac...

Mail.ru: [my.games, lootdog.io] XSS via MCS Bucket

Proxy pass for the path in my.games and lootdog.io domains was misconfigured to point to the root of public S3 storage, allowing to place static content in the domain path leading to XSS possibility...

GitHub Security Lab: [CATENACYBER]: [CPP] CWE-476 Null Pointer Dereference : Another query to either missing or redundant NULL check

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Query to find TLS configurations supporting hardcoded insecure versions of the protocol and cipher suites

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query to detect XSLT injections

This bug was reported directly to GitHub Security Lab...

Automattic: Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - Bypass

Hello there, I hope all is well! I found a stored xss on https://app.crowdsignal.com/ Steps: Go to https://app.crowdsignal.com/dashboard Create a survey. Go to https://app.crowdsignal.com/quizzes/survey-id/question Add Multiple Choice Click Add media button. Select Embed Media Paste this:...

Automattic: IDOR leads to Edit Anyone's Blogs / Websites

Hello there, I hope all is well! Steps: 1. Go to https://intensedebate.com/signup and create 2 accounts. 2. Login as victim and go to https://www.intensedebate.com/edit-user-profile 3. Click Add Blog / Website text and fill the form click Save Settings button 4. Go to...

Agoric: Dependency on private SSH keys in public github

Summary: As i am searching for the some information i came through one of the https://github.com/Agoric/agoric-sdk/blob/8a8136533220a862bf87d319e821858c8b7ba3b3/vagrant/Dockerfile as i am looking at the content i came through github link for ssh private key...

Mail.ru: Clickjacking Vulnerability via https://profile.my.games/gamecenter/profile/ can lead to sensitive cross site actions (Bypass X-Frame-Options)

Clickjacking attack could allow to force user to change profile settings on profile.my.games...

Mail.ru: Multiple SQL Injections and constrained LFI in esk-static.3igames.mail.ru

SQL Injections in esk-static.3igames.mail.ru due to unsafe usage of GET parameters...

Mail.ru: the same as #948259 - XSS at jsgames.mail.ru

Reflected XSS in jsgames.mail.ru via GET parameter backurl found it in under 1 minute , thanks for sharing @yukusawa18 ;...

Mail.ru: This Github Repository Seems Leaking "nino.samokat.ru" Source Code

nino.samokat.ru promo site source code was leaked on github.com...

Node.js third-party modules: [curling] Remote Code Execution

I would like to report RCE in curling I can bypass the security check for special characters, read / overwrite file Module module name: curling version: 1.1.0 npm page: https://www.npmjs.com/package/curling Module Description A node wrapper for curl with a very simple api. Module Stats 156 weekly...

Node.js third-party modules: [imagickal] Remote Code Execution

I would like to report RCE in imagickal It allows to execute arbitrary commands on the victim's PC Module module name: imagickal version: 4.2.0 npm page: https://www.npmjs.com/package/imagickal Module Description node wrapper for ImageMagick commands Module Stats 42 weekly downloads Vulnerability...

BlockDev Sp. Z o.o: A specially crafted value for the 'Cache-Digest' header causing crash in chat.makerdao.com

A specially crafted value for the 'Cache-Digest' header causing crash...

pixiv: Open Redirect at https://oauth.secure.pixiv.net

Summary: Hello @pixiv security team, i hope you are well, i noticed you can redirect users to another domain if you send an invalided scope. Vulnerable Url...

Kubernetes: kubeadm logs tokens before deleting them

Report Submission Form Summary: kubeabdm's delete command takes as input either a bootstrap token ID, or a full token. Before determining whether the input is just an id or a full token, kubeadm logs the input using klog. If the deletion fails, the token would remain valid. An attacker who has...

Mail.ru: Возможность создать канал в группе, в которой пользователь не является админом [my.games]

Privilege escalation in chat management functionality on store.my.games...

GitLab: Able to leak private email of any user given his/her username via graphql

Summary Graphql query user is leaking private email of users query userusername:"" email username Steps to reproduce Step-by-step guide to reproduce the issue, including: Have a account with private email settings Use graphql query to access the private email query userusername:"" email username...

Valve: Add apps to packages 0, 61, 62 with /store/ajaxpackagemerge

The ajaxpackagemerge API incorrectly allowed partners to add their own apps to certain Valve administrative packages. This can be further leveraged to generate CD key ranges for these administrative packages. The API access control was corrected...

Node.js third-party modules: [arpping] Remote Code Execution

I would like to report RCE in arpping It allows to execute arbitrary commands on the victim's PC Module module name: arpping version: 2.0.0 npm page: https://www.npmjs.com/package/arpping Module Description Discover and search for internet-connected devices locally using ping and arp Module Stats...

Acronis: No brute force protection on web-api-cloud.acronis.com

There was no brute force protection on https://web-api-cloud.acronis.com/api/idp/v1/token endpoint...

Lark Technologies: Stored xss on helpdesk using user's city

A stored XSS cross-site scripting was found on the internal larksuite helpdesk, which an attacker could have potentially used to obtain access to the internal helpdesk. We thank imrannisar for reporting this vulnerability and confirming its resolution...

Acronis: Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 - Acronis Scheduler2 Service

Vulnerability description not provided...

Shopify: damage to the timeline so that comment fields cannot be displayed or not available to all members in the store

see https://a-alert-b-y000-b-finda.myshopify.com/admin/discounts/416981811222 I tried to make a discount code with a product name and a discount code like: ± ± when I havehtag the product name on the timeline comment and I get a "server error" reply and it causes crashes to the timeline, so...

Sony: SSRF on http://www.███████/crossdomain.php via url parameter

The researcher reported that a Sony endpoint was vulnerable to Local File Inclusion LFI and Server-Side Request Forgery SSRF vulnerabilities. The researcher used the LFI vulnerability to read sensitive files such as /etc/passwd from the web server. The researcher also demonstrated using the SSRF...

Mail.ru: IDOR смена email пользователя через Ситимобил Бизнес

It was possible to change e-mail address of the user via corporate.city-mobil.ru. An award for this report was distributed evenly between 956791 and 971422. Report 956791 demonstrated the vector for corporate.city-mobil.ru, 971422 demonstrated this vulnerability may have higher impact besides the...

U.S. Dept Of Defense: Reflected XSS on ███████

Summary: Reflected Cross site Scripting XSS on████leaving.html?url=%22%3E%3Cscript%3Ealertdocument.domain%3C/script%3E Steps To Reproduce: 1. Navigate to███leaving.html?url= 2. Enter a crafted XSS payload like "alert"xss by nagli" 3. Alert will pop :- █████████ How can the system be exploited wit...

Glassdoor: Reflected XSS at https://www.glassdoor.co.in/Job/pratt-whitney-jobs-SRCH_KE0,13.htm?initiatedFromCountryPicker=true&countryRedirect=true

Summary: There is a reflected XSS vulnerability in https://www.glassdoor.co.in/Job/pratt-whitney-jobs-SRCHKE0,13.htm?initiatedFromCountryPicker=true&countryRedirect=true Vulnerability Type: Reflected XSS Browsers tested: Chrome, Firefox Payload:...

Acronis: Clickjacking on cas.acronis.com login page

Steps To Reproduce: Create a new HTML file Source code: I Frame Clickjacking Vulnerability Save the file as whatever.html Open document in browser Reference: https://hackerone.com/reports/591432 FIX- The vulnerability can be fixed by adding "frame-ancestors 'self';" to the CSP...

Mail.ru: CSRF Delete chat invitation link.

CSRF vulnerability in api.my.games allowed to delete chat invitation link with crossite request...

Acronis: Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/

Summary Hello, There is possible to inject arbitrary HTML constructions on the page /admin/su/. The problem is in the insufficient escaping of special characters like for the Error parameter. If this parameter contains a specially crafted vector, the application will return the page that will...

GitLab: Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances

NOTE: I am still researching whether there is a possibility to deploy the exploit without user interaction. Summary GitLab provides a rich representation for Jupyter Notebooks .ipynb. In turn, Jupyter Notebooks provide the possibility for rich output via HTML. Although most tags and attributes ar...

Glassdoor: Account Takeover

A user's access token from a Facebook/Google app was found to be accepted by the target application, allowing for account takeover. The token was not properly validated, enabling the use of any previously obtained user token to log in to the application...

CS Money: Pixel Flood Attack leads to Application level DoS

Summary: Hello Team, I had gone through your policy and I saw that DoS is out of scope but I am not sure about Application level DoS. The another reason to report this attack because it affects real customers who want to chat with your support team. I had tested this with two accounts 1. From...

Acronis: Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 installer

Vulnerability description not provided...

Kubernetes: exposed Git Repo at http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io/.git/

Dear Security team, If this report is out of scope, please let me know and I will close the report myself I found a git repository on http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io/.git/.git. This endpoint allows an attacker to retrieve much of the source code and git history for this...

X (Formerly Twitter): Bypass Password Authentication to Update the Password

Summary:This additional security measure from twitter provides protection to the victim's account, considering that a victim's session may have been hijacked by a hacker, however, due to this additional layer of security Implemented by twitter the hacker would not be able to change the victim's...

WakaTime: Private leaderboard owner email disclosure when sending invites

Hi , the unVerify email disclosure when invite to any one on Leaderboards . Step .. 1- create account [email protected] . 2- not verify email . 3- go to Leaderboards . 4- check invite any email [email protected] . your friends. 5- your friends look inbox the waketime invite it say [email protected]...

Mail.ru: Пользователь может изменить способ оплаты указав чужой corporation ID

IDOR vulnerability in city-mobil.ru allowed arbitrary organization to be billed for a taxi ride...

LY Corporation: Developer uploaded files missing authentication on LINE GAME Developers site(gdc.game.line.me)

IDOR vulnerability at gdc.game.line.me allowed unauthenticated users to perform brute-force attacks to disclose unauthorized files related to service testing and QA...

New Relic: Getting API access key Through Introspection query Graphql

The introspection query should only be allowed internally and should not be allowed to the general public. If we can fetch the entire back-end API documentation and calls available on a server then that can be very dangerous is many cases what if we could get our hands on some API calls only mean...

U.S. Dept Of Defense: IDOR to Account Takeover on https://████/index.html

Hello Team! Summary: I found when you wish to update your profile on https://███████/ after your login through https://██████████/signIn/signIn.html website due to an IDOR. This IDOR gives you the opportunity to change the origin email for the registered account by changing the ID parameter on th...

LY Corporation: Password reset by malicious input on air.line.me

Due to the bug in the account verification process in the password reset function of air.line.me, it was possible to change other's passwords if a temporary password reset key was set to a space...

Shipt: bypass the [OKTA] login redirect can lead to disclosing limited-information about the sub-domain at [ shiptsec.com ]

A security researcher identified limited and non-sensitive information disclosure for one of our public-facing tools that is used by internal users. While the risk was very low and nothing was directly exploitable, we went ahead and made the quick change to mitigate this behavior. We made the...

Acronis: DOM based XSS in store.acronis.com/<id>/purl-corporate-standard-IT [cfg parameter]

Summary Hi Acronis team, i found a DOM based XSS in store.acronis.com, this vulnerability arise from a missing escape for the \ character. Steps To Reproduce 1. go to:...

Mail.ru: [http://kiwi.youdrive.today/] Information disclosure via Kiwi TCMS vulnerability

Outdated kiwi.youdrive.today Kiwi TCMS instance was vulnerable to information disclosure via JSON-RPC endpoints. Outdated Kiwi TCMS instance was vulnerable to information disclosure via JSON-RPC endpoints. Exploit example dump users info except superuser: curl -i -s -k -X $'POST' -H $'Content-Typ...