MTN Group: Upload directory of Mtn.co.sz has listing enabled

Summary: There are some exposed files accessible for anyone Steps To Reproduce: Go to http://www.mtn.co.sz/wp-content/uploads/ and navigate between available folders Impact Every uploaded data can be accessible through this directory listing vulnerability This might include several...

DataStax: Helpdesk Takeover at dmc.datastax.com

Summary: DNS record dmc.datastax.com is pointing to stale dmc-support.zendesk.com domain on Zendesk which is available for takeover. DNS Stale Records: F661014 Proof of Concept: There was no helpdesk configured at this address, which means that the address was available and anyone could claim it....

U.S. Dept Of Defense: Reflected Xss https://██████/

Hello security all teams Relevant Products/Components: last version Detailed Description: Reflected XSS so have high impact. Steps To Reproduce: 1-go in subdomain 2-and check url if tableau uses 3-Uses you can add this redirect dir in url with Authentication redirect:-...

Reverb.com: Race Condition allows to redeem multiple times gift cards which leads to free "money"

Hello team! I've found a Race Condition vulnerability which allows to redeem gift cards multiple times. This how a s/he can easily buy stuff just bying one gift card and redeem it over and over again. Steps to reproduce Preparations - Burp Suite Pro - Turbo Intruder Note: This also can be...

Stripo Inc: Tabnabbing in template comments - stripo.email

Tabnabbing - template comments on stripo.email Tabnabbing - template comments on stripo.email...

Stripo Inc: Stored XSS in template comments.

Stored XSS - template comments on stripo.email Stored XSS - template comments on stripo.email...

Mail.ru: XSS via POST request to https://account.mail.ru/signup/

Reflected XSS in account.mail.ru via POST parameter back...

Mail.ru: XXE на webdav.mail.ru - PROPFIND/PROPPATCH

XXE injection in webdav.mail.ru...

Mail.ru: Blind SSRF на calendar.mail.ru при импорте календаря

Blind SSRF in calendar.mail.ru via calendar import functionality...

U.S. Dept Of Defense: Reflected Xss

hello security team i found reflected XSS in this subdomain https://███ POC:- 1-go in subdomain 2-go here https://███████/en/embeddedAuthRedirect.html?auth=javascript:alert"xElkomy" 3-Done Image:- ███████ xElkomy Impact reflected cross-site scripting XSS operation with JavaScript, which runs in t...

Nord Security: CORS Misconfiguration on nordvpn.com leading to Private Information Disclosure,Account takeover

Summary: An cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of th...

InnoGames: Blind SQL Injection

Summary of the Issue A Time Based Blind SQL injection vulnerability was detected on www.innogames.com. Using a specifically crafted payload it was possible to extract database entries. Vulnerable endpoint: https://www.innogames.com/ Steps to reproduce: 1. Getting two states for boolean based sql...

Mail.ru: Stored XSS in calendar via UID parameter

Stored XSS in calendar.mail.ru via UUID of calendar...

Internet Bug Bounty: HTTP Smuggling multiple issues in Squid 3.x & squid 4.x

Hello, as can be seen on a recent public security update by Squid I reported several smuggling issues. If you want some background on impact of Smuggling issues You can check the current works of James Keetle or my own previous published works. https://www.youtube.com/watch?v=upEMlJeUIk HTTP Desy...

Mail.ru: API method at api.my.games allows to enumerate user emails

API method which allowed to enumerate emails at https://api.my.games/ was not sufficiently protected...

Nord Security: Host header injection/redirection | signup and login page

Hey Team. There's a host header injection vulnerability in signup and login page. If possible, the application should avoid incorporating user-controllable data into redirection targets. In many cases, this behavior can be avoided in two ways: Remove the redirection function from the application,...

Razer: Expired reCAPTCHA site key leads to Rate Limit Bypass and Email Enumeration

The tester discovered a configuration issue involving Google reCAPTCHA that would allow adversaries to enumerate valid email addresses for users. While minor, Razer appreciates the report and clear PoC...

Phabricator: Markdown parsing issue enables insertion of malicious tags

mongoose By exploiting the URL markdown an attacker is able to add tags to an anchor-element. This is less impactfull since the default csp policy blocks inline javascript execution, but an attacker could deface individual pages, bypass the rel="norefferrer" tag to perform tab nabbing or perform...

New Relic: Restricted user can manage the NerdGraph entities' tags

Hey team, I've found that the Restricted user can manage the NerdGraph entities' tags: - create new ones; - edit and/or remove current ones. It seems that the tags are supposed to be used internally by account administration and unauthorized removing of them can cause some issues. Thus, this repo...

Mail.ru: HTML injection at face.city-mobil.ru

Browser-specific IE HTML injection in city-mobil.ru On the moment of reporting, HTML injection within this scope was considered under same condition with XSS. Under current rules, HTML injection without proven XSS execution may be not eligible for bounty. https://rdot.org/forum/showthread.php?t=2...

Razer: [Razer Pay Mobile App] Broken access control allowing other user's bank account to be deleted

The Razer Pay MY backend API had an access control vulnerability which would allow a client to delete the account of other users by varying the ID. Although an adversary could not target a specific individual by name, they could affect the integrity of the Razer Pay system. This was fixed in...

Mail.ru: Leak Sensetive Data at face.city-mobil.ru

Unrestricted git directory in face.city-mobil.ru could leak sensitive data including access token for internal repository...

Mail.ru: Public available Sensitive Information about drivers

Domain, site, application -- API for client app Citimobil https://c-api.city-mobil.ru/ Version 4.33.0 and others Testing environment -- Device on any OS with internet connection Any software to send https requests Steps to reproduce -- Send POST request to url...

Shopify: Stored XSS in Shopify Chat

1.install app Shopify Chat 2.Click chat on the shop homepage or Shopify Ping to send poc javascript:alert1//https://dqdqdqdqdq.myshopify.com 3.Click url, alert F657395 Impact 1.Front end user Self-XSS 2.Administrator XSS foreground user...

Razer: Misconfigured Bucket [razer-assets2] https://assets2.razerzone.com/

The tester discovered an S3 bucket exposure at assets2.razerzone.com. We appreciate the tester bringing this to our attention...

PUBG: RXSS to Stored XSS - forums.pubg.com | URL parameter

René Kroka found a Reflected XSS vulnerability that could be chained to a Stored XSS attack in the Invision Community forums software used by PUBG. By crafting a malicious URL the attacker is able to trigger Javascript to execute on their own page; known as Reflected XSS. The attacker then create...

Polymail, Inc.: Reflected XSS by changing url parameters on the user invite onboarding links.

@renekroka Discovered a potential reflected XSS by changing url parameters on the user invite onboarding links. 1...

Nord Security: Potential leak of server side software at repogohi.nordvpn.com

Summary: I found a public Git Repository at https://repogohi.nordvpn.com/. It looks like the software components in this repository are part of the VPN Servers. So I'm afraid there's a certain risk. The following packages are among others publicly available: openvpn-xor2.4.5-stretch1nordamd64.deb...

Nord Security: Blind SSRF on debug.nordvpn.com due to misconfigured sentry instance

Summary: The debug subdomain uses Sentry for application monitoring and error tracking. This software comes with a feature known as source code scraping turned on by default which makes it is possible to make blind get requests from the server on which it is running. Steps To Reproduce: add detai...

Shopify: Timeline Editor Self-XSS (Previous Fix #738072 Incomplete)

1.Consistent steps 2.poc: axxx 3. F656339 Impact admin...

Ruby on Rails: Prevent XSS when passing a parameter directly into link_to

Note: I would say this is perhaps more of a feature request than an actual vulnerability, but Rafael França deleted this from GitHub and asked to submit it here instead In a rails views it's easy to accidentally create an XSS vulnerability by using the following in a template: Doing this exposes...

Mail.ru: Stored XSS on https://community.my.games/ (Add Post)

Two stored XSS at https://community.my.games/. First XSS via upload photo title at link https://community.my.games/community/game/GameName/ . Second XSS via Discussion at the same link...

Mail.ru: Mail.Ru Top - Website Counter Bruteforcing

counter-specific password at top.mail.ru was not sufficiently protected against bruteforce...

WordPress: Stored XSS on Wordpress 5.3 via Title Post

I have identified a WordPress security vulnerability , a Stored XSS vulnerability that affects latest version of WordPress 5.3 POC: 1 Login to wordpress website 2 Make a post with title payload xss like example alertdocument.domain; 3 Publish then open the post, XSS Will trigger Impact Can steali...

Razer: Improper Authorization at https://api-my.pay.razer.com/v1/trxDetail?trxId=[Id] allowing unauthorised access to other user's transaction details

The tester determined that the Razer Pay backend server could be exploited to obtain transaction details from another user. Razer Fintech appreciates the detailed report and clear PoC...

Razer: Insecure Processing of XML leads to Denial of Service through Billion Laughs Attack

The tester discovered a Razer Gold Thailand server was vulnerable to a DoS attack / resource exhaustion related to an XML parser used on the server. Razer thanks the tester for his clear report/PoC...

Razer: [Razer Pay Mobile App] IDOR within /v1_IM/friends/queryDrawRedLog allowed unauthorised access to read logs

The tester determined the Razer Pay MY server was vulnerable to unauthorized access of certain log file information due to an exposed signature in the Razer Pay Android application. Razer Fintech appreciates the clear and detailed report...

Stripo Inc: SSRF in Export template to ActiveCampaign

Summary: I found a SSRF vulneranility in export template to email marketing platform ActiveCampaign. Steps To Reproduce: add details for how we can reproduce the issue 1. Login to your account in 1. Go to https://my.stripo.email/cabinet//templates/ 1. Click on Create your first mail & select one...

Node.js third-party modules: [htmr] DOM-based XSS

Hi, I would like to report DOM-based XSS in htmr. It allows attackers to insert malicious JavaScript payload into the page. Module module name: htmr version: 0.8.6 npm page: https://www.npmjs.com/package/htmr Module Description Simple and lightweight Hash: $window.location.hash; 4. Run the server...

Magic: HTTP SMUGGLING EXPOSED HMAC/DOS

HTTP SMUGGLING EXPOSED HMAC / DOS Using the transfer-encoding header and following it with a zero. The back end leaked the hmac the back end reflected back the hmac key encryption type, and a lot of details. Further testing had it reflect more headers. http-smuggling-dashboard-fortmatic.png we wi...

Zenly: Insecure Storage and Overly Permissive API Keys in Android App

Description: Most often Developers for their ease of use,leave API keys and some sensitive keys ,Tokens as hardcoded strings,which isn't really a good ideas as it can result in Leaks of sensitive information getting in Wrong Hands which indeed can results in Data theft and Tampering with how the...

PayPal: Reflected XSS at https://www.paypal.com/ppcreditapply/da/us

Researchers identified endpoints that were vulnerable to reflected XSS, due to insufficient input sanitization. This could allow malicious client-side content to be rendered by the app, which could affect a user's session, browser, or the contents of the page itself. The issue was resolved by...

Nord Security: Disclosure of User Information

Hi Team, We can get information about the users registered such as: id, name, login name, etc. and employees of NordVPN without authentication on https://www.nordvpn.com Vulnerable URL: https://nordvpn.com/wp-json/wp/v2/users/ Vulnerable URL: https://nordvpn.com/?restroute=/wp/v2/users/ POC:...

Unikrn: Staging Rabbitmq instance is exposed to the internet with default credentials

Description: RabbitMQ is an open-source message-broker software sometimes called message-oriented middleware that originally implemented the Advanced Message Queuing Protocol AMQP and has since been extended with a plug-in architecture to support Streaming Text Oriented Messaging Protocol STOMP,...

Concrete CMS: XSS in select attribute options

To reproduce 1. Create a new select attribute. 2. Add a select attribute option with value alert'XSS' and hit Save. 3. Edit the newly created attribute again and see XSS dialog. The vulnerability lays in the typeform.php file, see...

Polymail, Inc.: Bug in OAuth Success Redirect URI Validation

@bluebert discovered a bug on the OAuth login endpoint that allows creation of OAuth login urls with Polymail as the subdomain on external domains. This has now been fixed. A bug in how OAuth login URLs were generated in particular, of the redirect URI allowed for an attacker to steal secrets...

Yelp: DoS of https://blog.yelp.com/ and other WP instances via CVE-2018-6389

Description: There is possibility in /wp-admin/load-scripts.php script to generate large 3Mb amount of data via simple non-authenticated request to server. The vulnerability is registered as https://vulners.com/cve/CVE-2018-6389 Details: Detailed attack scenario is described for example here:...

Nord Security: Open redirect

The following URL is vulnerable to an open redirect it will redirect to google.com: https://support.nordvpn.com//path///google.com vulnerable code: if window.location.href.indexOf'/path' !== -1 console.log"document.URL", document.URL window.location.href =...

Stripo Inc: No CSRF Protection in Resend Confirmation Email feature leads to Sending Unwanted Email in Victim's Inbox without knowing Victim's email address

Summary: There's no CSRF protection in confirmation email resending feature as a result of which an attacker can trick the victim to receive a confirmation email unknowingly. In other features of the website, the content-type must be "application/json", and there is same-origin policy, which...

Stripo Inc: Upload Profile Photo in any folder you want with any extension you want

Summary: There exists a vulnerability in Stripo as a result of which an attacker can upload his/her profile photo in any folder he/she wants, with any file extension he/she wants. I also checked whether it could lead to code execution or directory traversal by modifying the values in the request,...