Nextcloud: Improper access control to messages of Social app

The Social App https://apps.nextcloud.com/apps/social lacks access controls in the displayPost function /@username/token allowing an unauthenticated user to view any message content by knowing or guessing the message ID. The vulnerable code is at...

WordPress: Clickjacking on donation page

Description: Vulnerable URL: https://wordpressfoundation.org/donate/ Clickjacking on the vulnerable URL allows an attacker to redirect a victim to do a donation at an attacker's page. Steps To Reproduce: 1 To test whether the page is vulnerable to clickjacking or not use this code i Frame THIS PA...

Automattic: Denial-of- service By Cache Poisoning The Cross-Origin Resource Sharing Misconfiguration Allow Origin Header

Summery: The wp-json implementation on some WordPress websites I've tested is vulnerable to Denial-of-service where by an attacker can provide an arbitrary origin header in the request, which is then echoed back in the response via the Access-Control-Allow-Origin header, which is cached and serve...

GlassWire: Uncontrolled Search Path Element allows DLL hijacking for priv esc to SYSTEM

GlassWire contains a DLL hijacking vulnerability that could allow an authenticated attacker to execute arbitrary code on the targeted system. The vulnerability exists due to GlassWire loading DLL files from the PATH environment variable without verification. The machine should have at least one...

DuckDuckGo: DOM XSS on duckduckgo.com search

Hey there, there is a DOM XXS vulnerability on the https://duckduckgo.com/ search result page through the kp and kae parameters of the Cloud Save feature. POC URL:...

Concrete CMS: Arbitrary File delete via PHAR deserialization

crayons : Concrete5 Arbitrary File delete via PHAR deserialization - Target: Concrete5 - Version: 8.5.4 Latest at 2020. 07. 12 / PHP 7.2 - Credit: WSP Lab@KAIST - Contact: [email protected] TL; DR - An attacker can send an arbitrary input value in the isdir function, which causes a PHAR...

X (Formerly Twitter): Denial of Service [Chrome]

Hi Team, Summary: I encountered such an error while creating a new account: F903872 But I don't remember where I found this last point. I remember only when I was a new member. I created a url using the load %xx as in 500686 reports as follows. https://twitter.com/i/flow/%00 I got a result like t...

Radancy: [mijn.werkenbijdefensie.nl] Denial of service occurs due to lack of email length confirmation

Creating an account on https://mijn.werkenbijdefensie.nl/profielaanmaken/ could be done with a very long emailaddress. A max email address length validation check has been implemented as per RFC the maximum length allowed for an email address is 255 characters. However, we don't validate email...

Mail.ru: Improper Restriction of Excessive Authentication Attempts at https://api.warrobots.com/auth (Pixonic Games)

Password at warrobots.com was not sufficiently protected against bruteforce...

U.S. Dept Of Defense: SharePoint Web Services Exposed to Anonymous Access

Summary: Any unauthenticated/anonymous users are able to access the SharePoint Web Services .wsdl files for the ██████████ website. Description: The SharePoint installation for this particular site allows any user to access the spdisco.aspx on the web server which discloses the location of of all...

U.S. Dept Of Defense: SharePoint Web Services Exposed to Anonymous Access

The SharePoint configuration for this particular site allows any user to access the spdisco.aspx on the web server which discloses the location of of all SharePoint's web service endpoints. The URLs are: ██████████ ███ Impact An adversary may utilize the exposed information about the web services...

Automattic: Captcha checker "pd-captcha_form_SURVEYID" cookie is accepting any value

Summary: Hi team, There is a Captcha protection feature on surveys and polls. If you captcha protection enabled survey, you will see this : F901789 When you solve captcha and click Submit Captcha, website sets a cookie like this : F901799 And if you delete this cookie and try access to survey, yo...

GitHub Security Lab: [javascript] CWE-020: CodeQL query to detect missing origin validation in cross-origin communication via postMessage

This bug was reported directly to GitHub Security Lab...

Automattic: Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed Media

Hello there, I found a stored xss vulnerability. Steps: 1. Go to https://app.crowdsignal.com/dashboard 2. Create a quiz. 3. Go to https://app.crowdsignal.com/quizzes/your-quiz-id/question 4. Add Multiple Choice 5. Put a name to answer 1. 6. Click Add media button. F901543 7. Select Embed Media 8...

Visma Public: HTTP Request Smuggling at app.workbox.dk

The researcher was able to find a HTTP request CL.TE smuggling vulnerability at app.workbox.dk. The likely consequences would have result in interfering with normal user traffic, leak 'Session Cookies, leak PII info...

lemlist: stored xss in app.lemlist.com

Hi there, I found a stored xss app.lemlist.com. Steps To Reproduce: 1. go to https://app.lemlist.com/. 1. create or edit campaigns. 1. visit tab Buddies-to-Be. 1. click Add one on the right Top. 1. Fill in the input 1. add / Icebreaker and companyName 1. click create . POC F901411 Impact Stealing...

Nextcloud: Full path disclosure vulnerability via Upload .htaccess file

Hello Security team, i foud Full path disclosure vulnerability via Upload .htaccess file see POC video. Thankz Impact Sensitive File/Folder Information...

Mail.ru: Open Redirect at "city-mobil.ru"

Open redirection in city-mobil.ru via URI path with '@'...

Basecamp: HTTP request smuggling on Basecamp 2 allows web cache poisoning

It is found that an authenticated Basecamp 2 user can desync front and backend servers and poison the socket with harmful response for the next visitor. During redirect probe, It also appears that front-end infrastructure performs caching of content. Using HTTP request smuggling attack, It is...

Omise: Authenticity token doesnt expire after single use leading to CSRF

Summary Once you said that you ruby framework for making the authenticity-token which acts as a CSRF protection. You also send me this as to help me understand https://medium.com/rubyinside/a-deep-dive-into-csrf-protection-in-rails-19fa0a42c0ef . After finding i found that an authenticity-token c...

Visma Public: Missing authorization allows sales only user to record payment.

The researcher has found a missing authorization issue that allowed a sales only user to record payments that he was not supposed to...

U.S. Dept Of Defense: Subdomain takeover due to an unclaimed Amazon S3 bucket on ███

Summary: An unclaimed Amazon S3 bucket on █████████ gives an attacker the possibility to gain full control over this subdomain. Description: ███████ pointed to an S3 bucket that did no longer exists. The bucket points to an Amazon S3 website bucket in the US East region. I claimed this bucket and...

Visma Public: A sales only user can edit the purchase invoice drafts.

The researcher has found a missing authorization issue: a sales only user could edit the purchase invoice drafts that he shouldn't...

Mail.ru: Clickjacking Vulnerability via https://webagent.mail.ru leading to protection bypass for https://web.icq.com/ end point

Clickjacking protection bypass on web.icq.com via webagent.mail.ru...

Kubernetes: Fake email from <any_name>@kubernetes.io to any other email

Hi, I just found an issue No Valid SPF Records in your mail server @kubernetes.io Desciprition : There is a email spoofing vulnerability.Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email...

Rocket.Chat: It is possible to elevate privileges for any authenticated user to view permissions matrix and view Direct messages without appropriate permissions.

Description: ===================== For the user with "View Private Room" permission only it is possible to rewrite permission role e.g. to admin in /api/v1/me method response via some proxy tools e.g. Charles and get access to servers permissions matrix and view Direct messages. Releases Affected...

Shopify: STAFF "No-Permissions" on the Store can retrieve the details Order via exchangeReceiptSend

I discovered a bug in an android mobile app that allowed STAFF No Permissions using Receipt Send to Mobile of any Order information in the Store. Steps to reproduce: 1 STAFF account is created and assigned "No Permissions" on a Shop by Owner/Admin 2 STAFF then login to shop. Notice that STAFF is...

Central Security Project: Unsafe deserialization in Nexus Repository helm plugin

A remote code execution vulnerability CVE-2020-15871 has been discovered in Nexus Repository Manager 3. A user with the right permissions can run arbitrary code as the user running the Nexus Repository Manager server. Alternatively, an attacker could trick a user with the right permissions into...

Mail.ru: Improper Restriction of Excessive Authentication Attempts at o2-ac.my.com/token

Password at my.com was not sufficiently protected against bruteforce...

Mail.ru: [combo.mail.ru] SMS code bruteforce

Authentication procedure was not sufficiently protected against bruteforce and allowed arbitrary combo.mail.ru account takeover...

GitHub Security Lab: [Java] CWE-295 - Incorrect Hostname Verification - MitM

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query to detect OGNL injections

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: CWE-273 Unsafe certificate trust

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query for disabled revocation checking

This bug was reported directly to GitHub Security Lab...

InnoGames: Stored XSS on recruit.innogames.de

Summary: When applying for a Supporter/Moderator job at recruit.innogames.de the drop-down field "Position" is vulnerable to a stored XSS as the content is not validated. Description: Steps To Reproduce: 1. Visit https://recruit.innogames.de/staemme/de/index/page/show/apply 2. Fill out all requir...

Gener8: Session not invalidated after password reset

After a user performed a password reset, all their active refresh tokens were not invalidated. This could allow an adversary with access to a valid refresh token to regain control of a victim's account, subsequent to a password reset being completed...

Nextcloud: Access control missing while viewing the attachments in the "All boards"

The vulnerability lies in the "view attachment" of the tasks . When a user uploads the file to the Task, the attachment is given a numeric number and is increased +1 on further uploads. It is easy for any user to view and download all the files uploaded to the tasks by any user. The access is not...

Node.js third-party modules: [json-bigint] DoS via `__proto__` assignment

I would like to report a DoS in json-bigint. It allows to cause denial of service using very limited input 70 bytes. Module module name: json-bigint version: 0.3.1 npm page: https://www.npmjs.com/package/json-bigint Module Description JSON.parse/stringify with bigints support. Based on Douglas...

Engel & Völkers Technology GmbH: SPF Misconfiguration

There is a email spoofing vulnerability. Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing is a tactic used in phishing and spam campaigns because people are more likely to open an...

Shopify: Script Editor preview token still working with uninstalled application, even for unpublished script

Within the Script Editor application, it is possible to preview a script on the storefront and proceed to purchase. Once the user click on the preview link, it opens https://shop.myshopify.com/admin/scripts/preview?scriptid=scriptid which then generate a preview token to be used by the storefront...

Engel & Völkers Technology GmbH: Improper authentication on phpmyadmin portal which is hosted in https://eventapp.engelvoelkers.com

Summary: Hi Team, following domain https://eventapp.engelvoelkers.com/ publicly exposed phpmyadmin portal and authentication mechanism is poorly configured, On response manipulation, application giving access to internal structure of phpmyadmin portal, which disclosing many internal paths and sta...

Automattic: [tumblr.com] 69< Firefox Only XSS Reflected

Description : Hello, i have found a XSS Reflected in https://www.tumblr.com/abuse/start?prefill= But the XSS only works in versions of firefox that are below 70. Because its been blocked by CSP, but the version below 69 of firefox is vulnerable. Here's a great article about this subject...

Shopify: Subdomain Takeover of multiple *.ttcdn.co domains

@priyanshuxo demonstrated being able to takeover multiple ttcdn.co subdomains. While we removed the DNS records, the ttcdn.co domain is out of scope for our program, making this report ineligible for a bounty. This is a limited disclosure at their request...

Nextcloud: Social App does not validate server certificates for outgoing connections

The Social App https://apps.nextcloud.com/apps/social does not validate the server TLS certificate for connections to other ActivityPub servers. These connections are used to retrieve the public key for a user or posting a message to another ActivityPub server. The public key for a user is used t...

U.S. Dept Of Defense: Reflected XSS on ███████ page

Summary: The page at https://█████/NtMView.php is vulnerable to reflected cross-site scripting. Description: The page takes a user input in the form of a drop down list, then uses that text in the resulting page ███████ . An attacker can intercept the query to the page and insert an XSS payload, ...

Stripo Inc: Cross-Site WebSocket Hijacking Lead to Steal XSRF-TOKEN

The WebSocket handshake request was vulnerable to CSRF, WebSocket content was contain many sensitive data for the user It was like the PortSwigger Lab...

Mail.ru: xss while uploading a file

Self-XSS via uploaded file name in city-mobil.ru XSS executing while uploading payloaded file...

Mail.ru: Account Takeover via Forgot Password Page at https://3k.mail.ru/send_password.php?

Password recovery procedure was not sufficiently protected against bruteforce and allowed arbitrary 3k.mail.ru account takeover...

Automattic: Users can bypass page restrictions via Export feature at "Share" feature in CrowdSignal

Summary: Hi team, If you upgraded your account, you can share your survey results via "Share" button. F893428 As you can see, I selected Results page on Allow access to the following. So user will access only Results page. But if user has the Export feature. User can export the restricted pages...

Automattic: IDOR at 'media_code' when addings media to questions

Summary: Hi team, When you add a question to your survey and click Save, it sends this request : F893416 In this request, mediacode is vulnerable for IDOR. If you change it to any media ID, you will see it on your question. And these IDs are sequential. So you can access to any user's media...