15406 matches found
Zomato: [www.zomato.com] Blind SQL Injection in /php/widgets_handler.php
Disclosing it as per the request from @zzzhacker13. This report is identical to 838855 but it was just on a different endpoint. POC - - :/php/widgetshandler.php?method=getResWidgetButton&resid=51-CASE//WHENLENGTHversion=10THENSLEEP61END Zomato Security Team...
Open-Xchange: Buffer overread in parse_angle_addr called from message_address_parse_path
Call messageaddressparsepathpooldatastackcreate, data0, size0, &addr2; with input 0x3c,0x40,0x5b,0x40,0x40,0x28, ie parser.data == '@' if parsedomainlistctx 0 && ctx-parser.data == ':' ctx-parser.data++; - else if parsingpath && ctx-parser.data != ':' + else if parsingpath && ctx-parser.data...
Open-Xchange: Multiple buffer over reads in mbox_from_parse
Vulnerabilities were found fuzzing mboxfromparse Different inputs reproducing the behavior are 0xe7,0xdf,0x1,0x0,0x30,0x3f,0x20,0x32,0x20,0x30,0x3a,0x32,0x39,0x20,0x3f,0x3f,0x3f,0x20,0x34,0x39,0x30,0x34,0xdb,0x32,0x32,0x3a,0x32,0x36,...
DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Security Configurability - Notification email is not sent when email is changed.
A notification email is not sent when the email address is changed. Notification email is not sent when email is changed. Best Practices As recommended practices, Important tasks like changing emails should have notification emails. |Technical severity|VRT category| Specific vulnerability...
PlayStation: Access Token Smuggling from my.playstation.com via Referer Header
I discovered a way to smuggle an access token from my.playstation.com via Referer header through chain of open redirection vulnerability. On my investigation of authentication flow I found this endpoint with potential site for open redirect vulnerability...
DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Security Configurability - The user's can set an existing password as a new password.
An application is allowing user to set new password same as that of the old password. Passwords are entirely user's responsibility but As the old password may be exposed to other users, depending on the security password policy application, it should not be possible to set a new password value...
DRIVE.NET, Inc.: [www.drive2.ru] There is no rate limit for comments endpoints.
The "add comment" endpoint was improperly rate-limited so the potential attacker could post a large number of comments, overloading the server and the notification system. Summary The add comment endpoint was improperly rate-limited so the potential attacker could post a large number of comments,...
DRIVE.NET, Inc.: [www.drive2.ru] CSRF through FCTX token bypass
During login on the login page, login is attempted through the FCTX token. In addition, the login page was implemented through g-recaptcha-response captcha, but an attacker can bypass g-recaptcha-response captcha without FCTX tokens, and login CSRF is possible. The issue was fixed by enabling the...
DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Security Configurability - Email notification is not being sent while changing passwords
Email notification was not sent while changing passwords. This issue was fixed. Best Practices As recommended practices, Due to missing notification email when changing password, If the password has been maliciously changed, the user will not be able to notice it, so immediate security measures...
Valve: ajaxgetachievementsforgame is not guarded for unreleased apps
Due to an access control bug in the 'ajaxgetachievementsforgame' method, a public profile could accidentally expose achievement names, display names, and descriptions for unreleased games. The caller would need to find a player with achievements for the unreleased app...
Helium: Organization Takeover via invitation API
Hello @helium, today I would like to show you how a malicious user could exploit an IDOR affecting the /invitations resource to gain Administrator privileges inside an organization of which he's part of as a reader. Steps to reproduce the bug Setup Let's assume that three accounts exist: -...
HackerOne: Login CSRF vulnerability on hackerone.com
Summary Hi. We found a CSRF token bypass on the Hacker One login page. So, this report describes Hacker One login CSRF Token Bypass. Exploitation process Hacker One uses the authenticitytoken token during login to prevent CSRF. However, the authenticitytoken token is not properly verified, so an...
Slack: XSS on link and window.opener
A vulnerability was found in Slack that allowed for cross-site scripting XSS attacks through a link and the window.opener property. This could lead to redirection to malicious sites or execution of JavaScript code. The impact of this vulnerability was potentially severe...
Mail.ru: Improper access control leading to deletion of Greeting videos on {https://smtp.8mar.mail.ru/}
smtp.8mar.mail.ru was pointing to partner-operated service where it was possible to delete uploaded greetings videos. No risks for Mail.ru users or active projects were identified...
Kubernetes: DoS for GCSArtifact.RealAll
Hi, I'm not be goot at english, if have anything don’t understand, please contact me. Thanks! Summary: attackers can control artifactName list make google storage client download large object cause denial of service. Component Version:...
Clario: Information disclosure of Internal php files on [mackeeper.com/blog/api/send-event]
Summary Vulnerable URL: https://mackeeper.com/blog/api/send-event contains service information Steps To Reproduce Step-1: Go to https://mackeeper.com/blog/api/send-event you will get MethodNotAllowedHttpException and different PHP files error info Step-2: After that, I have a change method to POS...
WordPress: Allow authenticated users can edit, trash,and add new in BuddyPress Emails function
Description: Allow author can edit, trash,and add new your posts in BuddyPress Emails function And editor can edit,trash, add new any posts in BuddyPress Emails default. Steps To Reproduce: Step 1 : Create two accounts: Admin and Author Step 2: Login with admin account. In admin account, give...
LY Corporation: Blind SSRF in social-plugins.line.me
LINE Social Plugins https://social-plugins.line.me/ is a service that provides LINE users with content sharing on the web. This Blind SSRF attack was caused by bypassing the DNS verification of the parameter value received. It could have made requests to internal servers or scanned internal netwo...
Acronis: Broken Access Controls
The End Point notary.acronis.com Blocks access to the panel if you are not an authenticated user. More is possible to access some functions of the panel by adding the .html at the end See Poc From Video Below Impact Broken access control vulnerabilities exist when a user can in fact access some...
Rocket.Chat: [Security Vulnerability Rocket.chat] HTML Injection into Email via Signup
Description Due to a lack of sanitization and validation in parameter affected, we can input HTML Tag and system will render it into Email victim. Affected Endpoint https://chat.oas.greenhost.net/home Parameter : Name Step to produce In textbox name, input HTML code like "\”@x.y " And in Email,...
Slack: Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack users
An issue in Slack's Create snippet feature results in filetypes being displayed incorrectly. This can lead to RCE if a Slack user downloads an executable file thinking that it is a CSV or other benign file type. https://www.youtube.com/watch?v=cIlGfnn4iG8...
CS Money: SSRF via 3d.cs.money/pasteLinkToImage
Summary: SSRF via 3d.cs.money/pasteLinkToImage The functionality fails to validate URL in link-parameter allowing attacker to create server-side request forgery attacks. As the server does a full HTTP-request, this can for example be used to: - DDoS-attacks towards internal and external hosts. -...
Valve: Buffer overflow In hl.exe's launch -game argument allows an attacker to execute arbitrary code locally or from browser
Half Life 1 allows users to set various launch arguments when running the game from the command line, one of them is "-game" which specifies the game/mod to be launched. Documented here hl.exe -game The contents of this argument is copied via a call to strcpy onto the stack without any size...
Kubernetes: Clickjacking
Report Submission Form Summary: Clickjacking is an attack that tricks a user into clicking a webpage element which is invisible or disguised as another element Description: Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user...
Mail.ru: Stored xss on https://go.mail.ru/
Reflected XSS via GET parameter in go.mail.ru...
Open-Xchange: Buffer over-reads in i_stream_zlib_read
This can be reproduced by a sample program using libcompression int mainint argc, char argv const unsigned char datadec; sizet sizedec; const uint8t data = argv1; sizet size = strlendata; struct istream testinput = testistreamcreatedatadata, size; const struct compressionhandler handler =...
Rocket.Chat: Android App Crashes while sending message to users/ on channel
Description I found a security vulnerability in Rocket's latest android app by which I was able to remotely crash any user’s app instantly just by just sending a simple message in private or in channel. The vulnerability require the victim open the message. Devices and Versions Rocket.Chat.Androi...
GitLab: XSS on Issue reference numbers
Dear team, I found an XSS that occurs when users move mouse over reference numbers of issues. This XSS occurs on Firefox. It does not occurs on Webkit-based ones such as Safari, Chrome. I haven't tested on Edge. It can be also occured in older browsers due to svg4everybody and...
Informatica: RXSS in http://procurement-businesscatalog.informatica.com
Hi, this is a simple XSS in the host below: Reproduction Steps Visit the following URL: http://procurement-businesscatalog.informatica.com/JPBC/login.hbc?lang=%3C/SCRIPT%3E%3CSCRIPT%3Ealertdocument.domain;%3C/SCRIPT%3E F760997 Impact Standard XSS impact...
Qulture.Rocks: XSS from arbitrary attachment upload.
Summary: The New Comment feature in the OKRs page allows a user to upload an arbitrary file. I was able to upload HTML file that contains Javascript code. The Javascript code will execute when victim access visits the attachment. Steps To Reproduce: 1. Upload an HTML file that contains javascript...
Mail.ru: [pulse.mail.ru] Доступ к статистике чужих площадок
Few API methods of pulse.mail.ru were not properly restricted and could be used to obtain statistics information for arbitrary domains...
Kubernetes: "Self" DOS with large deployment and scaling
Report Submission Form Summary: Good day! I was just messing around with some functions and trying to see what the impact was on my cluster. I found out that it took quite some resources to process a larger deployment, especially when scaling it. When I check your security release process I notic...
Internet Bug Bounty: tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c
There seems to be a heap-based buffer overread while running tcpdump on a crafted pcap file. A similar behavior is seen when tcpdump is listening on an interface and the contents of this file is relayed over the network. Please find the detailed report on github...
Open-Xchange: Null pointer dereference in SMTP server function smtp_command_parse_data_with_size
Sending the following bytes to the SMTP server induces a NULL pointer dereference...
Nextcloud: Missing server side controls when editing the board’s sharing permissions per user
Author: Silvia Väli, Clarified Security https://www.clarifiedsecurity.com/silvia-vali/ Date: 24th of March, 2020 Description: When the regular user is visiting the Deck view, all created boards are displayed along with the ones that are shared with the user by others. Available functionality with...
Open-Xchange: Null pointer dereference in SMTP server function smtp_string_parse
Sending the following bytes to the SMTP server induces a NULL pointer dereference...
Slack: Stored XSS in files.slack.com
We want to once again thank researcher @oskarsv for informing us of this issue. In the original submission that we previously disclosed here: https://hackerone.com/reports/783877, Oskarsv detailed a remote code execution vulnerability that hinged on the functionality of Slack’s “Posts” feature...
Qulture.Rocks: Privilege escalation from member user ( editor ) to admin user
Qulture.Rocks has multiple levels of admins, where you could manage parts of the application. One of those levels had a wrong configuration, which did not blocked it from updating its level to a higher one. Our team worked rapidly to fix this issue, blocking said level of updating itself...
Acronis: Missing rate limit for current password field (Password Change) Account Takeover
Vulnerability: Missing Rate Limit for Current Password field Password Change Account Takeover Steps to reproduce the bug: 1Go to Profile Password. Enter any wrong password In current password filed. 2Now enter the new password and Turn the Intercept ON. 3Capture the request & Send the request to...
Glassdoor: IDOR Vulnerability in Job Preferences
An attacker has the ability to change a victim's job preferences through an IDOR vulnerability. The issue exists in the following endpoint: https://www.glassdoor.com/member/profileApi/preferences/delete.htm...
GitLab: Arbitrary file read via the UploadsRewriter when moving and issue
Summary The UploadsRewriter does not validate the file name, allowing arbitrary files to be copied via directory traversal when moving an issue to a new project. The pattern used to look for references is : MARKDOWNPATTERN = %r!?.?\/uploads/?0-9a-f32/?.?.freeze This is used by the...
Open-Xchange: Use after free in smtp_server_connection_handle_command
Function smtpserverconnectionhandlecommand in src/lib-smtp/smtp-server-connection.c creates a variable named cmd with cmd = smtpservercommandnewtmpconn, cmdname, cmdparams; It gets used with return cmd == NULL || !cmd-inputlocked; ie cmd-inputlocked dereferences the pointer But we can get to this...
Razer: HTML injection in support.razer.com [IE only]
The tester discovered the support.razer.com site had an HTML injection vulnerability that could have facilitated a phishing attack. Razer thanks the tester for his report and for working with the team to help remediate...
PlayStation: Authorization Token on PlayStation Network Leaks via postMessage function
Description After some analysis on how playstation network authentication work, I came across a certain pattern of how authorization tokens are handled. The web application utilizes postMessage function to exchange authorization tokens between windows/frames. To simplify this, let's follow on one...
GitLab: SSRF on project import via the remote_attachment_url on a Note
Summary The Note model has an attachment which is provided by a CarrierWave uploader: ruby mountuploader :attachment, AttachmentUploader One of the features this provides is the ability to download and attach a file via a url, see...
Qulture.Rocks: Unrestricted File Upload in Chat Window
Summary: The application allows the attacker to upload dangerous file types that can be automatically processed within the product's environment. Steps To Reproduce: 1. Hit the browser with below URL. https://qa.qulture.rocks/en/users/signin 2. Open The Cat window. 3. Upload any exe file . 4. Cli...
BlockDev Sp. Z o.o: load scripts DOS vulnerability
load scripts DOS vulnerability...
HackerOne: program_analytics_benchmarks query shows information not visible in public
Summary: programanalyticsbenchmarks is displaying information i don't see yet in public profile of a program. Description: I tried querying programanalyticsbenchmarks for the program security and ██████ and it showing information i cannot find in public profile especially in ███████ Steps To...
PlayStation: SSRF chained to hit internal host leading to another SSRF which allows to read internal images.
Report Summary: We found an SSRF at https://image.api.np.km.playstation.net/ Vulnerable endpoints: /images , /dis/images. using image GET parameter. Description This endpoint allows us to fetch a remote image over HTTP protocol using the image GET parameter and convert them to the desired format...
PlayStation: Use-After-Free In IPV6_2292PKTOPTIONS leading To Arbitrary Kernel R/W Primitives
Summary Due to missing locks in option IPV62292PKTOPTIONS of setsockopt , it is possible to race and free the struct ip6pktopts buffer, while it is being handled by ip6setpktopt. This structure contains pointers ip6popktinfo that can be hijacked to obtain arbitrary kernel R/W primitives. As a...