Zomato: Ability to manipulate price with a max threshold of `<1 Rupee` in support rider parameter

Hi Team I have found an issue in support rider amount calculation at the time of checkout where the amount is tamperable by negative fraction of rupees which makes the total amount decreased by maximum of 1rs. POC - 1-Goto - zomato.com 2 - Add anything to your cart 3- At the checkout page , Add...

Shopify: Ability to publish a paid theme without purchasing it.

Hi, Description I found out that it is possible to publish a paid theme without purchasing it. I remember trying this some time ago and it seemed to be safe from this kind of attack. Steps to reproduce 1. Make sure you have the default theme installed and that it is published. 2. Install any free...

Zomato: The vulnerabilities found were XSS, Public disclosure, Network enumeration via CSRF, DLL hijacking.

Summary IP found using ping command- 52.77.124.190 Then I used nmap tool to find the indepth information. I used burp suite and DNS scanner but it was not fruitful. Then I explored some GitHub repositories to perform thorough web-application testing. Using Aquatone I found some hidden domains. Th...

Staging.every.org: Race Condition when following a user

Summary: Hi team, There is a race condition vulnerability when following a user. If you send the Follow requests asynchronously, you can follow a user multiple times instead getting an error message. I've been using Turbo Intruder extension at Burp Suite for trying Race Condition attacks. I can...

LY Corporation: LINE Profile ID leaks in OpenChat

Users can participate in OpenChat using a new OpenChat profile that is distinct from the LINE profile. However, when the victim attaches an image in a post in OpenChat's Note, the ID of LINE Profile was stored together in the image's metadata. From this information, it is possible to determine th...

curl: curl overwrites local file with -J option if file non-readable, but file writable.

Summary: When using -J -O options on curl command line tool and a server responding with a header that is using Content-Disposition to provide a filename, existing local file will be overwritten if the file is non-readable by the current user, but file is writable by the current user. Curl contai...

Mail.ru: Bypass OTP on contact back request at https://driver.city-mobil.ru/

It was possible to bypass phone verification for support call back request...

Hyperledger: Vulnerability in Private Data Endorsement Policy Management in Hyperledger Fabric 2.0

To whom it may concern, We are a research group conducting research on the Hyperledger Fabric. We find a design flaw about the endorsement policy of Private Data related transactions in Hyperledger Fabric 2.0. When private data adopts a default chaincode-level MAJORITY endorsement policy, the...

BugPoC: Improper use of "path" parameter can be used to trick testers into leaking their Front-End PoC

Summary: In https://bugpoc.com/testers/front-end, the populateFromFragment function incorrectly assigns hash parameter path to the subdomain element, allowing the "Test" functionality of the Front-End PoC Generator to open a popup on any domain instead of the expected web.bugpoc.ninja. It can be...

Valve: Shell command injection in https://partner.steamgames.com/bundles/savestore/ via overwriting asset_path_identifier

Shell command injection in https://partner.steamgames.com/bundles/savestore/ via overwriting assetpathidentifier. Insufficient validation of parameters allowed injecting shell metacharacters into values used to construct a Bash command...

Weblate: Secret_key in GitHub

hello I have found secretkey in GitHub is public and noticed something this key have comment Make this unique, and don't share it with anybody. and it's public in GitHub also I noticed this file has coding to do the payment.db I think information like this must be private SECRETKEY =...

Nord Security: Getting SmartDNS for free from - join.nordvpn.com

The reporter identified an issue within our backend system which performs validation of the active services. There was a misconfiguration related to caching and time period calculation. This lead to SmartDNS service being active for a longer period of time than it should have been, compared with...

PayPal: RCE via npm misconfig -- installing internal libraries from the public registry

A Bug Bounty researcher identified an issue where certain development projects defaulted to the public NPM registry, instead of using the intended internal packages. Since the packages on the public registry did not exist, the researcher created these and observed they were downloaded. Had these...

Bitwarden: Blind HTTP GET SSRF via website icon fetch (bypass of pull#812)

After a credential has been added to vault.bitwarden.com or any self-hosted installation, if the settings allow website icons to be fetched https://bitwarden.com/help/article/website-icons/, the Bitwarden server will try to fetch the icon image. The relevant source code is...

MTN Group: [play.mtn.co.za] Application level DoS via xmlrpc.php

Description Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DOS/SSRF. The website play.mtn.co.za has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. hackeron...

OWOX, Inc.: Unrestricted File Upload in Chat Window

Summary: The application allows the attacker to upload dangerous file types that can be automatically processed within the product's environment. Steps To Reproduce: - Hit the browser and navigate to https://bi.owox.com and sign in. - Open The Chat window. - Upload any .rb or .php file . - Click ...

MTN Group: CVE-2018-6389 exploitation - using scripts loader

Issue Description Unauthenticated attackers can cause a denial of service resource consumption by using the large list of registered .js files from wp-includes/script-loader.php to construct a series of requests to load every file many times. The vulnerability is registered as CVE-2018-6389 76172...

Node.js third-party modules: [systeminformation] Command Injection via insecure command formatting

I would like to report a Command Injection vulnerability in the systeminformation package. It allows an attacker to inject arbitrary OS commands. Module Module name: systeminformation Version: 4.26.10 npm page: https://www.npmjs.com/package/systeminformation Module Description System and OS...

MTN Group: blind sql on [selfcare.mtn.com.af]

Summary: add summary of the vulnerability Steps To Reproduce: add details for how we can reproduce the issue get cid = sql SQL query - SELECT user FROM dual CONAPPMTNA HTTP Request GET /selfcare/HomePageDisplay?cid=26%20AND%20321=6%20AND%20498=498&location=MTNA HTTP/1.1 X-Requested-With:...

LY Corporation: CORS misconfiguration leads to users information disclosure at https://studyroom.line.me

Due to the CORSCross-Origin Resource Sharing misconfiguration in the StudyRoom API server, SOPSame Origin Policy can be bypassed, and the API that retrieves one's profile information was returning more personal information than necessary. Combining the issues allows an attacker to obtain user...

Mail.ru: Access to information about any video and its owner via GraphQL endpoint [dictor.mail.ru]

An IDOR vulnerability in dictor.mail.ru allowed to obtain arbitrary video information via direct GraphQL query...

MTN Group: SQL injection [futexpert.mtngbissau.com]

Summary: add summary of the vulnerability Steps To Reproduce: add details for how we can reproduce the issue 1. Poc Request POST /signin/ HTTP/1.1 Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Referer: https://futexpert.mtngbissau.com/ Cookie:...

MTN Group: xss on [developers.mtn.com]

xss on history.pushState'', '', '/' F908897 Impact POC F908895 F908896...

U.S. Dept Of Defense: Reflected XSS in https://www.██████/

Hello Security Team, I would like to report the XSS vulnerability on your system. The i= parameter is not escaped properly for URL encoded values. Steps To Reproduce: Visit the following POC link:...

Acronis: Acronis Sync Agent Service - Untrusted DLL Search-Ordering lead to Privilege Escalation

Vulnerability description not provided...

U.S. Dept Of Defense: Exposed Docker Registry at https://████

Summary: The docker registry at https://██████ has no authentication in place and is therefore exposed to the public. This leads to full disclosure of all available docker containers, the possibility to upload docker container and manipulate and delete existing docker containers. Description: Fro...

Mail.ru: Path traversal on bank.mail.ru ( CVE-2013-3827 )

Defects in Oracle’s JSF2 implementation allowed limited path traversal in tbank.mail.ru...

Nintendo: Arbitrary code execution in TSEC Heavy Secure, return-oriented programming in TSEC Secure ROM, and recovery of TSEC-derived cryptographic secrets

The vulnerability in TSEC Heavy Secure allowed for arbitrary code execution. A return-oriented programming vulnerability was discovered in the TSEC Secure ROM. Cryptographic secrets derived from TSEC were recovered...

Acronis: Local File Disclosure /Delete On [us-az-vpn.acronis.com]

Cisco ASA VPN server hosted on https://us-az-vpn.acronis.com was found to be using an outdated version that suffers from a Local File Disclosure /Delete vulnerability. Through this vulnerability an unauthenticated remote attacker can read and delete the contents of any file stored on the VPN serv...

Nextcloud: PIN for passwordless WebAuthn is asked for but not verified

Nextcloud introduced WebAuthn passwordless authentication with version 19. As far as we understand, you assume that your implementation provide two-factor authentication: "The server asking for authentication can request verification of multiple factors, so that a configured key requires the user...

Rocket.Chat: Insecure use of shell.openExternal() in Rocket.Chat Desktop App leading to RCE

Summary: The Rocket.Chat Desktop app passes the links users click on to Electron's shell.openExternal function which can lead to remote code execution. Description: The filtering on the URLs passed to shell.openExternal is insufficient. An attacker can craft and send a link that when clicked will...

U.S. Dept Of Defense: Blind Stored XSS on the internal host - █████████████

The vulnerability was a blind stored XSS on an internal host. The payload was triggered from the endpoint https://███████████████/NSSI/controlcenterV2/index.htm?directlink&courses/classes/findstudent&&&&&&&& and was found in the Referer header. The vulnerable URL was not accessible from outside t...

U.S. Dept Of Defense: RXSS - ████

Hello, friends today when I was checking some sites I found this bug on your own website. Detalis XSS Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web...

Mail.ru: IDOR of contracts on dictor.mail.ru

API endpoint at dictor.mail.ru disclosed e-mails of registered users...

Phabricator: Edit Policy restriction does not prevent comments.

Change the edit policy of a Maniphest Task - Attempt to comment on the the task with a user who doesn't have access Impact Given a few users I spoke to believe restricting the edit policy blocks comments, This allows an underpriveleged user to gain access to carry out a restrcited action. Mongoos...

lemlist: stored xss via Campaign Name.

Summary: Hi, I found a stored xss https://app.lemlist.com Steps To Reproduce: 1. go to https://app.lemlist.com/. 2. create or edit campaigns. 3. set the payload / in the Campaign Name. 4. visit Buddies-to-Be tab . 5. click Add one on the right Top . or click on one of the list of Contact 6. you...

Nintendo: [3DS][StreetPass] Heap Overflow in Swapnote parser leads to userland StreetPass RCE

Affected Systems - System: Nintendo 3DS - Version: = 11.13 - Region: ALL Description When parsing TLRF chunks in message files the application calls memcpy using user provided sizes to copy controlled data over a fixed-size buffer. Thus one can overflow heap chunks which is enough to get code...

Dropbox: Server Side Request Forgery (SSRF) at app.hellosign.com leads to AWS private keys disclosure

The report details about a Server Side Request Forgery vulnerability that was present on the document upload through integrations feature in the HelloSign application. The vulnerability was caused due to an unvalidated external file upload through our various integration partners. The attacker...

Acronis: Administrative access to development deployment of web service due to auto-filled credentials

It was possible to gain administrative permissions on https://admin.acronis.host due to auto-filled credentials. The service was used for development purposes only and did not contain any sensitive data or data of real users. Summary: I discovered an Acronis admin panel which auto filled...

Acronis: SQL injection on admin.acronis.host development web service

Summary: I found an Acronis domain and started hunting on it. During my hunting, I found an admin panel and was able to access this panel separate report inbound. It was easy to gain access to this panel, and I was not sure if it was for testing purposes or a genuine admin panel. I played around...

Node.js: HTTP Request Smuggling due to CR-to-Hyphen conversion

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: add summary of the vulnerabili...

8x8: SQL injection (stacked queries) in the export to Excel functionality on Vidyo Server

An abandoned Vidyo server was found to be vulnerable to SQL injection and exposing access to the associated local database. The Vidyo server was retired...

Mail.ru: Account takeover in cups.mail.ru using punycode characters

A logical bug in database collation usage for string comparison during access recovery process allowed to takover account in cups.mail.ru by registering colliding Unicode domain...

Mail.ru: Subdomain takeover at msproject.geekbrains.ru

Unused subdomain of geekbrains.ru was deligated to tilda.cc and not claimed...

U.S. Dept Of Defense: DOM XSS on https://www.███████

Description DOM XSS can be achieved due to missing sanitation when setting the source of an iframe. POC 1. Visit https://www.████frame.htmljavascript:alertdocument.domain 2. View alert Vulnerable Code javascript function Load str=document.location.hash,idx=str.indexOf'' ifidx=0 str=str.substr1;...

Nextcloud: No rate limiting on sinup page

Hi Team, Summary: As a best practice a login page should have a rate limiting. Below is the captured request of respective login page of nextcloud.com -------------------------------------------------------------------------------------------------------------------- POST...

GitLab: Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd parties

Summary There's a limitation that requires a validated email before going through the OAuth flow, however this is bypassable. Bypassing this means the target site assumes your email is validated, and actually ends up signing you in with an non-validated email. This behavior can frequently lead to...

Mail.ru: [https://youdrive.today/] Nginx directory traversal

Invalid nginx configuration allowed limited path traversal in youdrive.today and leaking sensitive application data in configuration files. Nginx directory traversal via misconfigured alias leads for disclosing all the configuration. Exploit: https:///static../config.js...

Mail.ru: SMS Brute Force Possibility via https://youdrive.today/login/web/code can lead to Account Takeover

Authentication procedure was not sufficiently protected against bruteforce and allowed arbitrary youdrive.today account takeover...

Snapchat: Improper Authentication - any user can login as other user with otp/logout & otp/login

'/scauth/otp/droid/logout' request contains userid parameter. Usually it is equal to current user userid, but if an attacker passes userid of victim account he can login as victim. I will demonstrate the problem on two accounts. Victim: ███ Attacker: ██████████ - Attacker perform a usuall login t...