15693 matches found
Node.js third-party modules: [i18next] Prototype pollution attack
I would like to report a prototype pollution vulnerability in i18next. It allows to modify the prototype of a base object, which may result in DoS, XSS, RCE, etc. depending on the way the library is used. Module module name: i18next version: 19.7.0 npm page: https://www.npmjs.com/package/i18next...
Brave Software: Redirecting users to malicious torrent-files/websites using WebTorrent
Summary: An attacker can redirect a user to a malicious torrent file/website using a reverse tab-nabbbing flaw in WebTorrent. Description WebTorrent allows user to open files after download of while they are being downloaded directly from the browser F965466 An attacker can use this to redirect...
ExpressionEngine: SQL injection at /admin.php?/cp/members/create
SQL injection vulnerability in the control panel. This is limited to users who have access to the control panel, and the ability to create members...
Nextcloud: Stored XSS in collabora via user name
Affected: collabora and nextcloud Ubuntu 18.04.5 LTS Nextcloud 19.0.1 snap version collabora CODE The name of the user is displayed when him joins to edit the document allowing the attacker trigger xss. Impact Set the name of the attacker account to Create a new document → share the document with...
Shopify: Disclose STUFF member name and make actions.
Hello Shopify Security Team! Bug Summary: ============= Based on the report 968165, this also can retrieve the STUFF member name and can send messages using his name. Reproduction steps: ============= - install shopify chat applications. Start Exploit 1 : ============= + Go to targeted store : +...
Shopify: Disclose customer orders details by shopify chat application.
Hello Shopify Security Team! Bug Summary: ============= This bug leads to disclose any store orders details including sensitive informations, through shopify chat app. the chat app can retrieve the orders details for unauthorized user. Reproduction steps: ============= - install shopify chat...
TikTok: Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration
The researcher discovered a URL parameter reflecting its value without being properly sanitized and was able to achieve reflected XSS. In addition, researcher found an endpoint which was vulnerable to CSRF. The endpoint allowed to set a new password on accounts which had used third-party apps to...
Open-Xchange: Buffer overread off by one in `rpa_read_buffer`, incomplete fix for CVE-2020-12674
In function rpareadbuffer, the condition in if p end return 0; len = p++; is not strict enough It should be if p = end return 0; len = p++; The fix from https://github.com/dovecot/core/commit/69ad3c902ea4bbf9f21ab1857d8923f975dc6145 is not enough The ASAN stack trace is...
Nuri: Open Redirect on https://go.bitwala.com/
Hello I found open redirect bug on https://go.bitwala.com. I know that domain is not in scope.I just want to inform a bug. Steps To Reproduce: 1. go to...
Yelp: IDOR in locid parameter allowing to view others accounts Profile Locations
The application transmits in many occasions the locid parameter via URL, which means that this parameter may be being logged in plan text in the Apache server access.log, if not in others also. The fact that this happens, makes this parameter vulnerable not only to be read from this log file, but...
Open-Xchange: Incomplete fix for CVE-2020-12673 : Specially crafted NTML message leads to buffer over read
The vulnerability CVE-2020-12673 got fixed by https://github.com/dovecot/core/commit/fb246611e62ad8c5a95b0ca180a63f17aa34b0d8 adding this check if length datasize error = "buffer length out of bounds"; return FALSE; But this fix seems incomplete with regards to ntlmssptstri The fix should also ad...
Slack: Slack-Corp Heroku application disclosing limited info about company members
@demonia brought it to our attention that two Slack employee email addresses were discoverable in a test application. There was zero risk to customer data. Nothing special, A Heroku Appliction Without Authentication Has Been Discovered On The Linux Application Data Disclosing Limited Information...
New Relic: "Basic user" which can only access a limited subset of the platform can access certain pages which are restricted to the user by the account owner.
@jhimansh described an issue where forced browsing could be used to visit restricted pages as an unprivileged user. As our web application is shipped as client side JavaScript, there is no way to prevent viewing all pages within that code. However, checks are done server-side to ensure that...
Glassdoor: Reflected XSS at https://www.glassdoor.co.in/Interview/BlackRock-Interview-Questions-E9331.htm via filter.jobTitleExact parameter
Summary: There is a reflected XSS vulnerability in https://www.glassdoor.co.in/Interview/BlackRock-Interview-Questions-E9331.htm?filter.jobTitleExact=Portfolio+Management+Group-Fixed+Income+Analyst&countryRedirect=true Affected Parameter: filter.jobTitleExact Browsers tested: Chrome, Firefox...
Acronis: True Image 2021 - LPE via XPC service communication
Summary This is a follow up of 908152. The bug reported there wasn't fixed properly, and as you don't see it, I consider this as new. In the good faith that you will not close this as duplicate submitting this. Also hoping for a bit more bounty than the 200$... The privilege helper tool only...
Kubernetes: secret leaks in vsphere cloud controller manager log
Report Submission Form Summary: When create k8s cluster over vsphere and enable vsphere as cloud provider. With logging level set to 4 or above, secret information will be printed out in the cloud controller manager's log. Kubernetes Version: 1.18.6 Component Version: legacy cloud provider Steps ...
Node.js third-party modules: [bl] Uninitialized memory exposure via negative .consume()
Module module name: bl version: 4.0.2 npm page: https://www.npmjs.com/package/bl Module Description A Node.js Buffer list collector, reader and streamer thingy. Module Stats 8 660 595 weekly downloads Vulnerability Vulnerability Description If user input even typed ends up in consume argument and...
Node.js: `fs.realpath.native` on darwin may cause buffer overflow
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: The libuv's implementation of...
Open-Xchange: Null dereference in `cmd_denotify_operation_execute`
To reproduce, run test suite on following input : require "vnd.dovecot.testsuite"; require "notify"; require "envelope"; test "D Middle" // notify :options "timo@exat"; denotify :is "noot"; if not testresultexecute testfail "fat"; Output is with ASAN enabled stack trace...
Open-Xchange: Assert failed in `edit_mail_istream_read`
To reproduce, run test suite on following input : require "vnd.dovecot.testsuite"; require "variables"; require "editheader"; testset "message" "$mege"; test "" addheader :last "der" "Her-3"; if not testresultexecute Output is with ASAN enabled stack trace testsuite: Panic: file edit-mail.c: line...
Open-Xchange: Failed assert in `mail_index_transaction_lookup`
To reproduce, run test suite on following input : require"vnd.dovecot.testsuite";require "fileinto";require "mailbox";test"" fileinto:create "Folder"; if testresultexecute testmessage:folder "Folder" 2; Output is with ASAN enabled stack trace testsuite: Panic: file mail-index-transaction-update.c...
Open-Xchange: A specifically designed sieve script can cause a DoS in lib-sieve during sieve script compilation via NULL pointer dereference
Reproduction realcrash.sieve is the attached script 1. Build dovecot and pigeonhole 2. Run sievec realcrash.sieve Requirements include and variables extensions should be required. One of the global commands global/export/import without any arguments should be followed by the same command with val...
Azbuka Vkusa: Reflected XSS on av.ru via `q` parameter at https://av.ru/collections/*
Closed...
Shopify: Password protection can be removed for newly created development store
Details Per https://help.shopify.com/en/partners/dashboard/managing-stores/development-storesthe-development-store-password-page, it states that the password can only be removed once the store has been transferred or switch to a paid plan. You can remove the password page only after you transfer...
Azbuka Vkusa: Leak of Google Sheets API credentials
Closed...
Ruby: Potential HTTP Request Smuggling in ruby webrick
function readbody in file /lib/webrick/httprequest.rb use expression /chunked/io to decide transfer-encoding whether or not. that is not rigorous. When using webrick as a http server, a attacker may use a Transfer-Encoding: AAAchunkedBBB header to fake a legal header. than can make a HTTP Request...
Yelp: Clickjacking lead to remove review
Steps To Reproduce: 1. Open iframe F960017 2. You can remove reviews from this iframe Impact Clickjacking lead to remove reviews...
Mail.ru: Access to git & and configuration files on backtoschool.geekbrains.ru via gitfile
Leaking sensitive application data in configuration files at backtoschool.geekbrains.ru...
Internet Bug Bounty: CVE-2017-13041 The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().
Description: Versions of tcpdump before 4.9.2 are vulnerable to a buffer over-read in print-icmp6.c. This vulnerability was disclosed to the tcpdump maintainers and was recently patched in version 4.9.2 and disclosed as CVE-2017-13041. Patch:...
Internet Bug Bounty: CVE-2017-13040 The MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions.
Description: Versions of tcpdump before 4.9.2 are vulnerable to a buffer over-read in print-mptcp.c. This vulnerability was disclosed to the tcpdump maintainers and was recently patched in version 4.9.2 and disclosed as CVE-2017-13040. Patch:...
Shopify: XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.com
Hello team, I found unrestricted file upload via avatar in https://accounts.shopify.com/accounts/, and XSS Stored in PNG IDAT chunks using exiftool , exiftool command exiftool -Comment=""alertprompt'XSS BY ZEROX4'" xsscommentexifmetadatadoublequote.png Payload example : �PNG �...
TikTok: Bypass SMS verification to delete TikTok account
Improper authorization could potentially allow an attacker to bypass SMS verification and delete a TikTok account. This attack would first require the account to be compromised. A fix has been implemented to resolve this issue. We thank @luizviana for reporting this to our team and confirming the...
Kartpay: Admin/Info lekage
The Administrator System was opened in public which can be misused by anyone so to avoid a Security system has been implemented to allow from limited Ip address only...
Mail.ru: Stored Xss
Stored XSS in comment functionality on profile.my.games and community.my.games...
Azbuka Vkusa: IDOR - Other user's delivery address disclosed
Closed...
Dropcontact: Information Disclosure through DEBUG at Subscription [https://app.dropcontact.io/app/subscription?connector=salesforce](CRITICAL)
We were displaying some sytem information in case of app crashing...
GitHub Security Lab: [javascript] CWE-117: CodeQL query to detect Log Injection
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Java: CWE-522 Insecure basic authentication
This bug was reported directly to GitHub Security Lab...
Dropcontact: Django should not have debug mode enabled
We were displaying sensitive information...
Endless Group: XSS on https://fax.pbx.itsendless.org/ (CVE-2017-18024)
Summary: Hello Endless Hosting, I found an XSS on https://fax.pbx.itsendless.org/ . This domain running an AvantFax software 3.3.6 However, the exploit of CVE-2017-18024 for version 3.3.3 is working on that version. Here is the exploit code of CVE-2017-18024 history.pushState'', '', '/'...
Basecamp: Premium Email Address Check Bypass - Hey
Hello, I reported a bug to [email protected] a couple weeks ago, not realizing that I was a member of the private bug bounty program. It was fixed quickly Less than 1 hour which was awesome to see. Being that this was reported through a seperate channel, and it is for Hey, I'm not even sure it woul...
Dropcontact: Registering with email [ +70 Chars ] Lead to Disclose some informations [Django Debug Mode ]
We were displaying / leaking sytems information in case of app crash...
Dropcontact: User registration using public domain email like gmail in place of professional email.
Like sais in the title, we were only checking and restricting professional email in frontend, which led to being able to register with an email which is not pro because we were not checking this info in the backend. User was able to register with public domain email like gmail by response...
Dropcontact: Django DEBUG mode enabled and leaked system information.
We were leaking / showing system information. Django DEBUG mode was enabled and showing some information on some errors.I just follow the errors and finally got some sensitive system information such as configuation ,API keys ,Database users ,System Directories,etc...
Acronis: mysql credentials exposed on - https://cz.acronis.com/docker-compose.yml
Hi, there are some MySQL credentials exposed on https://cz.acronis.com/docker-compose.yml It is not that you are gonna avoid a compromise with that user/password pair, but just in case you don't wanna make it even easier publishing the credentials to the wild x Impact MySQL credentials exposed...
Yelp: Email flooding using user invitation feature in biz.yelp.com due to lack of rate limiting
Summary: Hello everyone, The feature to invite users to manage your business has no rate limiting or captcha implemented. Therefore, a malicious user can use this to mail bomb any email's inbox with invitation requests. Platforms Affected: biz.yelp.com Steps To Reproduce: This is a pretty straigh...
Dropcontact: Sensitive Information Disclosure
we were displaying sensitive information. While testing the site i was able to disclose sensitive information such as username, passwords, api keys, etc due to DEBUG = True .This bug arose due to default configuration at the backend. Now the bug is fixed. Thanks to the team for the quick fix!...
Dropcontact: Dropcontact's disclosed report is exposing Private/Confidential information
Some other report was disclosed fully with confidential information !...