Brave Software: Arbitrary file download via "Save .torrent file" option can lead to Client RCE and XSS

Summary: An attacker can use the "Save .torrent file" option in WebTorrent to smuggle malicious files onto the client's machine. Description Brave allows users to download the ".torrent" via WebTorrent. WebTorrent decides whether a file is torrent or not based on the following headers...

Acronis: Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - tibxread.exe utility

Vulnerability description not provided...

Dropcontact: No Valid SPF Records

Hiii, There is any issue No valid SPF Records Desciprition : There is a email spoofing vulnerability.Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source. Email spoofing is a tactic used in phishing...

U.S. Dept Of Defense: Read-only path traversal (CVE-2020-3452) at https://██████.mil

Summary: I discovered a vulnerability Read-only path traversal CVE-2020-3452 at https://██████████.mil Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remot...

Rocket.Chat: Session Hijack via Self-XSS

Summary: It's possible to hijack a session by tricking the user to perform a Self-XSS on the drag and drop functionality in the chat. Description: Self-XSS is an underrated vulnerability that can have a harmful impact on the users of the application like here, after we get access to the user's...

Shopify: Stocky App Administrator can create a backdoor admin account by using an existing POS User

Details The Stocky App has POS Users that are being created once a POS Staff logs in into the application from the Point Of Sale application on a mobile device. From the users management page located at https://stocky.shopifyapps.com/users there's no visible way to edit those POS users. Although,...

Acronis: SQL Injection in agent-manager

1.https://mc-beta-cloud.acronis.com/api/agentmanager/v2/unitconfigurations?name=update-schedule&nodata=false&tenantid=1590228&unit=atp-agent%27and%2F%2A%2A%2Fextractvalue%281%2Cconcat%28char%28126%29%2C%28select+database%28%29%29%29%29and%27...

Mail.ru: CVE-2016-6415 on api-staging.plazius.ru [46.148.201.218]

Unpatched CVE-2016-6415 vulnerability could potentially lead to information disclosure on the host in plazius.ru infrastructure...

Solana BBP: Heap memory can be accessible through metrics.solana.com

Summary: Heap memory can be accessable due to misconfiguration in one of the sub-domains. While doing recon i ended up downloading heap memory file. Steps To Reproduce: 1.Open https://metrics.solana.com:8086/debug/pprof/heap 2. now you can see heap memory accessible through it Supporting...

Solana BBP: Buffer can be readable through Debug on metrics.solana.com

Summary: Buffer memory can be readable due to debug mode enable in one of the sub-domains. t Steps To Reproduce: 1.Open https://metrics.solana.com:8086/debug/pprof/goroutine?debug=1 2. Here you can also brute force the endpoint. Supporting Material/References: F955888 Impact Buffer over-reads can...

U.S. Dept Of Defense: Elmah.axd is publicly accessible and leaking Error Log for ROOT on █████_PRD_WEB1 █████████elmah.axd

Description: Hello, Security team, hope you are doing well. I found out that elmah.axd is publicly accessible on ████████ which is leaking error log which contain cookies and server code etc. Step-by-step Reproduction Instructions 1. Go to ██████elmah.axd and you will see the error logs. 2. Same...

Hyperledger: The “payload” Field of Transactions in a Block Reveals the Private Data to All Peers

To whom it may concern, We are a research group conducting research on Hyperledger Fabric 2.0. We find a design flaw about the “payload” field of transactions, which can reveal the Private Data to all peers in one channel. When a client invokes a function to read the private data, the is stored i...

GitLab: Revoked User can still view the Merge Request created by him via API

Summary In Gitlab when a user is demoted to Guest role, the Guest user will not be able to view and edit the Merge requests in a project even if the merge request is created by him. But this check is not implemented in API so the Guest user will be able to the following actions for the Merge...

GitLab: Unauthorized user is able to access schedule pipeline variables and values

Summary The feature allows to add or overwrite variables that are passed to jobs in order to modify the behavior just for that specific instance. As per this https://gitlab.com/gitlab-org/gitlab-foss/-/issues/32568note32531510 , the current security model is If you are owner of schedule as...

Dropcontact: API key is not validated for C.R.M integration [Pipedrive] of LOGGED IN USER, A user can use another USER'S API key for this operation.

We didn't verified the API key when a new user was using his pipedrive free trial, so someone could take a key of another pipedrive which don't belong to him and make his free trial on this api key. Or launch a free trial on a pipedrive already connected to pipedrive...

U.S. Dept Of Defense: Remote Code Execution on █████████

Summary: An unauth solr lead to RCE on ██████████ Description: Hello, I found a solr unauth at https://██████/solr/ This version is 5.5.1, vulnerable with CVE-2019-0192 and CVE-2019-0193, i have try CVE-2019-0193 and successful RCE. Impact Attacker can get shell on server. Step-by-step Reproducti...

Nextcloud: Denial of Service when entring an Array in email at seetings

in settings https://demo2.nextcloud.com/index.php/settings/users/TweLbFT93aqRnEfF/settings when you submit the request with email value Array the server return 500 Internal Server Error Poc video: F954435 Impact denial a service attack on the server. This may lead to the website becoming slow or...

Shopify: Ability to see password protected content by bypassing the password page of shopify preview URL for new development stores (as of August 17, 2020)

Hi, Description I have found a way to bypass the password page of a shopify preview URL for new development stores created as of August 17, 2020. Currenty, with older development stores, when we share a preview url with someone, we are able to see the content of the store without having to enter ...

HackerOne: Recently added 'Country' field doesn't send email notification when changed

Summary: Hi team, This is a small bug report. Actually I think there is no important security issue but I wanted to report it ¯\ツ/¯ If you change your 'Country' information on account settings, HackerOne doesn't send Your profile was recently changed email. Description: There is an email...

Acronis: CSRF and XSS on www.acronis.com

Vulnerability description not provided...

X (Formerly Twitter): Twitter Media Studio Source Information Disclosure With Analyst Role

== Steps == 1. With "A" account go to "https://studio.twitter.com/accountmanagement/youraccountnumberhere/accountusers" and Add account "B" as analyst. 2. Now, With "B" account go to "https://studio.twitter.com/" and switch to "A" account. Then go to "https://studio.twitter.com/producer" and you...

Mail.ru: Bitbucket public repo leaking credentials from the 1C Enterprise system used by Samokat

Application configuration data related to Samokat project was leaked on github.com...

Acronis: XSS in (Support Requests) : User Cases

Stored XSS was possible on https://www.acronis.com/en-us/my/cases/index.html via support case sent to https://support.acronis.com...

Solana BBP: i don't the important and it's impact . the affected asset: https://github.com/solana-labs/solana/blob/master/.buildkite/env/secrets.ejson

Summary: add summary of the vulnerability Steps To Reproduce: add details for how we can reproduce the issue 1.i have browsed this source code of github: https://github.com/solana-labs/solana/tree/master/sdk 2. i have browsed the files and i found the file which called buildkite/env/secrets.ejson...

Solana BBP: Sensitive data leaks [username, password, keys]

Summary: Hello team, This bug shows some critical asset like secret username, password, keys, etc. publicly on githubq Steps To Reproduce: Please visit the url below 1. https://github.com/solana-labs/solana/blob/e310bad7ab09a4a5bd23314983bffa1707506230/.buildkite/env/secrets.ejson 2...

Solana BBP: i don't the important and it's impact . the affected asset : https://github.com/solana-labs/solana/blob/master/.buildkite/env/secrets.ejson

Summary: add summary of the vulnerability Steps To Reproduce: add details for how we can reproduce the issue 1. i have browsed this source code of github: https://github.com/solana-labs/solana/tree/master/programs 1. i have browsed the files and i found the file which called...

Acronis: Stored XSS in backup scanning plan name

Dear Acronis Security Team, Summary: There is a possibility of storing an XSS on the https://mc-beta-cloud.acronis.com/ui/ console. Steps To Reproduce: 1. Login to the console with the given account 2. Go to "Backup Scanning" under "PLANS" 3. Click on "Create Plan" 4. Specify the location of the...

Dropbox: User has Sender permission can Get Team information

A security researcher was able to leverage a user with a sender role to view all team information by issuing a crafted POST request to portal.helloworks.com/editteam which provided information disclosure team's primary contact, whereas accessing the URL is forbidden based on the sender role. The...

InnoGames: Cache Poisoning via uppercase letters in invalid path

Summary of the issue Cache poisoning vulnerability appears in the request to innogames.com. The issue arises when language path parameter from the url gets processed on the backend to become lowercase. Then if a path provided in X-Forwarded-Host does not exist on the server, 301 response is...

U.S. Dept Of Defense: CVE-2020-3187 - Unauthenticated Arbitrary File Deletion

Summary: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a...

GitLab: Insufficient Type Check leading to Developer ability to delete Project, Repository, Group, ...

Summary Similar bug to 858671, but this time with annotations mutation: DeleteAnnotation in app/graphql/mutations/metrics/dashboard/annotations/base.rb ruby module Mutations module Metrics module Dashboard module Annotations class Base " clientMutationId 3. Project disappear along with Repository...

U.S. Dept Of Defense: Read-only path traversal (CVE-2020-3452) at https://█████

Summary: I discovered a vulnerability Read-only path traversal CVE-2020-3452 at https://███████ Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote...

Node.js third-party modules: [supermixer] Prototype pollution

I would like to report a Prototype pollution in supermixer, It allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation. Module module name: supermixer version: 1.0.3 npm page: https://www.npmjs.com/package/supermixer Module Descriptio...

Visma Public: Information disclosure to "Permission as auditor" user

Inside the same company, the researcher was able to view information that that was not supposed to with the Auditor role associated with the user...

Acronis: Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine Service

Vulnerability description not provided...

Dropcontact: Idor for firstpromoter service

An IDOR has been detected on firstpromoter service...

U.S. Dept Of Defense: Read-only path traversal (CVE-2020-3452) at https://████████

Summary: I discovered a vulnerability Read-only path traversal CVE-2020-3452 at https://████████ Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote...

Acronis: Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - systeminfo.exe utility

Vulnerability description not provided...

Mail.ru: В самокат имеется возможность просмотра суммы заказа и номера заказа по ID [smart.space]

IDOR in smart.space API allowed to list number and amount of order without attribution to user...

U.S. Dept Of Defense: ███ is vulnerable to CVE-2020-3452 Read-Only Path Traversal Vulnerability

Summary: ████████ is vulnerable to Read-Only Path Traversal Vulnerability as described at https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86 Description: Get request parameters at the /+CSCOT+/translation-table and the /+CSCOT+/oem-customization...

Acronis: TrueImage for Acronis True Image 2020 - Untrusted DLL Search-Ordering lead to Privilege Escalation as Administrative account

Vulnerability description not provided...

Azbuka Vkusa: Open redirect (DOM-based) on av.ru via "return_url" parameter (Login form)

Closed...

Mail.ru: Возможность просмотра коментариев к чужим обращениям [corporate.city-mobil.ru]

IDOR vulnerability in corporate.city-mobil.ru interface allowed to access a feedback comments of a different users...

BugPoC: Users can Change their Own Email Address

BugPoC uses AWS Cognito for authentication and user pool management. @vasi42 noticed that they were able to use the Cognito API, UpdateUserAttributes, to update their own email address. Calling this API without subsequently calling the VerifyUserAttribute API puts your account into an unverified...

Acronis: Cross Origin Resource Sharing Misconfiguration

Description :- Cross-Origin Resource Sharing CORS is a mechanism that uses additional HTTP headers to tell browsers to give a web application running at one origin, access to selected resources from a different origin. The CORS mechanism supports secure cross-origin requests and data transfers...

Azbuka Vkusa: Corporate Jira credentials disclosed in public gist

Closed...

HackerOne: Pentester can obtain information about other pentesters who applied for the same test, but weren't accepted

Hi team, I don't know your policy about pentestersabout their visibility on the platform, But I couldn't find any other pentesters before. 1 For example: GraphQL has the h1pentester attribute that would explicitly point us to the pentester, but if we make a query, it doesn't reveal the pentester ...

Mail.ru: HTTP request smuggling (?) canpol.deti.mail.ru

HTTP request smuggling in canpol.deti.mail.ru led to possibility for non-blind SSRF exploitation with access to serverside api...

New Relic: Adding your account to victim's app via deeplink

At your android app, there is a feature for passwordless login. It sends an email and if you click the link, it triggers a deeplink on the app for login. I think this feature needs a state control, for example setting loginstatetoken=ABC on the requester device and adding this loginstatetoken to...

New Relic: Sending thousands of notifications with single request

Hello, while testing your mobile api an endpoint got my attention. This endpoint was: https://api.newrelic.com/api/ios/v3/devices/update.json?operation=register I immediately checked if server is validating the integrity of data or not. After finding out there is no validation, I added around 500...