Mail.ru: RCE Jira(CVE-2019–11581) [my-com.atlassian.net]

Hello, Summary i found the domain my-com.atlassian.net is vulnerable with RCE JiraCVE-2019–11581 via contact admin function POC - on page https://my-com.atlassian.net/secure/ContactAdministrators!default.jspa - use payload on Subject & Request details...

New Relic: Stored XSS at Mobile (Versions tab)

Hey team, I've discovered stored XSS rendered at Mobile inside the Versions tab working at least at latest Safari and latest Chrome MacOS. Steps to reproduce: 1 Sign into Mobile with some account which can edit the mobile applications 2 Navigate to some active mobile app, then go to Settings -...

Internet Bug Bounty: A reflected XSS in python/Lib/DocXMLRPCServer.py

I have report this issue to PSRT and it has been resolved now. Details about this issue is at https://bugs.python.org/issue38243 and https://vulners.com/cve/CVE-2019-16935 Impact It's the same with other xss...

curl: SSRF via maliciously crafted URL due to host confusion

Summary: Curl is vulnerable to SSRF due to improperly parsing the host component of the URL compared to other URL parsers and the URL living standard. POC curl -sD - -o /dev/null "http://google.com:80\@yahoo.com/" Curl makes a request to yahoo.com instead of google.com. Supporting...

ForeScout Technologies: DOM XSS at www.forescout.com in Microsoft Edge and IE Browser

Summary: I've found an DOM Based XSS on homepage Steps To Reproduce: 1.Go to this url and you'll see alert pop https://www.forescout.com/ But this will work just on ME/IE browsers because chrome and firefox have default encode system hash url And vulnerable code is on your directly source code...

pixiv: Reset any password

Summary: When I try to reset the password, the verification code of the mailbox is 6 digits, and there is no limit on the number of submissions, so I can reset the password of any user. Steps To Reproduce: 1.input the email reset password url. F595146 click the "submit" button F595147 input the...

Mail.ru: JMX RMI command injection on 195.211.131.82(Mail.ru Gaming)

Externally available Jolokia interface in Mail.Ru Gaming network allowed JMX RMI commands injection Сommand injection in Jolokia JMX. Reading the docs helps. A lot. Also, having good friends who can help you when you need it:...

GitLab: View the Starred Projects in a Private Profile

Summary It is possible to view the starred Projects in a private profile. Consider my profile for instance, https://gitlab.com/maruthi-adithya . This is a private profile and none of my account-related information should be leaked. However, https://gitlab.com/users/maruthi-adithya/starred.json...

People Interactive: Origin IP found, Cloudflare bypassed

The vulnerability allowed non-Cloudflare IP addresses to access the origin servers, bypassing Cloudflare's protection and potentially exposing the servers to unfiltered attacks and data retrieval...

IBM: SQL Injection and plaintext passwords via User Search

An identified SQL Injection vulnerability was reported to IBM found within an IBM asset. It has been analyzed, and resolved. We thank the xyantix for reporting this vulnerability...

Bumble: SSO through odnoklassniki uses http rather than https

SUMMARY When using single-sign on through odnoklassniki, the user is sent to an http non-https URL, allowing an attacker under some conditions to log in to the victim's Badoo account by stealing odnoklassniki credentials, as well as to execute a CSRF-attack on the log-in form. RECOMMENDATION Let...

Ubiquiti Inc.: RCE in AirOS 6.2.0 Devices with CSRF bypass

There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution. These vulnerabilities can be also can be also paired with other e...

Mail.ru: Information disclosure with sensitive data

Apache server status was available at touch.mail.ru, leaking some requests information...

Razer: Subdomain takeover at ftp.thx.com

The tester discovered the ftp.thx.com server was vulnerable to a subdomain takeover. This server is only used by internal parties so risk was minimal but THX appreciates the report...

Node.js third-party modules: [treekill] RCE via insecure command concatenation (only Windows)

I would like to report a RCE issue in the treekill module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: treekill version: 1.0.0 npm page: https://www.npmjs.com/package/treekill Module Description treekill process and it's all children and child...

Node.js third-party modules: [node-df] RCE via insecure command concatenation

I would like to report a RCE issue in the node-df module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: node-df version: 0.1.4 npm page: https://www.npmjs.com/package/node-df Module Description node-df abbreviation of disk free is a cross-platform...

Node.js third-party modules: [yarn] yarn.lock integrity & hash check logic is broken

I would like to report a vulnerability in yarn. It allows to pollute yarn cache via a crafted yarn.lock file and place a malicious package into cache under any name/version, bypassing both integrity and hash checks in yarn.lock so that any future installs of that package will install the fake...

Mail.ru: Information Disclosure [ https://curious.ru/api/submissions ]

API endpoint at curious.ru disclosed e-mails of subscribed users...

Roblox: Insecure redirect rule results in bypassing ban redirect on certain pages

Description Account bans on Roblox work via redirect rules. If an user attempts go to a page that's outside a whitelisted set of rules, they'll be redirected back to the ban page. After researching, I've found that the following rules are whitelisted and bypass this redirect: - Any URLs ending in...

GitLab: No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im

Summary In the oauthclients collection of the default gitter installation, there's no value registeredRedirectUri in the database for web-internal clientKey. The request to /login/oauth/authorize?responsetype=code&clientid=web-internal&redirecturi=http://whatever causes the app to crash when tryi...

Razer: DOM XSS at https://www.thx.com in IE/Edge browser

Summary: I just recently found easy exploitable DOM XSS vulnerability because of https://www.thx.com/assets/plugins/ultimate-social-media-icons/js/custom.js?ver=5.2.3 js file Steps To Reproduce: First i want to say this is vulnerable code function sfsimobilewechatshareurl if...

Razer: Accessible Druid Monitor console on https://api.pay-staging.razer.com/

The tester discovered a monitoring application was available on a remotely accessible administrative console in the Razer Pay staging environment, which could have been used to leverage information that could have compromised the server. The Razer Pay team removed this and other similar servers...

Razer: Unauthenticated access to sensitive user information

The tester discovered that a THX server known primarily to THX employees was exposing several hundred records containing customer email addresses and in very few cases, a personal name. No other information was revealed. This issue was fixed shortly after the report. We appreciate @smalien's...

Razer: Payment PIN Verification Bypass

The tester originally reported a PIN bypass in the Razer Pay MY client and provided a video POC which was very helpful. This was fixed in client version 2.11. Razer Fintech appreciates the tester's assistance and patience helping us resolve this issue...

Razer: DLL Hijacking in Synapse 2 CrashSender1402.exe via version.dll

The tester determined that the Synapse 2 installed executable CrashSender1402.exe was subject to a DLL hijacking vulnerability. As this was no longer supported by the third party provider, Razer decided to remove this executable from future versions of Synapse 2...

Razer: 2FA doesn't work in "https://insider.razer.com"

Hello, I found 2FA bypass vulnerability in https://insider.razer.com and I found this feature not at all working after enabled 2FA. Please follow the below steps to reproduce the issue Steps to reproduce 1. Login to https://insider.razer.com with your credentials. 2. Next, go to Two-Step...

Node.js third-party modules: [tree-kill] RCE via insecure command concatenation (only Windows)

I would like to report a RCE issue in the tree-kill module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: tree-kill version: 1.2.1 npm page: https://www.npmjs.com/package/tree-kill Module Description Kill all processes in the process tree, including t...

Starbucks: India - An Insecure Direct Object Reference (IDOR) allowed unauthorized access to view card index number and monetary balance

mrintrusionist discovered an Insecure Direct Object Reference IDOR which affects the https://card.starbucks.in/StarbucksMSRModule/starbucksGetCardData.do endpoint through the cardId parameter. This allowed an authenticated, but unauthorized user to iterate cards and view the balance...

Mail.ru: Race condition на покупке призов за баллы

Добрый день! Описание Уязвимость Race condition была обнаружена на delivery-club.ru при покупке за баллы. Запросы покупки успевают пройти до того, как происходит списание баллов. Таким образом можно успеть купить несколько товаров не тратя на это баллы. Тестирование У меня на счету было 105 балло...

Shopify: Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission

Technical Background ===================== Shopify Apps need an access token to work with the data of a store. Is very important to keep this token in a secure place. Quoting the Shopify Blog: ... this is like a password into this shop, so you’ll want to store this token in a very safe place...

Lark Technologies: Reflected XSS on Lark Suite

A reflected cross-site scripting XSS vulnerability was found at the Lark Suite log-in endpoint via the redirecturi parameter which could have potentially allowed an attacker to inject malicious code. We thank @jin0ne for reporting this to our team and confirming the resolution...

Razer: Insecure Logging - OWASP (2016-M2)

The tester discovered that the Razer Pay Android application was storing user data locally on the phone in the clear. An adversary would need access to the phone to obtain this information. The application was patched to avoid storing this information in version 2.10...

Mail.ru: worki.ru: SMS code bruteforce

SMS code verification process in worki.ru was not sufficiently protected against bruteforce attack Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...

New Relic: Mixed content issues on newrelic.com

Hi guys, I have found Mixed Content on https://newrelic.com/: Insecure endpoint http://newrelic.com/ that should be served over HTTPS. Description: Passive mixed content is content sent over HTTP that is contained on the HTTPS page, but which can not change other parts of the page. For example, a...

Kartpay: bypass captcha in the form forgot password

Summary: In this issue I can bypass Captcha Protection in the Forgot Password form. Browsers Verified In: firefox url: https://affiliate.kartpay.com/ url vulnerable: https://affiliate.kartpay.com/forgotpassword Steps To Reproduce: 1-Enter your email in the forgot password parameter. 2-complet...

Razer: Misconfigured s3 Bucket exposure

Found a s3 bucket that belongs to razer and properly not configured. bucket name:- http://rzimageupload.s3.amazonaws.com/ Bucket Source:- https://api.razer.com Steps To reproduce:- 1. Go to https://api.razer.com and create a project . 2. In the project icon select an image from your computer. 3...

Omise: Signup with any email and enable 2FA without verifying email

Description : When i signup, i can enable 2FA without verification my email. Attack Scenario : 1. The Attacker signup with the victim email. 2. Go to Two factor authetication and enable 2FA Impact when the victim want to register in this site, they can't, because they email claims by attacker. an...

Razer: Race Condition in Oauth 2.0 flow can lead to malicious applications create multiple valid sessions

The tester discovered a flaw in the Razer ID authentication system that could allow multiple access tokens. This was a minor issue but could theoretically have led to extended access due to unexpired tokens. Razer thanks the tester for their diligence. Here is a write-up for similar bug:...

Razer: OTP token bypass in accessing user settings

The tester was able to determine that the OTP token used by Razer ID was not being properly verified against the specific user which would allow an adversary to replay their own OTP token against a different user. If the adversary also had been able to obtain the user's login and password through...

Razer: Admin Management - Login Using Default Password - Leads to Image Upload Backdoor/Shell

The tester discovered an access control issue on a development server. Although this was not technically in scope of the bounty program and there was little risk to customer information, we granted an award as a token of appreciation for providing excellent PoCs and working with us on this...

U.S. Dept Of Defense: Unauthenticated arbitrary file upload on the https://█████/ (█████.mil)

The vulnerability involved an unauthenticated arbitrary file upload on the https://█████/ █████.mil website. An unsafe upload endpoint at https://██████/upload.php was identified, where a test file was successfully uploaded. The uploaded file could be accessed at the internal path...

U.S. Dept Of Defense: Unauthenticated arbitrary file upload on the https://█████/ (█████████)

The vulnerability involves an unauthenticated arbitrary file upload on the https://█████/ █████████ website. A test file was successfully uploaded to the /upload.php endpoint, and the uploaded file was accessible at the /delete.me path. This vulnerability could have led to consequences such as...

Shopify: Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections

The following report intends to disclose a bypass for 416983. It's been found that removed staff members who had "Apps" permission can still modify flow app connection settings due to improper authorization. Description Signed URLs generated by Shopify Flow https://apps.shopify.com/flow use a...

LY Corporation: Able to Become Admin for Any LINE Official Account

The reporter found an issue where abusing an IDOR would allow for an attacker to become an administrator of any LINE Official Account. This was due to an issue where the group ID could be extracted and/or easily guessed, combined with lack of authentication, leading to being able to craft a reque...

New Relic: Host Header Injection

Reproduction 1- open reset link https://login.newrelic.com/passwords/forgot 2- Enter the victim's email address and click Reset and Email Password 3- Intercept the HTTP request in Burp Suite & add X-Forwarded Host Header and write attacker.com/.newrelic.com link will be like...

Nextcloud: Only the file extensions are checked, not the MIME types as configured

The tool is not working as hoped. File access control speaks of MIME types that are blocked or not blocked. In fact, only the file extensions are checked. If a user renames an unauthorized file to an allowed file, he can upload and download it. The MIME type of the current file is insignificant,...

Zomato: Information Disclosure through Sentry Instance ███████

Hello team I found a bug sensitive information can be used from attackers to perfom attack in youre server I don't know if this in scope so i'm sorry if i'm wrrong withou spending youre time here the steps how i found this bug : 1-Please use burp suite to reproduce the same result 2-i notice you...

Kindred Group: [unibet.com] Delete messages via IDOR at /mom-api/messages/unibet_█████████@unibet/

==Below is the original, partially-redacted report== --------- Description: Hey team, I found an endpoint which is vulnerable to IDOR by which I can delete messages of any user without their interaction at all. But sadly I can't reproduce this issue for the time being as I don't have any spare...

LY Corporation: Reflected XSS in OAUTH2 login flow

The reporter found a reflected XSS in the OAUTH2 login flow which could have allowed potential attackers to steal credentials or hijack accounts by sending a message to the victim containing a malicious URL...

Semmle: Worker container escape lead to arbitrary file reading in host machine [again]

Summary: After a successful build, LGTM allow user to view the file list. By default, only source code files and build config files are reserved lgtm.yml and .lgtm.yml. If there are both files in folder, LGTM will process lgtm.yml file and skip .lgtm.yml, but it still keeps both of files in...