Node.js third-party modules: [windows-edge] RCE via insecure command formatting

I would like to report a RCE issue in the windows-edge module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: windows-edge version: 1.0.1 npm page: https://www.npmjs.com/package/windows-edge Module Description Launch a new Microsoft Edge tab on Windows...

Node.js third-party modules: [objtools] Prototype pollution

I would like to report a prototype pollution vulnerability in objtools module. It allows an attacker to inject properties on Object.prototype. Module module name: objtools version: 2.0.1 npm page: https://www.npmjs.com/package/objtools Module Description objtools provides several utility function...

Node.js third-party modules: [extend-merge] Prototype pollution

I would like to report a prototype pollution vulnerability in extend-merge module. It allows an attacker to inject properties on Object.prototype. Module module name: extend-merge version: 1.0.5 npm page: https://www.npmjs.com/package/extend-merge Module Description Shallow extend and deep merge...

Node.js third-party modules: [object-path-set] Prototype pollution

I would like to report a prototype pollution vulnerability in object-path-set module. It allows an attacker to inject properties on Object.prototype. Module module name: object-path-set version: 1.0.0 npm page: https://www.npmjs.com/package/object-path-set Module Description set values in...

Node.js: Child process environment injection via prototype pollution

Summary: prototype pollution causes polluted system environment for child processes. Description: This can be used to inject arbitrary --require flags to node.js child processes or in the case of current node.js versions it can be used to inject arbitrary JavaScript to child processes. In practic...

Topcoder: Blind stored XSS due to insecure contact form at https://www.topcoder.com leads to leakage of session token and other PII

Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://www.topcoder.com/contact-us/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets...

HackerOne: GraphQL field on Team node can be used to determine if External Program runs invite-only program

On 19th May, A new parameter policymarkdownhtml been introduced inside the team Graphql query. Using Graphql query, We can able to determine External program running privately on Hackerone as policymarkdownhtml parameter was able to fetch private internal policy. Note: Using this parameter, it wa...

U.S. Dept Of Defense: PII/PHI data available on web https://████████Portals/22/Documents/Meetings

Summary: https://███Portals/22/Documents/Meetings contains many internal documents which likely were reviewed on meeting/meetings preparations which should not be available for public but searchable via google/bing. Documents include: resumes, bio data form, emails including history of medical...

Node.js third-party modules: [keyd] Prototype pollution

I would like to report a prototype pollution vulnerability in keyd module. It allows an attacker to inject properties on Object.prototype. Module module name: keyd version: 1.3.4 npm page: https://www.npmjs.com/package/keyd Module Description A small library for using and manipulating key paths i...

Kubernetes: Hard coded Username and password in GiHub commit

Report Submission Form Summary: I was exploring the GitHub repository and I found some hard coded credentials in the commit history. These credentials are related to Vagrant tool which is used to setup virtual machines environment, This is a very critical disclosure and can lead to bigger damages...

Kubernetes: Internal IP addresses range and AWS cluster region leaked in a Github repository

Report Submission Form Summary: I was exploring the GitHub repository and found some internal IP address and its cluster region related to AWS cluster. So i decided to report it to you. Please have a look and let me know. Steps To Reproduce: VISIT THIS LINK : Repository - kubernetes / kubernetes...

Lark Technologies: User with single department permission can view applicant list of all department's

An endpoint was discovered that did not properly check for user permissions which could have caused unauthorized access to view pending approval requests, email addresses, and phone numbers belonging to other departments. We thank @imrannisar for reporting this to our team and confirming the...

Concrete CMS: Time-base SQL Injection in Search Users

Description ===================== I've identified an SQL injection vulnerability in the website labs.data.gov that affects the endpoint /index.php/dashboard/users/search and can be exploited via the fSearchDefaultSortDirection param. I didn't extract any data from the database, I've confirmed the...

Kubernetes: Private RSA key and Server key exposed on the GitHub repository

Report Submission Form Summary: I was searching for sensitive data in Kubernetes repository where I found these private keys. These are private RSA key and private server key, which could be used for unauthorized access. Steps To Reproduce: VISIT THESE LINKS Repository : kubernetes / kubernetes...

Valve: Signedness issue in ClassInfo message handler leads to RCE on CS:GO client

Title: Signedness issue in ClassInfo message handler leads to RCE on CS:GO client Scope: csgo.exe Weakness: Array Index Underflow Severity: Critical 9.6 Link: https://hackerone.com/reports/876719 Date: 2020-05-17 20:31:35 +0000 By: @chaynik Details: Vulnerability ------------- CSVCMsgClassInfo...

U.S. Dept Of Defense: Remote Code Execution through DNN Cookie Deserialization

Summary: The application at https://████████ presents a deserialization vulnerability that permits RCE and file read/write Step-by-step Reproduction Instructions 1. Navigate to a random page that must return a 404 Error status like https://████/test 2. Add this cookie in the request header:...

InnoGames: Impersonation and ticket id enumeration on support.innogames.com

A missing check for authorization made it possible to answer tickets owned by other users in their own name...

Monero: Remote node DOS

A vulnerability was discovered in monerod, the Monero daemon. The vulnerability allowed an attacker to repeatedly request enough objects to fill the outgoing send queue for each peer-to-peer connection, causing the connection threads to sleep for approximately 6 seconds and then terminate the...

Topcoder: SSRF at https://cognitive.topcoder.com leads to AWS instance metadata due to vulnerable email subscription feature

Summary: Topcoder makes use of Amazons AWS in their web application environment. I noticed a feature that allows a user to subscribe and receive emails from Topcoder. This feature is vulnerable to server side request forgery since it allows a user to supply an arbitrary URL which the application...

Starbucks: Singapore - Account Takeover via IDOR

ko2sec discovered that an alternate site shared database and cookie credentials with card.starbucks.com.sg. By exploiting an endpoint on the alternate site, ko2sec was able to copy a PHPSESSID cookie value from that site over to card.starbucks.com.sg and then see user information, update the...

Starbucks: Misuse of an authentication cookie combined with a path traversal on app.starbucks.com permitted access to restricted data

zlz and rhynorater discovered that by obtaining a valid authentication cookie and then combining that with a path traversal, this allowed access to restricted data. noapearson assisted by providing additional information post discovery. @zlz / @rhynorater / @noapearson — thank you for reporting...

Stripo Inc: Integer Overflow (CVE_2017_7529)

Integer Overflow - The issue affects nginx 0.5.6 - 1.13.2...

Brave Software: Cookie steal through content Uri

Summary A misconfiguration in a content provider is allowing Brave for Android to download internal files to Downloads folder, making them accessible to other apps. A malicious app could order Brave to download the cookies database and retrieve it afterwards. Environment - Device: HTC M8 - OS...

DuckDuckGo: DOM XSS on duckduckgo.com search

Hello, The is a DOM XSS vulnerability on https://duckduckgo.com search through the relsexp parameter. PoC URL: https://duckduckgo.com/?q=a&relsexp="&ia=web Screenshot: F830875 Video: F830880 Impact The attacker can execute JS code...

Lark Technologies: RPC Implementation allows unauthenticated remote calls

It was found that the RPC implementation via postMessage within Lark did not check origin, so an attacker could have potentially performed RPC calls on behalf of a user. We thank @mike12 for reporting this to our team and confirming the resolution...

Mail.ru: User session access due to Oauth whitelist host bypass and postMessage

A destination for postMessage was not properly restricted on connect.mail.ru allowing crossite access to session, as was shown for 3k.mail.ru application session. Both connect.mail.ru and 3k.mail.ru belong to Ext.B scope, this scope does not offer a bounty for attacks with clientside vectors on t...

curl: Invalid write (or double free) triggers curl command line tool crash

Summary: Whilst fuzzing libcurl built from git commit a158a09, a crash triggered by an invalid write or maybe a double/invalid free was found. Steps To Reproduce: Run: echo "LVQvCnVyIDA=" | base64 -d test0000 ./curl --verbose -q -K test0000 file:///dev/null Stack: valgrind -q src/curl --verbose -...

U.S. Dept Of Defense: Register with non accepted email types on https://███████

Summary Hello, this is a new report from 874457. Thank you @agent-l8 for your advice, really appreciate it. This report is about register with non-accepted email types on https://███████ Steps to Reproduce 1. Register With Not Accepted Email Types 2. Go to https://█████████ 3. Fill all the field...

U.S. Dept Of Defense: RCE (Remote code execution) in one of DoD's websites

Summary: The targeted website is vulnerable to CVE-2017-1000486, by only running command was whoami to prove that the RCE exist has been run successfully on the target Description: The target uses a vulnerable version of primefaces : Primetek Primefaces 5.x, that is vulnerable to a weak encryptio...

curl: Partial password leak over DNS on HTTP redirect

Summary: From version 7.62 curl and curllib leaks part of user credentials in the plain text DNS request. This happens if the server makes redirect, both 301 and 302 to a relative path eg header 'Location: /login'. It is NOT an issue in case of absolute redirection eg header 'Location:...

Shopify: Partner's non-verified business email change reflected into Shopify Collaborator Request

Details In https://partners.shopify.com a Partner must validate his email address prior making a request to manage a store. An email is then being sent to the Shop owner and it only includes the Partner's Business Name and it also links to the Collaborator Request Review to either accept or decli...

Insulet Corporation: Subdomain Takeover due to unclaimed domain pointing to Acquia Cloud

ssue Details The consultant identified that subdomain http:// or https://qa.myomnipod.com Web Site Not Found Sorry, we could not find any content for this web address. Please check the URL. If you are an Acquia Cloud customer and expect to see your site at this address, you'll need to add this...

U.S. Dept Of Defense: Tomcat examples available for public, Disclosure Apache Tomcat version, Critical/High/Medium CVE

Summary: There are multiple issues found on ███: 1. ███████/examples/ - Apache Tomcat examples are available for public. Multiple issues - session and cookies manipulation, internals IP disclosure. 2. Error page contains information about Apache Tomcat version 3. Reported Tomcat version is...

GitLab: Use of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilities

I was digging through the gitlab-foss repository and noticed an interested pattern that seems to be adopted in a few places: the use of Forwardable with meta-programming over delegators, explicit attrreader methods or methodmissing. Heads up: the arbitrary file read vulnerability I demonstrate in...

Mail.ru: capsula.mail.ru - Admin blind stored XSS

Stored XSS in capsula.mail.ru admin interface via vector demonstrated in 873818. Хранимый xss в панели администратора на capsula.mail.ru через окно "оценки процесса покупки"...

U.S. Dept Of Defense: HTML Injection leads to XSS on███

Hello Team! I just found a HTML injection in subdomain████ that leads XSS with several payloads, let me show you the POC. POC 1 Firefox 76 █████ --- POC 2 Chrome 81 ███████ --- Impact An attacker could use the domain to trick users to execute malicious javascript code. Step-by-step Reproduction...

VK.com: [m.vk.com] XSS на страницах /artist/

XSS при возвращении со страницы артиста. Insufficient validation of the from parameter at the artist page allowed the attacker to inject external URLs into the "Back" link using the LF char: https://m.vk.com/artist/marduk?from=%0A/external.com html When clicked, an ajax request to its URL was sen...

Mail.ru: [my.games] Stored XSS via untrusted bucket

Domain, site, application -- https://my.games/ Details -- If you check page source of https://my.games, you can notice that site gets static files scripts, styles, images using following URL declaration: https://my.games/hotbox/mygames/frontend/v3-6-13/img/share/main.png mygames here is a name of...

Mail.ru: Reflected XSS

Reflected XSS in target.my.com/ via URI GET parameter...

U.S. Dept Of Defense: SSN is exposed on slides, previous critical report was not fixed in an appropriate way

Summary: SSN is exposed on slides, previous critical report was not fixed in an appropriate way Description: 1. SSN is exposed on a screenshot. Slide 13th. SSN is covered by an olive/green rectangle which is moveable. The image itself was not updated. ██████wp-content/uploads/2018/12/████████ 2...

Mail.ru: capsula.mail.ru - reflected xss

XSS in capsula.mail.ru on support chat message lead to stored XSS in capsula.mail.ru admin interface 874387 This XSS lead to stored-xss in the admin-panel 874387 rubukkit.org...

PlayStation: Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' Application

Summary The PlayStation Now application version 11.0.2 is vulnerable to remote code execution RCE. Any website loaded in any browser on the same machine can run arbitrary code on the machine through a vulnerable websocket connection. 1. The local websocket server at localhost:1235 does not check...

Concrete CMS: Stored XSS in the file search filter

Download Concrete5 8.5.2 and install it 2. Log into your Concrete5 instance as admin 3. Go to Dashboard Files Search 4. In the file search bar, click Advanced 5. In the window that appears, enter a phrase and click the save button, paste the following payload: and click the save button 6. In the...

Concrete CMS: Stored XSS on express entries

Download Concrete5 8.5.2 and install it 2. Log into your Concrete5 instance as admin 3. Go to Dashboard System settings Express entities /index.php/dashboard/system/express/entities 4. Сlick on the Create button 5. in the field Name paste the following text: alert1 6. Go to tab View Objects...

U.S. Dept Of Defense: RXSS - https://████████/

Hello All I Found RXSS in your OWN Website Steps To Reproduce Go to Those Links. https://██████/A'onerror=%22alert%601%60%22testabcd/ Browsers I test them on Firefox and Google Chrome. Fix:- Filter input on arrival Encode data on output Use appropriate response headers Content Security Policy...

Kubernetes: Plaintext storage of a password on kubernetes release bucket

Report Submission Form Summary: During my recon I found these two buckets dl.k8s.io and dl.kubernetes.io which actually redirects to https://storage.googleapis.com/kubernetes-release/. By searching the string "password" under https://storage.googleapis.com/kubernetes-release/ I found a file calle...

GitHub Security Lab: CodeQL query to detect SSRF in Python

This bug was reported directly to GitHub Security Lab...

curl: Curl_auth_create_plain_message integer overflow leads to heap buffer overflow

Summary: There is an incorrect integer overflow check in Curlauthcreateplainmessage in lib/vauth/cleartext.c , leading to a potential heap buffer overflow of controlled length and data. The exploitation seems quite easy, yet the vulnerability can only be triggered locally and does not seem to lea...

HackerOne: Unauthorized access to metadata of undisclosed reports that were retested

Summary: reportretests object in User node discloses some information about undisclosed report Description: An attacker can get some infomation such as "assetname" , "assettype" , "severityrating" , "weaknessname" of undisclosed report Steps To Reproduce 1. Invoke the below graphql call POST...

Node.js third-party modules: [plain-object-merge] Prototype pollution

I would like to report a prototype pollution vulnerability in plain-object-merge module. It allows an attacker to inject properties on Object.prototype. Module module name: plain-object-merge version: 1.0.1 npm page: https://www.npmjs.com/package/plain-object-merge Module Description Extremely fa...