Nextcloud: Re-Sharing allows increase of privileges

User A shares a file/folder to user B with re-sharing permission, but readonly - User B shares this file/folder to User C Needs the shareapidefaultpermissions set to 1 all checkmarks off in admin panel - User B can add write permissions for the share to User C User C may also be anonymous using a...

curl: Poll loop/hang on incomplete HTTP header

Summary: When an incomplete server header is missing its value, the curl client will receive the packet but hang while parsing it. Examples of vulnerable server headers: Location, Content-Range and Connection. Adding the --max-timeoption will terminate the request as intended. Steps To Reproduce:...

Urban Dictionary: DOM XSS through ads

Multiple ads hosted on www.urbandictionary.com make the www.urbandictionary.com origin vulnerable to DOM XSS. Attached is an image of alertdocument.domain executing. The injection works in Firefox and Chrome. Visiting the following URL will probably cause an alert box displaying the document.doma...

Internet Bug Bounty: [CVE-2020-10543] Buffer overflow caused by a crafted regular expression

CVE ID: CVE-2020-10543 See: + https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod + https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod Impact Potential RCE...

h1-ctf: [H1-2006 2020] CTF Writeup

F851692 ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ I'll try to have the writeup ready in the following days here: https://hipotermia.pw/bb/h1-2006-ctf-solution It will be password protected and I will post a comment here when it is ready. Thanks for this CTF, I really enjoyed it! Impact -...

HackerOne: SAML Response Reuse on hackerone.com/users/saml/auth

Summary: When logging in with SAML, the user's IDP authenticates the user and generates a SAML response. The IDP then redirects the user's browser back to HackerOne to submit the SAML response. Upon receiving the SAML response, HackerOne validates it, sets a session cookie in the user's browser,...

Mail.ru: Private file read through file attachment

my.com MyMail application for Android could be tricked by malicious local application selected as a file picker by user to copy the file from application folder to insecure location...

Helium: Read-Only user can delete users

hello this endpoint DELETE /api/invitations/0ff7e9f9-877a-40cc-b99f-f6b3b1bea3f8 vulnerable to Insecure Direct Object Reference Steps to reproduce the bug Let's assume that three accounts exist: [email protected] role Administrator [email protected] role Read-Only [email protected] invited user...

Mail.ru: mail.ru/touch xss(r) debug parameter

Reflected XSS in touch version of mail.ru via GET parameter debug...

GitHub Security Lab: Add check for disabled HTTPOnly setting in Tomcat

This bug was reported directly to GitHub Security Lab...

h1-ctf: [H1-2006 2020] [Multiple Vulnerability] CTF Writeup - @abdilahrf_

As there is a private invite for the first 10 solver, i send only the flag now F851115 will complete my writeup on the next comment. Impact Controlling martenmickos account...

h1-ctf: [H1-2006 2020] ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$

Still working on the report figured I should turn it in though :D Impact hugeee...

Nextcloud: The password of a mail share is not set if the password is given when the share is created (Nextcloud < 18)

Create a new mail share with a password by using the OCS endpoint with something like: curl -u admin:admin -X POST -H "OCS-APIRequest: true" "http://localhost/ocs/v1.php/apps/filessharing/api/v1/shares?path=welcome.txt&shareType=4&[email protected]&password=plainTextPassword" - Open the...

Mail.ru: stored xss путём загрузки вредоносного файла + обход загрузки файлов.

Stored XSS via file upload functionality on static.donationalerts.ru /\ \ | \ . \ \ \ \ / \ + . x .\ / -----------/ o \ - .- + ; O \ +- . -'.- . \ \ / ..: - - - VVVVVVV VV V\ / . /./.+- . .- / +-- - . --AAAAAAAA/ | ' /x / x / // \ , x / ' . / . / ' \ / / / / / + | \ / ' / / / / ...

h1-ctf: [H1-2006 2020] CTF Writeup

Hi, The flag is :^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ F850811 I will do the writeup in the report summary. Regards, Yash Impact None as the money paid was not real...

Ruby on Rails: HTTP Host injection in redirect_to function

Hi team, Here is the sample vulnerable code ruby class TesttestController You are being redirected." end Then it will check if the options, because the input is String, so it will be the concatenate of request.protocol + request.hostwithport + options File actioncontroller\metal\redirecting.rb li...

h1-ctf: [H1-2006 2020] Flag for H1-CTF

F850509 I will submit the write-up today but I need to get some rest, Excellent CTF though, its my firs time ever to solve H1-CTF Impact ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$...

Node.js third-party modules: [wappalyzer] ReDoS allows an attacker to completely break Wappalyzer

Hello folks! please note that I'm reporting two different problematic regexes. module name: Wappalyzer version: 6.0.2 npm page: https://www.npmjs.com/package/wappalyzer Module Description Wappalyzer identifies technologies on websites. Module Stats Weekly downloads: 1,290 88 open issues 16 open...

Node.js third-party modules: [wappalyzer] ReDoS allows an attacker to completely break Wappalyzer

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report VULNERABILITY in...

h1-ctf: [H1-2006 2020] CTF

As there is a bonus for first 10 solutions for now I'll just post a flag. F850100 Impact -...

Mail.ru: Local SQL Injection in Content Provider (ru.mail.data.contact.ContactsProvider) of Mail.ru for Android, version 12.2.0.29734

Local SQL injection vulnerability in ContactsProvider of Mail.ru Mail application for Android special permissions required...

h1-ctf: [H1-2006 2020] H1-CTF writeup

Summary: I've just solved the challenge, I will submit the write-up tomorrow. Impact Flag: ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$...

Shopify: xss stored in https://your store.myshopify.com/admin/

hello , i fond xss stored in https://your store.myshopify.com/admin/ steps ; 1. go to https://swqdewd.myshopify.com/admin/menus/new 2. click in Add menu item 3. add name " AND any link 4. now click add 5. click in remove item 6. alert 7. watch the vedio poc for more information Impact xss attack...

h1-ctf: [H1-2006 2020] I successfully solved it!

Hello, I'll get post there the write-up soon. Here is flag: ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ Sincerely, @zeroxyele Impact null...

h1-ctf: [H1-2006 2020] I made the CEO's bounty payment!

^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ I will write the details in comment. Impact I have headache now...

h1-ctf: [H1-2006 2020] CTF Writeup

Just submitting Flag for now, Will soon submit Writeup : Impact Flag: ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$...

h1-ctf: [H1-2006 2020] Got the flag

Hey got the flag, will update the writeup soon started 6:00am may 30 BountyPay CTF Challenge Completed! Congratulations, all of the hackers have been paid their Bug Bounty money and you have completed the challange! Please submit your write up to https://hackerone.com/h1-ctf and make sure to...

h1-ctf: [H1-2006 2020] Multiple vulnerabilities leading account takeover

I'm posting flag and will send my write up upcoming days when I clear my mind after this rabbit holes! :D ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ Impact Multiple vulnerabilities leading attacker to takeover any bounty pay user...

OPPO: No rate limit on Reporting a Threat on [https://community.coloros.com] lead to Increase in the User Group/Points

Summary: When a user signs up on https://community.coloros.com he is assigned with a specific User Group which increases with his activity on the community. I found that there is no rate limit implemented on reporting a threat and due to which a User can abuse this functionality to Increase his...

h1-ctf: [H1-2006 2020] H1-2006 CTF Writeup

Hi! The challenges were really great. I had a lot of fun and I can honestly say I learned a few tricks during this journey. I will be submitting the flag now and will work on a very good writeup until the deadline. My reasoning is that there are two different prizes, one for the first ten and...

Mail.ru: [MY.GAMES] XSS в мессенджере

XSS in store.my.games on chat message...

curl: curl overwrite local file with -J

Summary: curl supports the Content-disposition header, including the filename= option. By design, curl does not allow server-provided local file override by verifying that the filename= argument does not exist before opening it. However, the implementation contains 2 minor logical bugs that allow...

HackerOne: Uploading large payload on domain instructions causes server-side DoS

This was a DoS vulnerability in a specific endpoint that didn't limit the size of the upload. As explained in the hacker summary, we limited the payload to mitigate the attack. Note : To everyone who sees this report, if a program accepts DoS vulnerabilities please try to try test carefully as it...

Engel & Völkers Technology GmbH: XSS reflected in https://tableau.engelvoelkers.com/

Summary: XSS reflected in https://tableau.engelvoelkers.com/ Steps To Reproduce: POC: https://tableau.engelvoelkers.com/en/embeddedAuthRedirect.html?auth=javascript:alertdocument.domain F848501 Impact XSS...

Stripo Inc: multiple email usage -my.stripo.email-

I first went to the "my.stripo.emai" view and registered with my google account. Then I entered the profile. I have replaced my email with an email that is not registered with your google account.I received a verification message on the email I changed. The button was not clicked. I copied it by...

GitHub Security Lab: Java: CWE-532 sensitive info logging

This bug was reported directly to GitHub Security Lab...

X (Formerly Twitter): Private list members disclosure via GraphQL

Summary: Due to improper queries of GraphQL, the attacker can steal members of the private list. Description: Twitter implements a unique GraphQL endpoint, which can use only the queries that Twitter specified. However, there is a flaw in the backend...

Nextcloud: The password of a mail share is not hashed if the password is given when the share is created

Create a new mail share with a password by using the OCS endpoint with something like: curl -u admin:admin -X POST -H "OCS-APIRequest: true" "http://localhost/ocs/v1.php/apps/filessharing/api/v1/shares?path=welcome.txt&shareType=4&[email protected]&password=plainTextPassword" - Check the...

Node.js third-party modules: [commit-msg] RCE via insecure command formatting

I would like to report a RCE issue in the commit-msg module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: commit-msg version: 0.2.3 npm page: https://www.npmjs.com/package/commit-msg Module Description commit-msg is a customizable git commit message...

Lark Technologies: Stored xss in larksuite internal helpdesk and other user's helpdesk.

A stored XSS cross site scripting vulnerability was found which an attacker could have potentially used to obtain access to the internal team's help desk and view submitted user tickets. We have resolved this issue and thank @imrannisar for reporting this to our team...

U.S. Dept Of Defense: xmlrpc.php FILE IS enable which enables attacker to XSPA Brute-force and even Denial of Service(DOS), in https://████/xmlrpc.php

Summary: Hello team, I have found a security vulnerability inhttps://███████/xmlrpc.php which lets attacker to: 1: XSPA or PortScan 2: Bruteforce 3:DOS and much more Description: Impact Step-by-step Reproduction Instructions █████████ 1: Go to https://██████/xmlrpc.php to check if it is enabled o...

Shopify: Ability to generate shipping labels in another store orders

Details A shop owner creating a session on its own store on https://mailbox.shopifycloud.com/ service can craft request to print labels on another store he doesn't have access to. Steps to reproduce 1. Go to an unfulfilled order and click on Create a shipping label 2. Copy the CURL request that i...

Shopify: Inject page in admin panel via Shopify.API.pushState [New Payload]

The correction for 868615, allows you to use new payload: js const ctx = window.openlocation.origin+'/admin/themes', 'blank' const data = JSON.stringify message: 'Shopify.API.replaceState', data: pathname: "abc:d../pages/xss//" ; ctx.postMessagedata Impact Abuse the active admin session to extrac...

Rockstar Games: Minor Account Privacy can Set to Everyone.

In this report, the researcher demonstrated an Insecure Direct Object Reference vulnerability that would allow Minor accounts accounts where the owner's age is self-reported to be under 18 years old to modify their privacy permissions to restricted settings. Ordinarily, accounts with owners betwe...

U.S. Dept Of Defense: Information Disclosure(PHPINFO/Credentials) on DoD Asset

Summary: A DoD leaks credentials on a phpinfo page. Description: https://███ publicly displays a phpinfo page that leaks system information and credentials. Impact The impact is medium not only due to information leakage of numerous different details such as system information but also the leakag...

Open-Xchange: Missing (or redundant) null check in `dcrypt_openssl_sign`

Function dcryptopensslsign in file src/lib-dcrypt/dcrypt-openssl.c has the following code if EVPPKEYbaseidkey-key == EVPPKEYRSA errorr = "Format does not support RSA"; return FALSE; and later if md == NULL if errorr != NULL errorr = tstrdupprintf "Unknown digest %s", algorithm; return FALSE; So,...

Starbucks: Singapore - Unrestricted File Upload Leads to XSS on campaign.starbucks.com.sg/api/upload

ko2sec discovered it was possible to upload arbitrary content on https://campaign.starbucks.com.sg/api/upload, leading to a stored XSS. This site was decommissioned. @ko2sec — thank you for reporting this vulnerability and for confirming the resolution...

Open-Xchange: Directory traversal allows execution of arbitrary binaries usign doveadm exec

Both the doveadm-exec man page and the online manual specify that it can be used to execute commands from Dovecot's libexecdir which sounds like an implicit security boundary. I recently ran across a situation where doveadm-exec was whitelisted in sudoers to be run as root. I realized it was...

Radancy: [www.werkenbijderet.nl] There is no rate limit for vacature-alert endpoints

https://werkenbijderet.nl/vacature-alert lacked a properly configured application specific tuned rate limiting defense mechanism. Because the speed limit was set very high, it was possible to send thousands of mails within 10 minutes. The fix was to implement a middleware which throttles requests...

Kubernetes: DoS for client-go jsonpath func

Summary: jsonpath recursive descent cause a DoS vul kubectl apiextensions-apiserver cli-runtime and kubernetes is depends on client-go I think evalRecursive cause of this vulnerability function pos: client-go/util/jsonpath/jsonpath.go:451 Component Version: client-go:master Steps To Reproduce: i...