15406 matches found
Mail.ru: "😂" + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/
Crossite scripting in community.my.games via post comments due to incomplete fix for 848732 I have been working on this issue for 2 hours and over 300 fails. Finally, I could exploit with a very exotic XSS payload. Payload with an emoji a little trick: %F0%9F%98%82!--😂//=...
8x8: Directory listing of https://get8x8.com/
The marketing domain get8x8.com was using default Apache directory configurations with indexing enabled...
GitLab: Unauthorized access to private project security dashboard
Summary User with guest permissions can't view security dashboard of the private project. However, this is not applied when user permission changes from maintainer to guest. As a result, if user was previously a maintainer in the project he/she can add the project to their security dashboard and...
MTN Group: Disclosure of internal information using hidden NTLM authentication leading to an exploit server
By using a request get on the url http://www.mtncongo.net/fr/Pages/ of the blog. we collect sensitive information from blogs step Typically, when visiting a website http://www.mtncongo.net/ or directory http://www.mtncongo.net/fr/Pages/ requiring privileged access, the server will initiate a logi...
Semrush: Broken validation of user Id for JWT Token
Traffic Analytics Tool TA uses JWT tokens to store user subscription information without any kind of personal information. JWT tokens are created by passing a user ID. There was an error with validation of user Id for JWT token...
Shopify: IDOR on stocky application-Low Stock-Varient-Settings-Columns
Hello, I have found a IDOR on stocky application Low Stock-Varient-Settings-Columns attribute, in fact malicious user can change the columns of another user. POC: 1Create two user A and B, login to A and create a store, test.myshopify.com login to user B and create a store test1.myshopify.com...
Mail.ru: [city-mobil.ru] SSRF & limited LFR on /taxiserv/photoeditor/save endpoint via base64 POST parameter
Vulnerability in photo editing functionality of https://city-mobil.ru/taxiserv/ allowed SSRF requests to internal services and local file read ability limited to image files. ¯\ツ/¯ I don't understand how I have missed it during fix validation of 748123 report. It's partly blind SSRF & LFR, which...
Nextcloud: Reduced purmations on encryption
OC\Security\SecureRandom::generate Reduced Permutations OC\Security\SecureRandom::generate will by default use a-Z0-9+/ 64 bytes character set. The numbers are not predictable, due to the use of randomint. Most notably the OC\Security\Crypto::encrypt method uses an IV with a length of 16 bytes. I...
U.S. Dept Of Defense: Previously Compromised PulseSSL VPN Hosts
Hi again!! Back in 2019, I had reported that a pulseSSL VPN server owned by US DoD can be compromised by a publicly available exploit. The report is 681249. As a result, the userid and passwd db was also compromised. I found that at least 1 userid and password combination from that compromised db...
Elastic: Remote Code Execution on Cloud via latest Kibana 7.6.2
Summary: A prototype pollution in Kibana can be used to gain remote code execution. Description: There is a prototype pollution bug in the upgrade assistant's telemetry collector, via a dangerous usage of .set:...
Stripo Inc: SSRF in my.stripo.email
They are a SSRF Server-side Request Forgery in https://my.stripo.email An attacker can do an attack and get ip address behind WAF and try to get RCE...
GitHub Security Lab: CPP: Out of order Linux permission dropping without checking return codes
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Go/CWE-643: XPath Injection Query in Go
This bug was reported directly to GitHub Security Lab...
Mail.ru: SQL LIKE clauses wildcard injection
LIKE clause was misused for session validation in one of https://c-api.city-mobil.ru/v2 API calls, allowing character-by-character session bruterofce. The session validation logic mistakenly allowed wildcards in the authorization token...
Internet Bug Bounty: Out-of-Bound Read in urldecode() [CVE-2020-7067]
Hi, Please see: https://bugs.php.net/bug.php?id=79465&edit=2 CVE is assigned CVE-2020-7067 Fixed in 7.4.5 Release: https://www.php.net/ChangeLog-7.php7.4.5 Impact A remote attacker might leak values from the memory by crafting a malicious url-encoded string into PHP's urldecode...
Valve: Privilege Escalation vulnerability in steam's Remote Play feature leads to arbitrary kernel-mode driver installation
Tested on Windows 10 x64 On Steam starting, it will check all installed files' Integrity, and re-download the modified files. This step makes every single file in Steam installation folder is exactly its original self. Before the first time Steam stream to SteamLink Remote Play feature, it makes...
Nextcloud: Code injection possible with malformed Nextcloud Talk chat commands
Summary The Nextcloud Talk app allows system administrators to setup chat commands that can be executed in Talk using the "/command" syntax. Users can provide additional arguments to the commands, such as "/calc 1+1" or "/wiki Hello", which are passed to the underlying script using @exec. If...
DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Security Configurability - The user can using the same password as your current ID.
The current username and password can be set the same, making it easy to guess the password. As a weak password policy issue, The current username and password can be set the same, making it easy to guess the password. |Technical severity|VRT category| Specific vulnerability name|Variant / Affect...
Internet Bug Bounty: Windows only: arbitrary file read vulnerability in openssl s_server
==Copied from an email sent to [email protected] on August 15, 2019== Hi, There's an arbitrary file read vulnerability present in openssl sserver when ran on Windows with the -WWW or -HTTP option. To reproduce: run openssl sserver -tls1 -WWW -accept 443 run .\curl.exe -k...
Mail.ru: [c-api.city-mobil.ru] IDOR chat messages between driver and customer
UUIDv1 was used as identifier in c-api.city-mobil.ru for some APIs where identifier was intended to be non-brutable while UUIDv1 entropy is insufficient...
GitLab: gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read
Summary Extracted from https://hackerone.com/reports/835455activity-7672566 While testing and looking at the patch for the nuget package workhorse bypass https://gitlab.com/gitlab-org/gitlab/issues/209080 I think I came across a more widespread bypass: bash create test file on gitlab server echo...
Phabricator: SSRF in notifications.server configuration
Modifying the notification server settings so that it connects to a malicious server. An attacker is able to redirect traffic from the vulnerable application to internal or external network resources. Steps To Reproduce: --------------------- 1. Open your phabricator installation authenticated wi...
Basecamp: CSRF on launchpad.37signals.com OAuth2 authorization endpoint
Hi, I found a CSRF in the OAuth2 authorization endpoint on launchpad.37signals.com. That allows a malicious 3rd party application to gain full API access to victim's account in 37signals products that uses OAuth2 authorization. I found that when making a post request to authorization endpoint it...
Visma Public: Ability to delete projects from Archived companies (Read only version)
The researcher discovered that Projects can be deleted from Archived companies which have "read only version".It was assessed as Low impact...
Uber: Exposed█████████in apk file - devbuilds.uber.com
Sensitive information was disclosed because of internal token leakage...
Mail.ru: Reflected XSS in city-mobil.ru/
Reflected XSS in city-mobil.ru due to unsafe usage of GET parameter...
Mail.ru: XSS in [community.my.games]
Crossite scripting in community.my.games via post comments All we say is Thank You for an Account Takeover Flaw!...
Shopify: None permission staff member can identify installed application and products attached to it
Hello, To see if a store has application installed and which products its configured the staff member should have application permission otherwise nothing is visible but i found a way that let none permission staff member to identify if the store has installed Digital Downloads and if the...
Mail.ru: IDOR in tracking driver logs at city-mobil.ru
IDOR vulnerability in taxiserv interface allowed to access a track log of a different driver...
Uber: Cookie Bombing cause DOS - businesses.uber.com
Cookie Bombing cause DOS on businesses.uber.com...
Mail.ru: Content injection on shared event (calendar.mail.ru)
Allowed tags/attributes for calendar events in calendar.mail.ru were not properly restricted allowing interface elements spoofing...
U.S. Dept Of Defense: Full Account Take-Over of ████████ Members via IDOR
Summary https://███████ is a Social Network Site belonging to US DoD. Membership is open to anyone, I have found a method to fully take-over any members' account by exploiting an IDOR bug in the ██████████ end-point. By changing the following values in the POST request to the affected end-point:...
Mail.ru: Information Disclosure on {http://pro.tracker.my.com}
Prometheus performance metrics were publicly available on pro.tracker.my.com...
U.S. Dept Of Defense: Members Personal Information Leak Due to IDOR
Summary https://██████ allows anyone to sign up and view other members profile. According to wikipedia, ███████ is part of US DoD "████████": ██████ I signed up with a regular account and noticed that by referencing users ████, I can send thousands of "█████████" and also, using another end-point...
U.S. Dept Of Defense: Stored XSS via 64(?) vulnerable fields in ███ leads to credential theft/account takeover
Summary: A user is able to complete a ████████ worksheets via https://██████████. This form allows a user to store multiple XSS payloads within, which will in turn allow the attacker to run malicious code in context of the legal personnel who view the request. Impact The attacker can have multipl...
Stripo Inc: SSRF via Export Service in ActiveCampaign
SSRF with ActiveCampaign...
Mail.ru: XSS at go.mail.ru
DOM-based self XSS in go.mail.ru social search functionality...
Elastic: Stored XSS in Elastic App Search
Summary: There exists a stored XSS via referenceui in "URL" Parameter in the latest Elastic App Search v7.6.2 Tested both on cloud and local instance Description: Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message...
BTFS: xss on bittorrent.com
hi team i realized xss bug on headers.php. https://www.bittorrent.com/scripts/site/headers.php?=1586521900793&callback= https://www.bittorrent.com/scripts/social/gettweet.php?=1586521900791&callback= its works on IE browsers. Impact fix them...
BTFS: frame injection on bittorrent.com
Hi team, headers.php is injectable. you can see on IE browsers. FULL URL : https://www.bittorrent.com/scripts/site/headers.php?=1586521900793&callback=%3ciframe%20src%3d%22http%3a%2f%2fgoogle.com%2f%3f%22%3e%3c%2fiframe%3e Impact fix them...
BTFS: .git file accessible on remote.bittorrent.com
Hi team, i detected your .git file accessible for any unauthorized user. url : https://remote.bittorrent.com/static/webui/.git/config HTTP/1.1 200 OK Set-Cookie: BTURT=talon-i-0837bbfadd509c546-2; path=/; domain=.utorrent.com Server: TornadoServer/2.1.1git Connection: keep-alive Content-Length: 2...
BTFS: XSS on remote.bittorrent.com
Hi security team, ı found xss on your subdomain. this is includes callback function. url : https://remote.bittorrent.com/talon/logout?message= Impact fix them...
Acronis: Open redirect at mc-beta-cloud-acronis.com
Open Redirect Vulnerability Steps To Reproduce: Type in this URL:...
Glassdoor: Reflected XSS on https://www.glassdoor.com/employers/sem-dual-lp/
Summary: There is a reflected XSS on https://www.glassdoor.com/employers/sem-dual-lp/ through the utmsource parameter. By using URL encoding I was able to bypass the WAF. Affected URL or select Asset from In-Scope: https://www.glassdoor.com/ Affected Parameter: utmsource Vulnerability Type: XSS...
BlockDev Sp. Z o.o: Blind SSRF at https://chat.makerdao.com/account/profile
Blind SSRF at https://chat.makerdao.com/account/profile...
Topcoder: SVG file upload leads to XML injection
Summary: Upload Avatar option allows the user to upload image/ . Thus enabling the upload of many file formats including SVG files MIME type: image/svg+xml SVG files are XML based graphics files in 2D images. Thus, this opens up an attack vector to upload specially crafted malicious SVG files. Th...
GitHub Security Lab: CPP: Out of order Linux permission dropping without checking return codes
This bug was reported directly to GitHub Security Lab...
Imgur: Sourcemaps and Unminified Source Code Exposed on Pages
Hello, I'm not sure if this was actually meant to be made public on purpose, but I was looking through some of the sources that were loaded and found out the following: https://imgur.com/ - See ██████ s.imgur.com - desktop-assets - js contains multiple minified JS files as one would usually expec...
Zomato: [www.zomato.com] Abusing LocalParams (city) to Inject SOLR query
Hi Team! ; I Found an limited SOLR Injection by Abusing LocalParams city in /webapi/searchapi.php, Therefore Please respect my decision to mark this report as Medium instead of High Based on the fact the code is Vulnerable even if it's hard to exploit. - Request adding single Backslash: http GET...