Automattic: IDOR when moving contents at CrowdSignal

Summary: Hi team, You can move your contents via Move to button at https://app.crowdsignal.com/dashboard And when you click to Move to My Content you will send a POST request to /dashboard like that : F893407 actionable parameter's value is the content's ID. And if you change this ID to victim's...

Automattic: IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignal

Summary: Hi team, If you click Edit button on any user of your team at https://app.crowdsignal.com/users/list-users.php, you will send a GET request to https://app.crowdsignal.com/users/invite-user.php?id=userid&popup=1 In this endpoint, id parameter is vulnerable for IDOR. When you change the us...

Automattic: No Email Checking at Invitation Confirmation Link leads to Account Takeover without User Interaction at CrowdSignal

Summary: Hi team, When you have a team account, you can invite users to your team from https://app.crowdsignal.com/users/list-users.php If you invite a user, you will see this : F893386 As you can see, there is confirmation link and we can see it from our dashboard. And if you invite existing ema...

U.S. Dept Of Defense: Stored XSS via Comment Form at ████████

Summary: An attacker can submit a comment form with injected HTML, leading to a number of malicious effects Step-by-step Reproduction Instructions 1. Browse to https://████ 2. Complete the form. I placed " in the Name field. Some example payloads for the Comments field are as follows: For...

Mail.ru: Improper Restriction of Excessive Authentication Attempts at https://mirror.w1.dwar.ru/login.php

Password at dwar.ru was not sufficiently protected against bruteforce...

Engel & Völkers Technology GmbH: XXE on www.publish.engelvoelkers.com

Summary: A XML External Entities vulnerability has been found on www.publish.engelvoelkers.com:8443. Initially a GET request was made to /dp/services and that returned a 500 Error with some XML data. Changing the HTTP request method to POST with some XML data produced a different response, so it...

Engel & Völkers Technology GmbH: Information disclosure via Spring Boot Actuators on gonext-stage.engelvoelkers.com

Summary: The Spring Boot Actuators are exposing critical information on gonext-stage.engelvoelkers.com such as the last 100 HTTP requests made to the server including cookies, paths, etc and the environment configuration. The endpoints are the following: - /trace - /env - /mappings - /configprops...

Mail.ru: Открытая админка Tarantool

Testing installation of internal Tarantool admin inteface without actual users data was available from external network...

Engel & Völkers Technology GmbH: SQL Injection at /displayPDF.php (printshop.engelvoelkers.com)

Intro An SQL injection has been identified. Through this vulnerability an attacker could execute arbitrary SQL statements compromising the integrity of the database and obtain sensitive information, violating the confidentiality of the data. Given the great impact of the vulnerability and...

Engel & Völkers Technology GmbH: Remote Code Execution (RCE) at "juid" parameter in /get_zip.php (printshop.engelvoelkers.com)

Summary Taking advantage of the vulnerability reported in 914194, it has been possible to analyze certain application code and detect remote code execution at https://printshop.engelvoelkers.com/getzip.php?juid=1 due to a lack of sanitization of the inputs received by the web application. This...

Palo Alto Software: IDOR on notes to HTML injection

Summary: Team member with role USER can change notes of any users and also we able to inject some html tags Steps To Reproduce: 1. Login in with role owner create note 1. login team member with role users 1. add note and capture with burp suite and change the uuid of notes PUT...

Mail.ru: Stored self XSS at auto.mail.ru using add_review functionality

Stored self-XSS in auto.mail.ru review functionality...

WordPress: CSRF on comment post

Hi Wordpress, I just found an CSRF on comment post. It allow attacker make victim comments on a post. Steps To Reproduce: Attacker send to victim a link with content below: history.pushState'', '', '/' Video poc: F891759 Impact Attacker make victim comments on a post...

Engel & Völkers Technology GmbH: Publicly accessible .SVN repository allows downloading entire source code

Summary of the Issue The researcher found a publicly accessible SVN repository at https://printshop.engelvoelkers.com/.svn/wc.db Steps to reproduce Go to https://printshop.engelvoelkers.com/.svn/wc.db Impact statement Information disclosure...

U.S. Dept Of Defense: Remote Code Execution via CVE-2019-18935

Summary: The website at https://█████████/apps/XTRAHome/Telerik.Web.UI.WebResource.axd?type=rau is vulnerable to CVE-2017-11317 and CVE-2019-18935, allowing an attacker to upload arbitrary files and gain remote code execution on the underlying system. Step-by-step Reproduction Instructions 1...

Bitwarden: Server-Side Request Forgery in "icons.bitwarden.net"

As, I already checked with support team via portal, due to domain confirmation I checked with them. Here, adding the required information: Title: Server-Side Request Forgery in "icons.bitwarden.net". URL: https://icons.bitwarden.net/spoofed.burpcollaborator.net/icon.png Parameter: REST based in...

SMTP2GO: Stored XSS at https://app.smtp2go.com/settings/users/

Vulnerability : A. Type:- Cross Site Scripting Stored B. Description:- Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Summary : When you will create a particular user...

Lark Technologies: Messages disclosure via search feature of other users group(Cross-Tenant).

Due to a Insecure Direct Object Reference IDOR vulnerability identified within the message search function of Lark, an attacker could have potentially viewed messages, docs, and attachments shared in other users groups. We thank @base64 for reporting this to our team and verifying the resolution...

Clario: No rate Limit on Licenses Activation

Introduction A little bit about Rate Limit A rate-limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given time-frame, HTTP-Servers can respond with status code 429...

Shopify: increased privileges on staff account

staff on partners without a store management permit can have access to the collaboration shop steps for reproduction 1. Invite staff to partners without store management permission 2. accept the invitation and the staff has become a member of the partner 3. On the staff account, try to access the...

Snapchat: Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.io

Researcher found valid jFrog credentials which were committed to a public Github repository of a Snap employee. This allowed access to internal Snap libraries/artifacts along with the ability to push updates to existing artifacts as well...

Visma Public: Reverse Tabnabbing in printing source document images

The security researcher was able to find a Reverse Tabnabbing bug in printing source document images functionality. This bug allows to replace current web page in users browser with a phishing one, facilitating phishing attacks...

Hiro: blockstack.org - is vulnerable to (CVE-2016-2183, CVE-2016-6329)

Descriptions Cryptographic protocols like TLS, SSH, IPsec, and OpenVPN commonly use block cipher algorithms, such as AES, Triple-DES, and Blowfish, to encrypt data between clients and servers. To use such algorithms, the data is broken into fixed-length chunks, called blocks, and each block is...

Showmax: [stories.showmax.com] Cross Origin Misconfiguration - Sensitive Information Exposure

The hacker reported user enumaration on https://stories.showmax.com/wp-json/wp/v2/users/ and CORS. The user enumeration didn't disclose any sensitive information except usernames which are not problematic because we have 2FA login in place and the usernames could be obtained even from standard...

DuckDuckGo: XSS on Videos IA

Failure found in the videos tab. A user was created on a website https://rutube.ru/video/83a4775f020b3fd68efd3dc9a73031e8/ one with the tag " . When we search DuckDuckGo for the video or user tag, we find a xss flaw in page...

Mail.ru: Mail.ru for Android - Theft of sensitive data

Symlink vulnerability in sharing activity allowed to access internal application files in Mail.Ru Mail for Android...

Shopify: Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation

Hello Shopify, I have found a bug by which I can verify any email on .myshopify.com, the bug is very strange but it works. Also I can take over the accounts but only the ones which do not have SSO. To reproduce please follow the steps exactly as I written otherwise you will not be able to reprodu...

Node.js third-party modules: property-expr - Prototype pollution

I would like to report Prototype pollution in property-expr It allows attacker to modify the prototype of a base object. Module module name: property-expr version: 2.0.2 npm page: https://www.npmjs.com/package/property-expr Module Description Tiny property path utilities, including path parsing a...

TikTok: Rate limiting on report video

Rate limiting was not in place for the "report video" option on TikTok web. We thank @alertjd for reporting this to our team...

Shopify: Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT

Using the Shopify ping application a user can communicate with the kit. The kit is an application that creates tasks based on the information supplied through the Shopify ping app by a user. With a few quick messages to Kit using Shopify Ping, a user can create a discount code and promote it, sta...

Node.js third-party modules: [is-my-json-valid] ReDoS via 'style' format

I would like to report a ReDoS in is-my-json-valid It allows cause a denial of service if schema uses the built-in style format. Module module name: is-my-json-valid version: 2.20.1 npm page: https://www.npmjs.com/package/is-my-json-valid Module Description A JSONSchema validator that uses code...

Engel & Völkers Technology GmbH: reflected xss in ██████

Summary: your subdomain : ██████ suffer from reflected xss bug that leads to execute javascript codes into browser Steps To Reproduce: add details for how we can reproduce the issue 1. visit : █████ 2. you will see popup and xss confirmed Supporting Material/References: █████ Impact An attacker c...

GitHub Security Lab: Golang : Add MongoDb NoSQL injection sinks

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java : CWE-548 - J2EE server directory listing enabled

This bug was reported directly to GitHub Security Lab...

Mail.ru: Log files Leaked In mcsblog.ru

Server log files were available via web interface...

Glassdoor: wasResumeUsed ███ on /api-internal/api.htm endpoint leaking other user's resume usage status

The API endpoint that checks if a resume was used for previous job applications was found to be vulnerable. The endpoint accepted a parameter called "resumeMetadataId" which was not properly validated, allowing an attacker to check the usage status of resumes that did not belong to the user. This...

Open-Xchange: Null dereference or redundant null check in `mail_crypt_load_global_private_key` for plugin mail-crypt

In this function, we check once if errorr is not NULL in if enctype == DCRYPTKEYENCRYPTIONTYPEPASSWORD / Fail here if password is not set since openssl will prompt for it otherwise / if keypassword == NULL if errorr != NULL errorr = tstrdupprintf"%s: %s unset, no " "password to decrypt the key",...

Kubernetes: Private IP addresses Disclosure

The following URL leaks the Private IP Addresses:- kubernetes.io/feed.xml The following Server’s Cluster RFC 1918 IP addresses were disclosed in the response: • 10.1.2.3 • 10.104.207.136 • 10.224.0.0 • 10.250.0.0 • 10.250.112.0 • 10.250.96.0 • 10.55.252.216 • 10.96.0.0 • 10.96.0.1 • 10.96.15.180 ...

Mail.ru: [ICQ] nwwwstg-d01.ops.icq.com check mk agent exposed to public

System information disclose on nwwwstg-d01.ops.icq.com...

Acronis: Acronis True Image Local Privilege Escalation via insecure folder permissions

Note: This has been submitted via service desk earlier, and I got a call from Acronis customer service that it's up on H1 and I should submit it there as well. All of the Acronis LaunchDaemons except the price helper which can be found here: /Library/LaunchDaemons/com.acronis. start an app / scri...

Mail.ru: HTML/iframe/XSS injection on https://www.ucs.ru/online/shelter/settings/check/

Potential XSS via POST parameters in www.ucs.ru...

Mail.ru: Blind SSRF in magnum upgrade_params

Method for magnum cluster creation accepted arbitrary values for container hostname leading to SSRF possibility to internal services in Mail.ru Cloud Computing service...

8x8: PHPinfo page on http://█████.callstats.io

PHPInfo file was exposed on legacy system. phpinfo was available at callstats.io subdomain. It disclosing information on a server and PHP version information...

Node.js third-party modules: [meemo-app] Denial of Service via LDAP Injection

I would like to report Denial of service via LDAP Injection vulnerability in meemo-app module. It allows a malicious attacker to send a crafted input that is interpreted as an LDAP filter, leading to Denial of Service. Module module name: meemo-app version: 1.9.2 npm page:...

Node.js third-party modules: [cloudron-surfer] Denial of Service via LDAP Injection

I would like to report Denial of service via LDAP Injection vulnerability in cloudron-surfer module. It allows a malicious attacker to send a malformed input that is interpreted as an LDAP filter, leading to Denial of Service. Module module name: cloudron-surfer version: 5.9.0 npm page:...

IRCCloud: IDOR with Geolocation data not stripped from images

Vulnerable URL :- https://usercontent.irccloud-cdn.com/file/0wXMTrPu/hgjbk Vulnerability Discription: When an image is taken using a smartphone or camera certain metadata fields are often attached to it. These fields could include the model of the camera, the time it was taken, whether the flash...

Mail.ru: SSRF in www.ucs.ru

Blind SSRF in www.ucs.ru...

Acronis: Account Takeover on unverified emails in File Sync & Share

Summary The name change functionality in File Sync & Share is expected to change the name in File Sync & Share. But the API endpoint used in it also allows changing email to any email without having to verify the email. The login email stays the same but the email within File Sync & Share...

X (Formerly Twitter): Android WebViews in Twitter app are vulnerable to UXSS due to configuration and CVE-2020-6506

Summary: CVSS score: 8.1 / High / CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Embargo notice: Do Not Disclose publicly until https://crbug.com/1083819 is disclosed. Twitter for Android is affected by a UXSS vulnerability due to its configuration of Android WebView and CVE-2020-6506. Vendor...

Visma Public: Improper access control allows sales only user to view bank balance of company accounts.

The researcher has found an access control issue that allowed a sales only user to view the bank balance of company accounts. This details should not be visible for missing permissions users...