15693 matches found
Shopify: GraphQL AdminGenerateSessionPayload is leaked to staff with no permission
@hiffley reported the ability to generate app tokens via the adminGenerateSession mutation in Shopify Admin, as a staff member with no permissions. This allowed for accessing a small subset of installed apps that are using this new flow including Shopify Email. Access was limited to the current...
Mail.ru: Source code and internal credentials disclosure
Sensitive application configuration data disclose on registry.infra.mail.ru...
Mail.ru: Reflected XSS in "keywords" parameter at "https://sbermarket.ru/metro/search"
Reflected XSS via GET parameter in sbermarket.ru...
Mail.ru: ΠΡΠΊΡΡΡΠ°Ρ Π°Π΄ΠΌΠΈΠ½ΠΊΠ° 1C ΡΠΌΡΠ»ΡΡΠΎΡΠ°
Staging testing versions of 1C-emulator and Adminer interfaces was available from external network without authentication on geekbrains.ru. This interfaces had no access to production data...
Node.js third-party modules: Arbitrary code execution via untrusted schemas in ajv
I would like to report an arbitrary code execution vulnerability in ajv. It allows to execute arbitrary code if an attacker-controlled schema is passed to the module. I have confirmed that this should be treated as a security issue. I labeled this as low because this is an unusual scenario, usual...
Nintendo: [3DS][SSL][SDK] Unchecked number of audio channels in Mobiclip SDK leads to RCE in eShop movie player
Affected Systems - Platform: New Nintendo 3DS - Region: ALL - System version: 11.13 latest at the time of writing Description The Mobiclip SDK used for parsing moflex videos does not check the number of audio channels in an audio stream. This leads to a miscalculation of free space remaining in a...
Greenhouse.io: SSH port on store.greenhouse.io is vulnerable to brute force attacks
Open SSH port found on third party vendor...
Visma Public: Stored XSS in eaccounting.stage.vismaonline.com
The security researcher was able to find a Stored XSS Cross-site scripting vulnerability on the eaccounting.stage.vismaonline.com domain. This causes arbitrary javascript execution on the victim's browser. The severity of this vulnerability has been evaluated as medium...
Glassdoor: 2FA bypass by sending blank code
Summary: βββββββββ. This is a failure in null check of the entered code. In simple terms, the 2FA while logging in can be bypassed by sending a blank code. This could be because of incorrect comparison of entered code with true code. A pre-validation may be null check before comparing the codes...
Zivver: XXE Injection through SVG image upload leads to SSRF
While uploading photos to my profile picture, I noticed that if I included an svg image, your server would parse and upload it to my profile. Through this, I explored more and found that this same functionality was also vulnerable to an XXE attack, where I could define my own entities, and your...
Mail.ru: [smena.samokat.ru] Predictable JWT secret
Default secret value was used for JWT generation by smena.samokat.ru What can go wrong if JWT HS256 secret value is secret π...
Mail.ru: ΠΠΎΠ»ΡΡΠ΅Π½ΠΈΠ΅ Π³Π°ΡΠ°Π½ΡΠΈΡΠΎΠ²Π°Π½Π½ΠΎΠ³ΠΎ Π΄ΠΎΡ ΠΎΠ΄Π° ΠΈ Π±ΠΎΠ½ΡΡΠΎΠ² Π±Π΅Π· ΡΠ°ΠΊΡΠΈΡΠ΅ΡΠΊΠΎΠ³ΠΎ ΠΈΡΠΏΠΎΠ»Π½Π΅Π½ΠΈΡ Π·Π°ΠΊΠ°Π·ΠΎΠ², ΠΏΡΠΈ ΡΡΠΎΠΌ ΠΈΡΠΏΠΎΠ»ΡΠ·ΡΡ Π°ΠΊΠΊΠ°ΡΠ½ΡΡ Π½Π΅ ΡΡΡΠ΅ΡΡΠ²ΡΡΡΠΈΡ Π»ΡΠ΄Π΅ΠΉ.
Reported demonstrated a possibility to bypass an anti-fraud protection in Citymobil taxi service...
Nextcloud: Reflected XSS when renaming a file with a vulnerable name which results in an error
Hi, It looks like Nextcloud team will accept the XSS protected by the CSP. Report 896511 Here is another XSS. 1. Rename an existing filename to .jpg. 2. Anyone tries to rename this .jpg with an invalid filename, like add a "" in it, will trigger the XSS attack. 3. Need bypass the CSP. Thanks...
Nextcloud: XSS in image metadata field
Hi, Will you confirm the XSS vulnerability blocked by the CSP? On Nextcloud 19.0.0 1. Upload the PoC.jpg 2. Check the PoC.jpg metadata 3. Need bypass the CSP to trigger it Impact Cross-Site Scripting...
Monero: Misconfiguration in build environment allows DLL preloading attack
Summary: monero-wallet-gui.exe tries to dynamically load some dynamic link librariesDLL which are not present in the applications directory, so LoadLibraryA system-call will search other directories such as Windows root and %PATH% for them. An attacker can gain arbitrary code execution if he/she...
GitHub Security Lab: Java: CWE-297 Insecure JavaMail SSL configuration
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CodeQL query for SpEL injections
This bug was reported directly to GitHub Security Lab...
U.S. Dept Of Defense: (CORS) Cross-origin resource sharing misconfiguration
Description: Affected website: https://ββββββββββ/wp-json Impact Step-by-step Reproduction : 1. Send this request: javascript GET /wp-json HTTP/1.1 Host: βββββββββ Connection: close Origin: http://evil.com Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Windows NT...
Facebook: Facebook - Reputation Sync For #267890541047618
This bug was reported directly to Facebook...
Blueboard: path traversal vulnerability adding /ββββββββ after ββββββββ and skip ββββββ page.
This report has brought to light a workaround to scheduling calls with our sales team, that would allow anyone to do so without going through our dedicated marketing website's flow...
Engel & VΓΆlkers Technology GmbH: [service.engelvoelkers.com] XSS in /video/id
Summary: The YouTube video page at https://service.engelvoelkers.com/video/id/ is vulnerable to reflected XSS attacks. Description: A dynamic part of the URL is printed to the page without proper encoding, causing a reflected XSS vulnerability. Steps to reproduce Visit the following link:...
GSA Bounty: Limited LFI
Summary: Due to improper parameter sensitization local file inclusion is possible. LFI is limited as we were not able to truncate the end of string. Description: Application root is located at /var/www/dashboard/new/public Due to URL Manipulation we are able to raed file from...
8x8: DOM Based XSS at docs.8x8.com
A domain for marketing documentation contained a DOM based XSS due to evaluation and rendering of window.location.href in the related javascript...
h1-ctf: [h1-2006 2020] Bounty payments are done !
Read more here! https://github.com/Louzogh/CTF-Writeup/blob/master/2020/H1-2006-CTF/README.md Hey, I've published my write-up at : https://github.com/Louzogh/CTF-Writeup/blob/master/2020/H1-2006-CTF/README.md Enjoy π ...
h1-ctf: [H1-2006 2020] Bounty Pay CTF challenge
H1-2006 2020 Bounty Pay CTF challenge Hi there! This is my H1-2006 CTF writeup submission. First of all, thanks for the great challenge! This was my first H1 CTF that I played. I really enjoyed doing it and I learned new things solving this challenge. In my case, it was the demonstration that I...
h1-ctf: [h1-2006 2020] Writeup h12006 CTF
^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ Impact...
h1-ctf: [h1-2006 2020] CTF Walkthrough
h1-2006-ctf Writeup June 2020 https://hackerone.com/h1-ctf/ The Competition Begins! The tweet announces the CTF challenge. Looks like we will need to find a way to process some payments. F863442 Initial Exploring Reading up on the extended description at https://hackerone.com/h1-ctf/ reveals that...
h1-ctf: [H1-2006] CTF Writeup
H1-2006 CTF Writeup I am fairly new to CTFs - this is just my second CTF after H1-415 CTF, at which I didn't get far at all. I think the most valuable thing I can do for anyone who comes across this writeup, is to describe exactly what I was thinking at each step along the way, including all my...
h1-ctf: [h1-2006 2020] Write up for H1-2006 CTF
I huffed and puffed my way up a flight of stairs into a dimly lit, dusty room, looking for Sherlock. As I made way through scattered books, I exclaimed, "Sherlock, wake up! Itβs that time of the year. h1-ctf, a chance to get an invitation to hackeroneβs live hacking event. βzer0ttl, of course! Yo...
Nintendo: [3DS][SSL] Use of uninitialized class member leads to RCE in eShop movie player
Affected Systems - Platform : New Nintendo 3DS - Region: ALL - System version: 11.13 latest at the time of writing Description The eShop video player does not initialize pointers to some decoder objects when creating a video player object. With a specific audio codec this induces the use of...
Nextcloud: Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers
In two Nextclouds A and B, in settings/admin/sharing, these settings are enabled: Restrict users to only share with users in their groups Restrict username autocompletion to users within the same groups Add server automatically once a federated share was created successfully Some user on A now...
Ruby on Rails: Rack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookies
The rack cookie parser parses the cookie string using unescape. This allows a malicious attacker to set a second cookie with the name being percent encoded. Typically it would be expected that we cannot trust cookies and in most cases that's true. However in a couple of cases certain expectations...
h1-ctf: [h1-2006 CTF] Multiple vulnerabilities leading to account takeover and two-factor authentication bypass allows to send pending bounty payments
Hi, First things first, the flag of the CTF challenge. F863095 Write-Up I've published my write-up at https://kapytein.nl/texts/2020-06-10-h1-2006-ctf-writeup-2cf34abd3ed/, in order to avoid a lengthy report π . TL;DR 1 2FA bypass as we control both values on the comparison. 2 SSRF to...
GSA Bounty: Blind SSRF on https://labs.data.gov/dashboard/Campaign/json_status/ Endpoint
Summary: Due to improper routes handling multiple malicious actions are possible. Attacker is able to call Class/Function/Param1/Param2 directly from source code. this may lead to call function that should be not accessible from GUI. Any Class from...
h1-ctf: [h1-2006 2020] Chained vulnerabilities lead to account takeover
Summary MΓ₯rten Mickos lost his account for BountyPay, the new service HackerOne is using to pay bug bounties. In this report I explain how I accessed a customer's account using a log file and bypassed its 2FA validation. I then leverage an open redirect bug to gain access to an internal server an...
h1-ctf: [H1-2006 2020] How I solved my first H1 CTF
Introduction: Hello! My name is @cr33pbp0y and I going to tell you how I resolved my first HackerOne CTF. Prelude One day, I was reading some tweets about some new vulnerabilities and new hunters adquisitions when the Great H tweeted: F861267 I thought: "WoW, a new virtual event!! It could be...
Mail.ru: Grafana SSRF in grafana.instamart.ru
non-blind SSRF in grafana.instamart.ru...
h1-ctf: [H1-2006 2020] Multiple vulnerabilities allow to leak sensitive information
Summary: --------------------- Hello team! This report is detailed write-up for chain of vulnerabilities that ended up with leaking sensitive information - a flag. CTF itself was really fun and I've enjoyed it. Hope you find my report valid and useful. Steps To Reproduce: ---------------------...
h1-ctf: [H1-2006 2020] Bypassing access control checks by modifying the URL, internal application state, or the HTML page, or using a custom API attack tool
H1-2006 CTF Writeup F859938 Summary: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification or destruction of all data, or performing a business function outside of the limits of...
h1-ctf: [H1-2006 2020] Exploiting multiple vulnerabilities to get hacker's payment ensured
Last week, Hackeroneβs CEO Marten lost his credentials for BountyPay. A tweet from hackeroneβs official twitter account asked for help from ethical hackers and bounty hunters to help the CEO recover his credentials and insure Mayβs payments. As an active bug hunter on Hackerone, I decided to take...
Nintendo: [3DS][SSL] Improper certificate validation allows an attacker to perform MitM attacks
Affected Systems - Platform: New Nintendo 3DS - Region: ALL - System version: = 11.13 Description The SSL system module does not properly validate the x509 certificates when establishing an SSL/TLS connection. Actually, the SSL system module does not check the signatures when validating a...
Open-Xchange: XSS on opening malicious OpenOffice presentation document
Title Opening a malicious OpenOffice presentation document may lead to cross site scripting XSS attacks Description When generating HTML content for drawings present in odp file, a div is generated by Drawing.java. The attribute target of this div is directly constructed from the field target...
Open-Xchange: XSS on opening malicious OpenOffice presentation document
Title Opening a malicious OpenOffice presentation document may lead to cross site scripting XSS attacks Description When generating HTML content for a master slides present in odp file, a div is generated by Container.java. The attribute data-container-id of this div is directly constructed from...
Open-Xchange: XSS on opening a malicious OpenOffice text document
Title Opening a malicious OpenOffice text document may lead to cross site scripting XSS attacks Description When generating HTML content for a comment present in text file, a placeholder div is generated by CommentPlaceHolder.java. The attribute data-container-id of this div is directly construct...
BlockDev Sp. Z o.o: Email HTML injection
Email HTML injection...
Nextcloud: XSS through image upload of contacts using svg file
This is a bypass of report 808287 Upload the attached file for the image of a contact, right click "Open image in new tab" and you will see the xss. Impact The person viewing the image of a contact can be victim of XSS...
GitHub Security Lab: CodeQL query to detect Server-Side Template Injections (JavaScript)
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CodeQL query for unsafe TLS versions
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CodeQL query for MVEL injections
This bug was reported directly to GitHub Security Lab...
h1-ctf: [H1-2006 2020] From multiple vulnerabilities to complete ATO on any customer account and staff admin
First of all, thanks for the awesome CTF. I enjoyed it very much : Summary The CTF was about helping HackerOne's beloved CEO, @martenmickos, to approve May bug bounty payments after he has lost his login details for BountyPay. It all started with this tweet: F860982 And as you all know, I had to...