Chaturbate: Camo Image Proxy Bypass with CSS Escape Sequences

Summary With CSS escape sequences it is possible to bypass CSS url detection and filtering. Details Users can use HTML tags in their Profile Bio in About Me and Wish List fields. Among other filtering and sanitization, image URLs are replaced by URLs on internal image proxy. For example, this...

Mail.ru: Boolean-based SQL Injection on relap.io

Boolean/error based SQLi in relap.io due to insecure use of GET parameters...

Ruby: Code Injection Bug Report

Good morning, I hope this message finds you well. On 22 November 2019, I emailed [email protected] about a Code Injection bug on cache.ruby-lang.org, as the ruby-lang.org website is considered out-of-scope on H1. on 24 November 2019 the bug was acknowledged and a patch released. This morning...

Grammarly: Unauthenticated users can access all food.grammarly.io user's data

Summary: The food.grammarly.io site uses the Meteor framework, which uses publications and methods to communicate between the backend and frontend. Although the site seems to require being authenticated as a Grammarly employee to use it, most methods and publications work without being...

Valve: Steam chat - trade offer presentation vulnerability

It was possible to construct a Steam URL that began with "/tradeoffer/new" and included valid partner and token information, but which was in fact an external link. The crafted URL would be treated by the Steam Chat UI as a trade offer and given special visual treatment...

HackerOne: Account takeover via leaked session cookie

Summary: You are disclose for me you session Description: you are gevi me your session on last report I am can use your sessionsorry ███ ████████ █████████ Impact HackerOneStaff Access, i can read all reports @security and more program...

Internet Bug Bounty: Dragonblood: Design and Implementation Flaws in WPA3 and EAP-pwd

Full background information is at our website and detailed information can be found in our research paper. Vulnerability Summary First Disclosure Summarized, the Dragonfly handshake of WPA3 and EAP-pwd is supposed to prevent dictionary attacks. However, we discovered design flaws that still enabl...

U.S. Dept Of Defense: Unprotected ██████ and Test site API Exposes Documents, Credentials, and Emails in ██████████ Proposal System

Summary: The test/integration API of the █████ web services is publicly exposed: disclosing documents, emails, and credentials to what appears to be the Seaport Bid proposal system. Because I did not attempt any exploitation outside of that necessary to deem this a reportable issue, it is not cle...

Bumble: The login of Hotor Not is Vulnerable to bruteforce.

I was able to validate that The Login of HotorNot is Vulnerable to BruteForcing . Steps to reproduce: 1. https://hotornot.com/signin 2.Use Burp intruder attack for BruteForcing 3.Send as many requests you want. Fix: Proper mitigation of BruteForcing should be done using Ratelimitng etc...

Mail.ru: Account Takeover worki.ru

worki.ru had no sufficient protection against SMS code bruteforce...

Razer: PHPInfo Page on www.razer.ru

The tester discovered a a PHP page disclosing information on a server out of scope of the bounty program. This was a low impact information disclosure of PHP version information. We appreciate the tester bringing this to our attention...

GitLab: Steal private objects of other projects via project import

Summary An attacker could transfer issues, merge requests of another project to the imported project by importing a crafted GitLab export. Steps to reproduce 1. Import the attached tarball as GitLab export. 2. Check the issues page of the imported project. You will see an private issue created by...

Mail.ru: IDOR of users

IDOR vulnerability in worki.ru API allowed to request information on job seekers / employers without imposed limits...

U.S. Dept Of Defense: Firewall rules for ████████ can be bypassed to leak site authors

Summary: ████ is a WordPress application that has several endpoints locked behind firewall, such as login screen and author names, but it can be bypassed. Description: By using additional slashes in the URL, I can bypass the firewall rules to display some WordPress information. Interestingly, the...

Bumble: Bruteforce password recovery code

Summary It's possible to bruteforce recovery code from SMS as iOS application doesn't have limits for incorrect inputs. I have tried 50+ different combinations until I reached code from SMS. Steps To Reproduce 1. Click "Use another option" on application startup view 1. Enter your phone number 1...

Starbucks: Hong Kong - Open Redirect on card.starbucks.com.hk

l00ph0le discovered that card.starbucks.com.hk was vulnerable to an open redirect due to improper parameter validation. @l00ph0le — thank you for reporting the original vulnerability and for confirming the resolution...

Moneybird: Pending MFA logins aren't immediatly expired after a password change

Researcher found an issue with sessions not all being terminated when password is changed. The 2FA implementation was at fault in this scenario as the session was found to be active even after the password was changed and two-step verification was turned off...

Nextcloud: Improper confidentiality protection of server-side encryption keys

This vulnerability is related to the Improper integrity protection of server-side encryption keys vulnerability but leverages a different attack vector. While the previous attack broke the confidentiality of encrypted files because the public keys are not integrity-protected, this new attack brea...

Zomato: HTML injection leads to reflected XSS

The following payload was used to bypass the WAF: html "...

Evernote: Non-production Open Database In Combination With XXE Leads To SSRF

Summary: The Apache Hive database hosted on the IP ██████████ and open on port 10000 is open and vulnerable to XXE. By "open", I mean that the database can be accessed by anyone. Steps To Reproduce: Chose any database client that supports Apache Hive and also uses a specific client version...

Nextcloud: Downgrade encryption scheme and break integrity through known-plaintext attack

The idea behind the Server Side Encryption is that you can move your encrypted files to an external party without that external party being able to to read or modify those files. Some time ago, Nextcloud switched from unauthenticated CFB cipher block mode to authenticated CTR cipher block mode in...

Mail.ru: Mail.Ru Email for Android: Injecting custom screen inside adding new account flow

Intent was implicitely invoked on account refistration in Mail.ru Mail application for Android, allowing screen content spoofing via local application...

U.S. Dept Of Defense: idor on upload profile functionality

Vulnerable URL: https://██████████/███████ID/Common/EditOne/Person/accountid steps to reproduce: 1.browse the image and click on the upload button 2.capture this request in burp suite 3. change the value 'personId' parameter to account2 accountid please see screenshot1 4.then goes to account2, th...

Clario: Lack of HTTPS in service communications

Summary: Lack of HTTPS in login page http://translate.kromtech.com/user/login Steps To Reproduce: http://translate.kromtech.com/user/login site, that allows accessing unencrypted of the site without SSL/TLS certificate...

Clario: Unauthenticated Reflected Cross-Site Scripting on https://account.mackeeper.com/signin page

Summary Unauthenticated Reflected Cross-Site Scripting on https://account.mackeeper.com/signin page in the bundled parameter Steps To Reproduce XSS via GET Method HTTP Request: GET /signin?bundleId=wrtqvetcvcwtd%22%3e%3cscript%3ealert1%3c%2fscript%3eyozl9 HTTP/1.1 Host: account.mackeeper.com...

Clario: Reflected XSS

Summary Unauthenticated Reflected Cross-Site Scripting on https://account.mackeeper.com/signup page Steps To Reproduce XSS via GET Method HTTP Request: GET /signup?trtId=wrtqvetc%22%3E%3Cscript%3Ealert%27xss%27%3C%2fscript%3E&tvrnplhw1=1&vim67=1&gvce1=1 HTTP/1.1 Host: account.mackeeper.com...

Shopify: Shopify Stocky App OAuth Misconfiguration

@vulnh0lic noticed that a staff member without Apps permission was able to access the Stocky app. We determined that this was because of a bug in Stocky's OAuth authentication code, which allowed the user to be granted access to Stocky at the start of the OAuth process rather than the end. This...

LY Corporation: Request smuggling on admin-official.line.me could lead to account takeover

The reporter identified a request smuggling issue on admin-official.line.me TE.CL-type. The reporter clearly illustrated the impact without putting our users at risk or affecting the stability of our service. For this we would like to thank @shaolintw! This issue was the result of how our load...

Mail.ru: SSRF in filtering on relap.io

Relap fetcher used to access external resources in relap.io project was not properly isolated from the production networks leaving potential for non-blind SSRFs. relap.io was in Ext.B scope on the moment of reporting...

Stripo Inc: Able to download any hosted content on AWS S3 bucket(stripo)

An AWS s3 bucket was found, with improper access controls, where all its contents could be downloaded. Steps to reproduce: 1. List contents of the bucket with: aws s3 ls s3://stripo 2. Download the hosted data with : aws s3 sync s3://stripo . Impact Any hosted data can be downloaded to an attacke...

Razer: Store Cross-Site Scripting - www.razer.ru

The tester discovered a stored XSS vulnerability on a Razer affilated website. Although this server was not in scope, we appreciate the tester bringing this to our attention...

Mail.ru: IDOR в списке пользователей по домену в relap.io

IDOR in relap.io allowed users enumeration for domain...

PayPal: Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password

A bug was identified whereby sensitive, unique tokens were being leaked in a JS file used by the recaptcha implementation. In certain cases, a user must solve a CAPTCHA challenge after authenticating. When the security challenge is completed, the authentication request is replayed to log in. The...

Bumble: Reflected XSS

The researcher has found an XSS when sending messages through our service...

Picsart: User account compromised authentication bypass via oauth token impersonation

OAuth token impersonation is actually a bug when 3rd party company app or malicious app collects the access token of the same user then that company can access to user account on PicsArt. The condition is that the user needs to authorized both PicsArt and malicious app with same Facebook or Googl...

Algolia: Information disclosure via a misconfigured third-party product

The researcher identified a misconfiguration in a third party product that could have been used to retrieve information about Algolia users. We fixed the issue and worked with the provider of the third party product who confirmed that this vulnerability had not been exploited. Disclosure of all...

Stripo Inc: Able to change password by entering wrong old password

Vulnerability Name: Able to change password by entering wrong old password. Description: The password change mechanism which is located at https://my.stripo.email/cabinet//profile is insecure as the password can be changed without knowing the old password. Any unauthorized user can access the...

Zomato: HTML Injection @ /[restaurant]/order endpoint.

The following payloads were used to bypass the WAF and perform XSS: Basic payload but did not work on all browsers: html " Payload worked on all browsers, but needed a right-click to be executed: html "XSS...

Mail.ru: allods.mail.ru sql injection

SQL injection in allods.mail.ru due to insecure use of externally controlled GET parameter...

Yoti: Multiple Vulnerabilities in (*www.yoti.com) - Leads to Leakage user admin Sensitive Exposure

Sumarry Hi! Team @yoti, We Found Multiple Vulnerabilities in you websites , Username Admin Login Sensitive Exposure All Sensitive Exposure Using Shodan Platforms Affected: website . https://185.116.54.11/wp-json . https://185.116.54.11/wp-json/wp/v2/users POC Supporting Material/References...

Stripo Inc: No length on password

Hey when I try to set the password while creating account I noticed that you haven't kept any password limit. You need to decrease password length :There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource consumption on behalf of...

Stripo Inc: SSL cookie without secure flag set

Issue background If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then t...

Stripo Inc: SSRF in /cabinet/stripeapi/v1/siteInfoLookup?url=XXX

Summary: SSRF vulnerability allows mapping the internal network. Steps To Reproduce: It is possible to run internal requests with the siteInfoLookup service. GET /cabinet/stripeapi/v1/siteInfoLookup?url=http://10.0.0.100:8080 HTTP/1.1 Host: my.stripo.email Based on the response we know if the ip ...

Shopify: XSS on product comments in transfers

summery: You are able to copy and paste stored XSS code into the comment section of a product in the transfers tab and receive the error. Reproduce: 1. Create a product with the name '"'' 2. add a transfer with that product 3. now go back to the product use the code button and type the same code...

Open-Xchange: SSRF - Office Documents - Image URL

Through /api/oxodocumentfilter?action=addfile endpoint it is possible to insert images into documents. Handling of this request in source code is implemented here: office/com.openexchange.office.rest/src/com/openexchange/office/rest/AddFileAction.java One of options is to insert an image by...

Mail.ru: [https://seosan.io] Account owner disclosure

seosan.io could unintentionally disclosure account owner name by e-mail during access recovery procedure. seosan.io has reached it's end of life and is not longer available...

Stripo Inc: subdomain takeover at status0.stripo.email

Hi , The subdomain status0.stripo.email was pointed at uptimerobot.com whereas it was not being used , but having Cname record as stats.uptimerobot.com . Hence anyone can takeover it. I have parked it with atest account on uptimerobot.com F634639 F634636 thanks Impact Anyone can use this subdomai...

Stripo Inc: Clickjacking on my.stripo.email for MailChimp credentials

Clickjacking is a malicious hacking technique where attackers can acquire sensitive data. Through simple social engineering techniques these links can be sent out to unsuspecting customers to steal their credentials or perform actions on their accounts. For this example I saw that where I goto...

Stripo Inc: Redirection through referer tag

Summary: I replaced the referer value https://stripo.email/de/ with www.google.com and it worked, it redirected me to google.com Steps To Reproduce: 1. Open URL https://stripo.email/de/subscribe/ 2. Intercept with BurpSuite 3. Change the parameter value of referer and insert any domain you want i...

Clario: Account verification bypass on translate.kromtech.com

Account verification bypass on translate.kromtech.com Summary: An account could be registered on translate.kromtech.com but the functionality returns "Access denied or Your user wasn't activated yet. ". But it's implemented in a strange way, every time we make a request that requires user to be...