15693 matches found
Nextcloud: The password of a mail share is not hashed if the password is given when the share is created
Create a new mail share with a password by using the OCS endpoint with something like: curl -u admin:admin -X POST -H "OCS-APIRequest: true" "http://localhost/ocs/v1.php/apps/filessharing/api/v1/shares?path=welcome.txt&shareType=4&[email protected]&password=plainTextPassword" - Check the...
Node.js third-party modules: [commit-msg] RCE via insecure command formatting
I would like to report a RCE issue in the commit-msg module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: commit-msg version: 0.2.3 npm page: https://www.npmjs.com/package/commit-msg Module Description commit-msg is a customizable git commit message...
Lark Technologies: Stored xss in larksuite internal helpdesk and other user's helpdesk.
A stored XSS cross site scripting vulnerability was found which an attacker could have potentially used to obtain access to the internal team's help desk and view submitted user tickets. We have resolved this issue and thank @imrannisar for reporting this to our team...
U.S. Dept Of Defense: xmlrpc.php FILE IS enable which enables attacker to XSPA Brute-force and even Denial of Service(DOS), in https://████/xmlrpc.php
Summary: Hello team, I have found a security vulnerability inhttps://███████/xmlrpc.php which lets attacker to: 1: XSPA or PortScan 2: Bruteforce 3:DOS and much more Description: Impact Step-by-step Reproduction Instructions █████████ 1: Go to https://██████/xmlrpc.php to check if it is enabled o...
Shopify: Ability to generate shipping labels in another store orders
Details A shop owner creating a session on its own store on https://mailbox.shopifycloud.com/ service can craft request to print labels on another store he doesn't have access to. Steps to reproduce 1. Go to an unfulfilled order and click on Create a shipping label 2. Copy the CURL request that i...
Shopify: Inject page in admin panel via Shopify.API.pushState [New Payload]
The correction for 868615, allows you to use new payload: js const ctx = window.openlocation.origin+'/admin/themes', 'blank' const data = JSON.stringify message: 'Shopify.API.replaceState', data: pathname: "abc:d../pages/xss//" ; ctx.postMessagedata Impact Abuse the active admin session to extrac...
Rockstar Games: Minor Account Privacy can Set to Everyone.
In this report, the researcher demonstrated an Insecure Direct Object Reference vulnerability that would allow Minor accounts accounts where the owner's age is self-reported to be under 18 years old to modify their privacy permissions to restricted settings. Ordinarily, accounts with owners betwe...
U.S. Dept Of Defense: Information Disclosure(PHPINFO/Credentials) on DoD Asset
Summary: A DoD leaks credentials on a phpinfo page. Description: https://███ publicly displays a phpinfo page that leaks system information and credentials. Impact The impact is medium not only due to information leakage of numerous different details such as system information but also the leakag...
Open-Xchange: Missing (or redundant) null check in `dcrypt_openssl_sign`
Function dcryptopensslsign in file src/lib-dcrypt/dcrypt-openssl.c has the following code if EVPPKEYbaseidkey-key == EVPPKEYRSA errorr = "Format does not support RSA"; return FALSE; and later if md == NULL if errorr != NULL errorr = tstrdupprintf "Unknown digest %s", algorithm; return FALSE; So,...
Starbucks: Singapore - Unrestricted File Upload Leads to XSS on campaign.starbucks.com.sg/api/upload
ko2sec discovered it was possible to upload arbitrary content on https://campaign.starbucks.com.sg/api/upload, leading to a stored XSS. This site was decommissioned. @ko2sec — thank you for reporting this vulnerability and for confirming the resolution...
Open-Xchange: Directory traversal allows execution of arbitrary binaries usign doveadm exec
Both the doveadm-exec man page and the online manual specify that it can be used to execute commands from Dovecot's libexecdir which sounds like an implicit security boundary. I recently ran across a situation where doveadm-exec was whitelisted in sudoers to be run as root. I realized it was...
Radancy: [www.werkenbijderet.nl] There is no rate limit for vacature-alert endpoints
https://werkenbijderet.nl/vacature-alert lacked a properly configured application specific tuned rate limiting defense mechanism. Because the speed limit was set very high, it was possible to send thousands of mails within 10 minutes. The fix was to implement a middleware which throttles requests...
Kubernetes: DoS for client-go jsonpath func
Summary: jsonpath recursive descent cause a DoS vul kubectl apiextensions-apiserver cli-runtime and kubernetes is depends on client-go I think evalRecursive cause of this vulnerability function pos: client-go/util/jsonpath/jsonpath.go:451 Component Version: client-go:master Steps To Reproduce: i...
GitLab: Possibilty to purchase Ultimate - 1 Year (EDU or OSS)
Hi, Any user can purchase Ultimate - 1 Year EDU or OSS which is for educational institutions or open source projects.I have found here https://gitlab.com/gitlab-org/customers-gitlab-com/-/issues/860 list of Gitlab plan id and found Ultimate - 1 Year which is free and purchased. Steps to reproduce...
Xiaomi: Insecure file upload in xiaoai.mi.com Lead to Stored XSS
Insecure file upload in xiaoai.mi.com Lead to Stored but self XSS...
Automattic: DOM-Based XSS in tumblr.com
Description Hi, i just found a XSS that i think it's a valid issue and i think it is in scope this time. To get the XSS the attacker needs to create a post in tumblr.com using...
Mail.ru: Database read through provider misconfiguration
Content provider implementation in ICQ for Android allowed another local application to force ICQ private files to be copied to insecure location...
Shopify: OrderListInitial leaks order details
Hello, During my investigation I have noticed that OrderListInitial graphql operation is leaking more information that it suppose to be for a staff with "Customer" only permission. Normally the graphql call is as below. POST /admin/internal/web/graphql/core HTTP/1.1...
Nextcloud: New users can read all Nextcloud Deck data from previous user with same username
First of all: Sorry, i know there is no scope "Deck" but both Joas and Jus pointed me to hackerone to report this security issue. 1. As an administrator create Nextcloud account "test" 2. Log in as "test" 3. Go to Deck app and create some boards, stacks and cards with personal or confidential...
U.S. Dept Of Defense: XSS via X-Forwarded-Host header
Summary: The █████ website is vulnerable to a cross-site scripting flaw if the server receives a crafted X-Forwarded-Host header. Description: The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a...
Visma Public: SXSS using unsanitized `customer no` in eaccountingprinting.stage.vismaonline.com
The researcher found that the customer no field in customer profile is not properly sanitized enabling html/js codeinjection causing an Stored XSS...
WordPress: Authenticated Stored Cross-site Scripting in bbPress
Description: There exists a stored XSS vulnerability in bbPress, due to which the XSS payload which I enter in my content, gets executed at /wp-admin/edit.php?posttype=forum. This vulnerability requires you to be an authenticated user. Steps To Reproduce: Step 1. Visit...
Mail.ru: SQL injection at fleet.city-mobil.ru
SQL injection in fleet.city-mobil.ru due to unsafe usage of POST parameter "param":"1'+MySQLpayload--+-"...
ownCloud: File System Monitoring Queue Overflow
in the source code "owncloud/client" in the file "src/gui/folderwatcherlinux.cpp" in the function "void FolderWatcherPrivate :: inotifyRegisterPath const QString & path" by calling "inotifyaddwatch" the file paths are set for monitoring cpp int wd = inotifyaddwatchfd, path.toUtf8.constData,...
WordPress: Arbitrary change of blog's background image via CSRF
Description: Despite being deprecated since v3.5.0, the wpsetbackgroundimage method defined in wp-admin/includes/class-custom-background.php, registered as an authenticated AJAX call wpajaxset-background-image, is still active. Given that the method is lacking CSRF checks, an attacker could chang...
Mail.ru: Collected Telegraf Matrics Accessible
Perfomance metrics were available at game.tz.mail.ru...
Node.js third-party modules: [last-commit-log] Command Injection
I would like to report Command Injection in last-commit-log It allows execution of arbitrary commands Module module name: last-commit-log version: [email protected] npm page: https://www.npmjs.com/package/last-commit-log Module Description Node.js module to get the last git commit information...
Slack: Stored XSS through PDF viewer
Slack allows users to upload files to their Workspace to facilitate sharing information between team members as well as with other workspaces. In addition, with the aim of easing access to PDF files, Slack provides its own "PDF Viewer" https://app.slack.com/pdf-viewer embedded in the application...
Starbucks: Default credentials for the temporary POC site alipoc.stg.starbucks.com.cn permitted WAF bypass and RCE
neweq discovered that a temporary proof of concept site alipoc.stg.starbucks.com.cn was initially configured with default credentials for a brief period of time before being taken offline. @neweq — thank you for reporting this vulnerability and for confirming the resolution...
Stripo Inc: [www.stripo.email] You can bypass the speed limit by changing the IP.
You can bypass the speed limit by changing the IP Login page Bypass the speed limit...
Glassdoor: Unauthorized usage of External API Key (Usage of Google Maps API Key ==> $$$
A Google Maps API key was found in the source code of a Glassdoor webpage, which allowed unauthorized usage of the API. The API key was not configured securely...
Starbucks: Cross-Site Scripting (XSS) on www.starbucks.com | .co.uk login pages
Hi team, Summary: There is a cross-site scripting vulnerability on the login page of www.starbucks.com and various regions, due to improper escaping on the URL path. Description: The login page at https://www.starbucks.com/account/signin builds several links by the relative URL path. An attacker...
Nutanix: AWS S3 bucket writeable for authenticated AWS users
S3 bucket permissions were not configured correctly, allowing any authenticated AWS user to delete and write files. Nutanix didn't properly configure one of their S3 buckets permissions and inadvertently allowed any authenticated AWS user to delete and write files. An attacker could post a...
GitLab: Todos are not redacted when membership changes - Access to (confidential) issues and merge requests
Summary This vulnerability was fixed in https://gitlab.com/gitlab-org/gitlab-foss/-/issues/54349 , but it reappears maybe due to some new changes and one is able to reproduce the vulnerability to access confidential issues and MRs. All issues and MRs used to get redacted after one hour grace peri...
Courier: SSO Provider Credential Cache (logged out of Google/GitHub, could still log into Courier)
After researching this further, our authentication provider Amazon's AWS Cognito caches the access token provided by Google, GitHub, and other SSO providers within their system for up to an hour and does not check against the SSO provider's API again until that cache has expired. We did verify th...
DigitalOcean: Blind XSS via Digital Ocean Partner account creation form.
Summary: Blind Cross-Site Scripting XSS was discovered at Digital Ocean Partners admin panel/dashboard where an attacker can run arbitrary Javascript Code at victims' end. Due to the absence of an HTTPonly cookie, an attacker can successfully steal the cookies of the user and use them to login to...
HackerOne: Near to Infinite loop when changing Group's name that has API token as Team Member
Summary: The https://hackerone.com contains an iteration or loop with an exit condition that is near to infinite loop. If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory and even a DoS attack. Description: Hello...
GitLab: Unrestricted file upload leads to Stored XSS
Summary i found that i can upload png file with JavaScript code and execute it in wiki page. Steps to reproduce Step-by-step guide to reproduce the issue, including: 1-login to gitlab account 2-open your project 3-open Wiki page. 4-Click "New page" button. 5-attach png file which contain below co...
Smartsheet: Smartsheet employees email disclosure through enpoint after login.
Summary: add summary of the vulnerability After login - while validating this issue 858974 - I notice there is an endpoint call /b/home?formName=webop&formAction=SheetLabLoadData&to=68000&ssv=98.0.2 that is bringing emails from some employees. Steps To Reproduce: add details for how we can...
Xiaomi: DOM-based XSS in d.miwifi.com on IE 11
There is a DOM based XSS on d.miwifi.com but it only works on IE 11...
8x8: IDOR: Adding Contacts to Other User Groups
The request to add a new contact performed insufficient validation on the specified group number. Altering the target group resulted in incrementing license count and disclosure of the name of the group, however access was not granted...
Node.js third-party modules: Bypass of SSRF Vulnerability
Bypass of SSRF report https://hackerone.com/reports/793704 Fix applied after reporting the actual report did not prevent from SSRF issue. https://github.com/TryGhost/Ghost/commit/47739396705519a36018686894d1373e9eb92216diff-3aa52b4b8c6e0fb8422de65648e35887R101 The function fetchOembedData only...
Central Security Project: Repositories of datanucleus are fetched over insecure protocol (http insted of https)
Maven artifact groupId: org.datanucleus artifactId: datanucleus-maven-parent version: 4.0.0 Vulnerability the jar files inside repositories are fetched using insecure protocol http instead of https. This allows these artifacts to be potentially MITMed to maliciously compromise them and infect the...
Xiaomi: CORS Misconfiguration, could lead to disclosure of users information
This will result in the leakage of the users IP by exploiting this cors misconfiguration issue There is no impact...
8x8: Admin Reseller Account Disclosure
The vendor that handles 8x8 Resellers had inadvertently exposed account credentials. The information was removed and credentials changed. Leaked admin account of third party reseller in github with full access to all files...
Mail.ru: MySQL username and password leaked on [2017.russianaicup.ru]
Configuration file available via web interface could disclosure potenrially sensitive inormation Configuration file available via web interface could disclosure potentially sensitive information...
GitLab: Full Read SSRF on Gitlab's Internal Grafana
Apparently, Grafana is bundled with Gitlab by default. So the grafana instance that is accessible via /-/grafana/is vulnerable to the SSRF outlined below. Summary By chaining together some redirects and a URL decoding bug, it is possible to achieve a full-read, unauthenticated, SSRF from your...
LinkedIn: LinkedIn users primary email + full name visibilty
Vulnerability description not provided...