Helium: Hyperlink Injection on Email Invitation

DESCRIPTION Found an hyperlink injection of the name of Organization when the attacker invites the victim to his organization with injection hyperlink. STEPS 1. Add organization with the name of https://attacker.com and switch it. 2. Go to user and invite the victim using email. 3. victim will se...

8x8: Outdated Coturn is vulnerable to known vulnerabilities (High)

Jitsi had several CoTurn servers that needed improvements to their access configurations and updated...

8x8 Bounty: Open TURN relay abuse is possible due to lack of peer access control (Critical)

NOTE: This is not an SSRF vulnerability but an open TURN relay vulnerability. Typically, this security vulnerability has at least the same impact as an SSRF. However it is considered more useful from an attacker's point of view since attacks are not restricted to HTTP. - Affects: - █████:443 -...

Rocket.Chat: Desktop app RCE (#276031 bypass)

Summary: 276031 fix bypass, two click remote code execution. Description: The security issue is in links preload file https://github.com/RocketChat/Rocket.Chat.Electron/blob/master/src/preload/links.js file. By rewriting RegExp.prototype.test method it is possible to prepare proper answers to get...

Mail.ru: Account takeover through password reset in cups.mail.ru

An IDOR vulnerability in password recovery procedure allowed arbitrary cups.mail.ru account rakeover. Write-up is here. : https://medium.com/kminthein/account-takeover-in-cups-mail-ru-bdab1483f92c...

Rocket.Chat: account takeover on 3.0.1 version

I find user reset password hash info and other security info on "/api/v1/users.info" note : I login on rocketchat with ldap account my role : user note: in request "https://target/api/v1/users.info?username=xhttps://target/api/v1/users.info?username=%5Bx%5D" you should change usrname to userId 1-...

Node.js third-party modules: Pixel flood attack cause the javascript heap out of memory

I would like to report Pixel flood attack in jimp It allows flooding the memory and causing DoS by uploading a crafted image 5kb image, and the Jimp module will tries to allocate 4128062500 pixels into memory. Module module name: jimp version: An image processing library for Node written entirely...

Glassdoor: HTML Injection in Glassdoor job sharing emails

HTML injection possibility within the "fromEmail" field of the email template going out from [email protected]. This report was a duplicate of 824165 which should've resolved this issue. Thanks @jackb898 for your report and looking forward to more findings from you...

Shopify: Open Redirect in www.shopify.dev Environment

Summary Reported vulnerability allows attacker for open/unknown redirect for victim user Steps to reproduce 1 Go to https://shopify.dev/concepts/shopify-introduction 2 Click on search 3 Type POC in search box and hit enter 4 Right click on first result displayed as POS and click on copy link...

Concrete CMS: Remote Code Execution through Extension Bypass on Log Functionality

Summary: ===================== The Application concrete5 CMS available on github is vulnerable to remote code execution through the functionality of setting the log file in "Loggin Settings". It is possible to bypass the portion of code responsible for the verification of the extension of the log...

Acronis: Content Spoofing

Vulnerability: Content Spoofing or Text Injection Description: This vulnerability will reflect text on to the web page which is used to scam a victim to visit or send information to a malicious website. Because it is inside the domain and trusted web page, there is chances of scam. Open the Url a...

ExpressionEngine: Low privileges (auth) Remote Command Execution - PHP file upload bypass.

The ExpressionEngine software was vulnerable to a remote command execution flaw due to a bypass in the file upload extension check, which allowed a low-privileged user to execute arbitrary commands...

Node.js third-party modules: Prototype pollution attack (lodash)

I would like to report a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype. Module module name: lodash version: 4.17.15 npm page: https://www.npmjs.com/package/lodash Module Description A modern JavaScript utility library delivering...

HackerOne: Reflected XSS on www.hackerone.com and resources.hackerone.com

Good day : I hope your doing as well as can be during these difficult times. I have found xss at 2 endpoints: https://www.hackerone.com/resources/ and https://resources.hackerone.com The payloads that work are here:...

Myndr: Open Redirect filter bypass through '\' character via URL parameter

Hi, I hope I find you all safe and good regarding those hard times nowadays. Summary: Found an Open Redirect vulnerability on http://meta.myndr.net by bypassing the trusted domain filter using a '' character. I was able to get the original redirection URL from the register button located at...

8x8: Send Phishing/Spam email from [email protected] to any email address.

The Sameroom API contained an endpoint to generate an email to notify the user that the account had been updated. This API request utilized a JSON body that specified the email address and DisplayName of the user without validating the format or characters of the DisplayName. An attacker could ha...

Nextcloud: Possible denial of service when entering a loooong password

You can create a very long password until you get the last user to put and aries or DoS. Normally passwords have 8-10-24 digits. By sending a very long password 1.000.000 characters Usually this problem is caused by a vulnerable password hashing implementation. When a long password is sent, the...

Clario: rxss at https://mackeeper.com page not found via rid parameter

Summary Reflected xss at /mk/api/send-event with rid parameter. Vuln endpoint: https://mackeeper.com/mk/api/send-event?rid= payload: alerttest Steps To Reproduce go to https://mackeeper.com/mk/api/send-event?rid=%3C/script%3E%3Cscript%3Ealertdocument.cookie%3C/script%3E payload:...

U.S. Dept Of Defense: CSRF Account Deletion on ███ Website

Summary: A CSRF vulnerability against the ███████ allows attackers to delete user accounts. Impact Users who visit a malicious website could find their ████████ account deleted. Step-by-step Reproduction Instructions 1. Create and login to a new account on the ██████ 2. Open the provided HTML fil...

Valve: Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_large

Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of itemimagesmall and itemimagelarge. Shell injection was achieved on a publishing gateway through metacharacter injection in an item-upload path...

Glassdoor: [XSS] Reflected XSS via POST request in (editJobAlert.htm) file

Description: first, it was a very good bug for me it starts when I was testing the form for I found a CSRF I sent it here 838778 I tested the form again and after few minutes I found that this parameter locationId in the post request is vulnerable to XSS the page take the value of this parameter...

Zomato: [www.zomato.com] Blind SQL Injection in /php/geto2banner

Hi Team! Our team discovered a Blind SQL Injection by Abusing LocalParams resid in /php/geto2banner We are working to create a full PDF Report as an WriteUp ; Here is a Temporal Exploit based on the Vulnerable request: POST /php/geto2banner HTTP/1.1 Host: www.zomato.com Connection: close...

MTN Group: Insecure crossdomain.xml on https://vdc.mtnonline.com/

Hi, https://vdc.mtnonline.com/crossdomain.xml contains the following xml file: Impact This will make any one able to receive content from https://vdc.mtnonline.com/ , attacker can steal CSRF tokens and user PII. More information about this issue is available here:...

Internet Bug Bounty: Use of uninitialized value in ftp_getrc_msg method of mod_proxy_ftp.c

This is a Security Bug Report for modproxyftp. This bug is present in ftpgetrcmsg method of modules/proxy/modproxyftp.c file. This is the line which causes this bug. c ... mb = aprcpystrnmb, response + 4, me - mb; ... If ftp server returns a response like "\r\n", which has 3 characters with...

Mail.ru: Http Response Splitting on thumb.cloud.mail.ru

Limited CRLF injection at thumb.cloud.mail.ru allowed to manipulate cookies...

WHO COVID-19 Mobile App: Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify Users

Summary: Note: I noticed that that the team has fixed issues like an XSS that's caused only from a header value typically OOS since it's not directly exploitable https://github.com/WorldHealthOrganization/app/pull/855, so in the spirit of this I'm also reporting another "good-to-fix" issue. On th...

LY Corporation: Spring Actuator endpoints publicly available and broken authentication

Due to insufficient access control, it was possible to access the Spring Boot Actuator endpoints /heapdump and /env. @kazan71p identified two highly sensitive applications leaking information through these endpoints. The LINE Security team shutdown the secondary endpoints just as it was discovere...

Mail.ru: Private files exposed to other apps

Insecure handling of external intent in ICQ for Android allowed another local application to force ICQ private files to be copied to insecure location...

Staging.every.org: No Rate Limit On Reset Password

Summary: A rate limiting algorithm is used to check if the user session or IP address has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame, HTTP servers can respond with status code 429: Too Many Requests. wikipedia I...

Visma Public: Read-only user can access payroll information without having access to payroll.

The researcher found that a read-only user without having access to payroll can still access all the data in payroll tab, by visiting the url directly, thus resulting into an unauthorized access...

Nextcloud: user can bypass password enforcement when federated sharing is enabled

If the admin forces password for link shares and federated shares are enabled, users can bypass this enforcement. Tested with Nextcloud 18.0.3 Steps to reproduce: - enable password enforcement for link shares as admin - as user1 create a link share with password - open the link share in a separat...

Shopify: *.shopify.com - Authentication bypass

I´ve found a flaw in the authentication process when accessing the website https://upcoming.shopify.com. There seems to be an HTTP Authentication in place to prevent access without authentication. Please follow below POC to get access to https://upcoming.shopify.com without login. The website is...

U.S. Dept Of Defense: Remote Code Execution via Insecure Deserialization in Telerik UI

Hello, I found an outdated version of Telerik Web UI v2016.2.607.40 at the following URL: https://███/Telerik.Web.UI.WebResource.axd?type=rau. This means that we can achieve full RCE by chaining two different CVEs: CVE-2017-11317, which allows us to upload arbitrary files on the server, and...

Mendix: Reflected XSS in "*.mendix.com/openid/*"

The endpoint at https://sprintr.home-accp.mendix.com/openid/ suffers from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the...

Internet Bug Bounty: mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full (CVE-2020-7065)

PHP bug report made public by the maintainers at the time of writing: https://bugs.php.net/bug.php?id=79371 Mitre CVE page: https://vulners.com/cve/CVE-2020-7065 Link to the release notes: https://www.php.net/ChangeLog-7.php7.4.4 Impact One of impacts is that the issue allows an attacker to...

Liberapay: Leaking Of Sensitive Information on Github

Summary: Sensitive Data were leaked in https://github.com/liberapay/liberapay.com Steps To Reproduce: 1. Install gitleaks from https://github.com/zricethezav/gitleaks 2. Run the following command in a Linux terminal gitleaks -v --pretty -r=https://github.com/liberapay/liberapay.com The following...

Shopify: Session works after logout from Shopify account and password of online store is displayed

When a user creates a Shopify Lite Plan account, in the product creation stage when the account has not been upgraded, the store's password is enabled such that any visitor who wants to access the store is required to enter password before being granted access to view the products listed in the...

Elastic: Create an account on auth-sandbox.elastic.co with email @elastic.co or any other @domain.com

Summary: Dear Team, Today when doing some recon steps and found this subdomain https://54.246.136.164/ Its not loaded correctly and viewing the source code exposed some other links interesting https://elasticsandbox.docebosaas.com/pages/14/learner-dashboard https://auth-sandbox.elastic.co Go to...

Semrush: IDOR in the https://market.semrush.com/

Insecure direct object references in marketplace due to a length restrictions in chosen hashing function...

Quantopian: Ability to perform various POST requests on quantopian.com as a different user - insecure by design.

Summary: Due to excessive control of victim's UI over algorithm collaboration feature one is able to force algorithm collaborator to issue malicious POST requests. Description: Hello again my favorite VDP! WebSockets again. Following vulnerability can be abused to attack a person that we...

WordPress: Improper Access Control in Buddypress core allows reply,delete any user's activity

Description: Improper Access Control in Buddypress core allows reply,delete any user's activity in other public group,which they don't join. Steps To Reproduce: Step 1: Create two account A, B with two public groups Step 2: In group A-account A, create a new activity idA Step 3: In group B-accoun...

Mail.ru: Stored XSS on {https://calendar.mail.ru/}

Stored XSS via event fields in calendar.mail.ru...

WordPress: Privilege Escalation in BuddyPress core allows Moderate to Administrator

Description: BuddyPress core allows Moderate to Administrator in Manage Group Members module Steps To Reproduce: Step 1 : Create two account with two groups Step 2 : In account A, create group abc with this two users. Step 3 : Administrator in group abc promote account B to Moderator Step 4 : In...

Informatica: XXE through injection of a payload in the XMP metadata of a JPEG file

Users are able to change their avatar picture. The avatar picture upload functionality is prone to a XXE attack when parsing the image file. Specifically, the XXE attack is executed through the injection of a payload in the "XMP metadata" of the uploaded JPEG file. Proof of concept note the "Burp...

WHO COVID-19 Mobile App: Probably unexploitable XSS via Header Injection

Summary: The Who-Platform header is reflected in the output of the page if it's not one of the recognized Who-Platform values IOS, ANDROID, WEB. While this is probably no longer exploitable as of 2015, it may be exploitable on less well implemented browsers not Chrome/Firefox/Edge. In general,...

GitLab: Stored XSS in markdown when redacting references

Summary It's possible to inject arbitrary html into the markdown by abusing the ReferenceRedactorFilter. This is due to the data-original attribute allowing html encoded data to be stored, which is then extracted and used as the link content. If the original data already is html encoded then it...

WordPress: CSRF in Profile Fields allows deleting any field in BuddyPress

Description: CSRF in Profile Fields allows deleting any field in BuddyPress Version: Latest Steps To Reproduce: Step1: Using a form like so to create the CSRF: history.pushState'', '', '/' Change your domain and idfield Step 2: When admin click with step 1 was hidden in images,.... Step1 will all...

Mail.ru: mailer.i.bizml.ru viber service preprod information disclosure

DEBUG mode enabled on http://52.29.101.127:1060/ leading to DB login and passwd leaks...

LY Corporation: Insufficient access control on all BCRM instances leading to the ability to create admin accounts using the API

BCRM is a service that helps manage and analyze your LINE Official Account, and provide useful insights. Due to insufficient access control checks in the /admins API endpoint, it was possible for an attacker to create admin accounts. These accounts are "super"-admin accounts meant for internal us...

Zomato: [www.zomato.com] Blind SQL Injection in /php/widgets_handler.php

Disclosing it as per the request from @zzzhacker13. This report is identical to 838855 but it was just on a different endpoint. POC - - :/php/widgetshandler.php?method=getResWidgetButton&resid=51-CASE//WHENLENGTH​version​=​10​THENSLEEP61END Zomato Security Team...