15404 matches found
GitHub Security Lab: [Java] CWE-939 - Address improper URL authorization
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CPP: Missing/incomplete TLS server certificate hostname validation
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CodeQL query to detect open Spring Boot actuator endpoints
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: gagliardetto: Query to detect incorrect conversion between numeric types
This bug was reported directly to GitHub Security Lab...
h1-ctf: [H1-2006 2020] Solution for the h1-2006 CTF challenge
Hi, The flag is ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$. I didn't know I can send it prior to the report until I saw some disclosed solutions from the previous challenges. The report will follow later today. Regards @thehackerish Impact Multiple vulnerabilities on .bountypay.h1ctf.com allow ...
Open-Xchange: Null pointer deference in call to `mail_get_flags`
run test suite on following input require "vnd.dovecot.testsuite"; require "fileinto"; require "imap4flags"; require "mailbox"; testset "message" text: Subject: Test message. Test message. . ; test "Flag changes between stores" fileinto :create "FolderA"; if not testresultexecute testfail "failed...
Open-Xchange: null dereference in `sieve_address_do_validate` (or redundant null check)
Function sieveaddressdovalidate in file sieve-address.c does dereference errorr if address == NULL errorr = "null address"; return FALSE; and then later checks for it being NULL : if errorr != NULL errorr = strcctx.error; So either, there is a first null check missing Or the later ones are...
Open-Xchange: Panic in file smtp-address.c: line 684 (smtp_address_write): assertion failed: (smtp_char_is_qpair(*p))
Reproducer is running test suite against file crash2.txt and getting following output : ./src/testsuite/testsuite crash2.txt Test case: crash2.txt: testsuitecatena: Panic: file smtp-address.c: line 684 smtpaddresswrite: assertion failed: smtpcharisqpairp Abort trap: 6 Content or crash2.txt is...
Open-Xchange: Panic: Input stream data unexpectedly has references
Run test suite binary on following input ./testsuite crash.txt with crash.txt file being : require "vnd.dovecot.testsuite"; require "variables"; require "editheader"; set "message" text: From: [email protected] To: [email protected] Subject: Frop! Frop! . ; testset "message" "$message"; test...
QIWI: PIN OK attack
PIN OK attack is an attack when a wedge-device created for MiTM is used to substitute the response from the card during an offline-PIN check and say that PIN was correct. Reproduction steps: An attacker with a stolen card without the correct PIN knowledge can use either a so-called wedge device f...
h1-ctf: [H1-2006 2020] CTF write-up
Hello, thank you for the awesome CTF! I definetly learned a lot. For now I will submit just the Flag. I am going to follow up with the Writeup as soon as possible. ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ Kind regards, Alex - hackingfish Attached: A screenshot of the site which is showing the...
Mail.ru: Sidekiq Dashboard Publicly accessible at http://shopper.staging.instamart.ru/sidekiq/
Sideqiq dashboard was externally available on the http://shopper.staging.instamart.ru/ server in staging testing environment...
Engel & Völkers Technology GmbH: Information disclosure at https://printshop.engelvoelkers.com/packages/.bash_history
Hello! I found .bashhistory in the home directory and this file was accessible through the web screenshot in attachment. This file exposes sensitive information history commands, directories, software version that could help a malicious user to prepare more advanced attacks. POC:...
h1-ctf: [H1-2006 2020] "Swiss Cheese" design style leads to helping Mårten Mickos pay poor hackers
Summary: Several vulnerabilities in the bountypay application leads to unauthorised access, information disclosure, SSRF and other fun stuff. Steps To Reproduce: This is how I helped Mårten Mickos pay the poor hackers who had been waiting so long for their bounties. First part: Web I started by...
Mail.ru: lenta_proxy information disclosure
Sensitive application configuration data disclose on lenta.proxy.instamart.ru...
Lark Technologies: Sub-Dept User Can Add User's To Main Department.
A vulnerability was found where users with permissions to manage the user section can add others outside of their department by changing the value of "departmentid" to an empty value. We thank @imrannisar for reporting this to our team...
h1-ctf: [H1-2006 2020] Multiple vulnerabilities lead to CEO account takeover and paid bounties
Summary: 1. A publicly accessible logfile discloses a user's credentials 2. Weak 2FA implementation allows user account takeover 3. Path injection in user's cookie allows SSRF, bypassing the IP restriction to list available builds on https://software.bountypay.h1ctf.com/ 4. API token leak in...
h1-ctf: [H1-2006 2020] Connecting the dots to send hackers their Bug Bounty
Hello team Thank you so much for organising the ctf it has helped a lot to learn and improve my knowledge now lets got to solution i have preapred short videos as a refrence for each part and broken down ctf in 8 challenges. So the ctf was broken into: 1. Gathering leaking to gain login credentia...
Mail.ru: [account.mail.ru] XSS-уязвимость в форме авторизации
User-assisted XSS in account.mail.ru due to unsafe usage of GET parameter Думаю, что данная XSS'шка является отличным примером того, что фильтрация HTML-символов во входных данных не всегда достаточная мера защиты. Если будем раскрывать уязвимость, то вот более удачная демонстрация, без моих куко...
Nextcloud: Allows any user to share their "Root" level folder by sharing "."
There seems to be a bug in the "File to Share" feature of Nextcloud Talk. This allows any authenticated user/admin to share their "root" level folder by manipulating the "path": parameter in the JSON body request to the remote API /nextcloud/ocs/v2.php/apps/filessharing/api/v1/shares Steps to rep...
h1-ctf: [H1-2006 2020] 36 hours of brain cycles utilized on solving a neat puzzle
Here we go: F852423 Recon: The given scope is: .bountypay.h1ctf.com Found subdomains: bountypay.h1ctf.com api.bountypay.h1ctf.com app.bountypay.h1ctf.com software.bountypay.h1ctf.com staff.bountypay.h1ctf.com www.bountypay.h1ctf.com Relevant GitHub repository:...
h1-ctf: [H1-2006 2020] The Story of Making Bounty Hunters Happy
Disclaimer: I will try to make this post a fun read, given that whoever triagges will be probably going through similar write-ups again and again. The beginning: Being away from HackerOne over a month had made me rusty. Although the call to arms for Mr. Mickos and the community could not be left...
h1-ctf: [H1-2006 2020] CTF Writeup!
The Beginning ===================== The scope of the H1-2006 CTF was .bountypay.h1ctf.com. After opening https://bountypay.h1ctf.com, I noticed that on the top left of the screen there was a dropdown with two login pages: one for Customers https://app.bountypay.h1ctf.com/ and one for Staff...
Zivver: Bypassing Rate limit for forgot password by using different ip addresses
This report describes a valid issue in the rate limiter configuration for the "forgot password" endpoint, in which only the authenticating user's IP address was used as a discriminator. This was resolved by limiting requests based on multiple discriminators including the target account and...
Nextcloud: Re-Sharing allows increase of privileges
User A shares a file/folder to user B with re-sharing permission, but readonly - User B shares this file/folder to User C Needs the shareapidefaultpermissions set to 1 all checkmarks off in admin panel - User B can add write permissions for the share to User C User C may also be anonymous using a...
curl: Poll loop/hang on incomplete HTTP header
Summary: When an incomplete server header is missing its value, the curl client will receive the packet but hang while parsing it. Examples of vulnerable server headers: Location, Content-Range and Connection. Adding the --max-timeoption will terminate the request as intended. Steps To Reproduce:...
Urban Dictionary: DOM XSS through ads
Multiple ads hosted on www.urbandictionary.com make the www.urbandictionary.com origin vulnerable to DOM XSS. Attached is an image of alertdocument.domain executing. The injection works in Firefox and Chrome. Visiting the following URL will probably cause an alert box displaying the document.doma...
Internet Bug Bounty: [CVE-2020-10543] Buffer overflow caused by a crafted regular expression
CVE ID: CVE-2020-10543 See: + https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod + https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod Impact Potential RCE...
h1-ctf: [H1-2006 2020] CTF Writeup
F851692 ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ I'll try to have the writeup ready in the following days here: https://hipotermia.pw/bb/h1-2006-ctf-solution It will be password protected and I will post a comment here when it is ready. Thanks for this CTF, I really enjoyed it! Impact -...
HackerOne: SAML Response Reuse on hackerone.com/users/saml/auth
Summary: When logging in with SAML, the user's IDP authenticates the user and generates a SAML response. The IDP then redirects the user's browser back to HackerOne to submit the SAML response. Upon receiving the SAML response, HackerOne validates it, sets a session cookie in the user's browser,...
Mail.ru: Private file read through file attachment
my.com MyMail application for Android could be tricked by malicious local application selected as a file picker by user to copy the file from application folder to insecure location...
Helium: Read-Only user can delete users
hello this endpoint DELETE /api/invitations/0ff7e9f9-877a-40cc-b99f-f6b3b1bea3f8 vulnerable to Insecure Direct Object Reference Steps to reproduce the bug Let's assume that three accounts exist: [email protected] role Administrator [email protected] role Read-Only [email protected] invited user...
Mail.ru: mail.ru/touch xss(r) debug parameter
Reflected XSS in touch version of mail.ru via GET parameter debug...
GitHub Security Lab: Add check for disabled HTTPOnly setting in Tomcat
This bug was reported directly to GitHub Security Lab...
h1-ctf: [H1-2006 2020] [Multiple Vulnerability] CTF Writeup - @abdilahrf_
As there is a private invite for the first 10 solver, i send only the flag now F851115 will complete my writeup on the next comment. Impact Controlling martenmickos account...
h1-ctf: [H1-2006 2020] ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$
Still working on the report figured I should turn it in though :D Impact hugeee...
Nextcloud: The password of a mail share is not set if the password is given when the share is created (Nextcloud < 18)
Create a new mail share with a password by using the OCS endpoint with something like: curl -u admin:admin -X POST -H "OCS-APIRequest: true" "http://localhost/ocs/v1.php/apps/filessharing/api/v1/shares?path=welcome.txt&shareType=4&[email protected]&password=plainTextPassword" - Open the...
Mail.ru: stored xss путём загрузки вредоносного файла + обход загрузки файлов.
Stored XSS via file upload functionality on static.donationalerts.ru /\ \ | \ . \ \ \ \ / \ + . x .\ / -----------/ o \ - .- + ; O \ +- . -'.- . \ \ / ..: - - - VVVVVVV VV V\ / . /./.+- . .- / +-- - . --AAAAAAAA/ | ' /x / x / // \ , x / ' . / . / ' \ / / / / / + | \ / ' / / / / ...
h1-ctf: [H1-2006 2020] CTF Writeup
Hi, The flag is :^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ F850811 I will do the writeup in the report summary. Regards, Yash Impact None as the money paid was not real...
Ruby on Rails: HTTP Host injection in redirect_to function
Hi team, Here is the sample vulnerable code ruby class TesttestController You are being redirected." end Then it will check if the options, because the input is String, so it will be the concatenate of request.protocol + request.hostwithport + options File actioncontroller\metal\redirecting.rb li...
h1-ctf: [H1-2006 2020] Flag for H1-CTF
F850509 I will submit the write-up today but I need to get some rest, Excellent CTF though, its my firs time ever to solve H1-CTF Impact ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$...
Node.js third-party modules: [wappalyzer] ReDoS allows an attacker to completely break Wappalyzer
Hello folks! please note that I'm reporting two different problematic regexes. module name: Wappalyzer version: 6.0.2 npm page: https://www.npmjs.com/package/wappalyzer Module Description Wappalyzer identifies technologies on websites. Module Stats Weekly downloads: 1,290 88 open issues 16 open...
Node.js third-party modules: [wappalyzer] ReDoS allows an attacker to completely break Wappalyzer
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report VULNERABILITY in...
h1-ctf: [H1-2006 2020] CTF
As there is a bonus for first 10 solutions for now I'll just post a flag. F850100 Impact -...
Mail.ru: Local SQL Injection in Content Provider (ru.mail.data.contact.ContactsProvider) of Mail.ru for Android, version 12.2.0.29734
Local SQL injection vulnerability in ContactsProvider of Mail.ru Mail application for Android special permissions required...
h1-ctf: [H1-2006 2020] H1-CTF writeup
Summary: I've just solved the challenge, I will submit the write-up tomorrow. Impact Flag: ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$...
Shopify: xss stored in https://your store.myshopify.com/admin/
hello , i fond xss stored in https://your store.myshopify.com/admin/ steps ; 1. go to https://swqdewd.myshopify.com/admin/menus/new 2. click in Add menu item 3. add name " AND any link 4. now click add 5. click in remove item 6. alert 7. watch the vedio poc for more information Impact xss attack...
h1-ctf: [H1-2006 2020] I successfully solved it!
Hello, I'll get post there the write-up soon. Here is flag: ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ Sincerely, @zeroxyele Impact null...