HackerOne: Disabled account can still use GraphQL endpoint

Summary Hi team & @jobert, I am not sure if it is by design. After disabling the account, the user will be forced to Enable his account after logging in. However, many of actions are implemented using GraphQL endpoint which bypasses account reactivation process before use. Since re-enabling the...

Internet Bug Bounty: Industry-Wide MITM Vulnerability Impacting the JVM Ecosystem

I've been exploring the industry-wide scope of the use of HTTP to resolve dependencies in build infrastructure across the industry. What I unearthed was that some of the most popular libraries and two compilers were impacted by this vulnerability. Vulnerability CWE-829: Inclusion of Functionality...

curl: Windows Privilege Escalation: Malicious OpenSSL Engine

Summary: The curl windows binaries are built with OpenSSL libraries and have an insecure path for the OPENSSLDIR build parameter. This path is set to c:\usr\local\ssl. When curl is executed it attempts to load openssl.cnf from this path. By default on windows, low privileged users have the...

ZEIT: Open redirect vuln on login

Summary: An attacker can redirect vicitm on an external website using https://zeit.co/login endpoint because next parameter Steps To Reproduce: add details for how we can reproduce the issue 1 .Go To https://zeit.co and login there 2 .after login go to...

Node.js third-party modules: [tianma-static] Security issue with XSS.

I would like to report XSS in tianma-static It allows XSS and HTML Injection First of all, It is my first report and I am sorry that I am not good at English T.T thank you. Module module name: tianma-static version: 1.0.4 npm page: https://www.npmjs.com/package/tianma-static Module Description...

Nextcloud: Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color`

I just found a reflected Cross-Site Scripting XSS vulnerability in Nextcloud Server that affects current stable and dates back to at least 15.0.5. The vulnerability seems mitigated by a Content-Security-Policy CSP, but there might be a residual risk for phishing, due to the CSP's lack of a...

New Relic: Stored admin-to-owner XSS at infrastructure alerts runbook URL leading to account takeover by malicious admin

Hey team, I have discovered a stored XSS vulnerability at infrastructure alerts runbook URL. There is a filter that is not allowed this URL to be with javascript: scheme, but I have found a way to bypass it. Alerts can't be created/modified by users with role lower than "admin" so I will show you...

HackerOne: Team member with Program permission only can escalate to Admin permission

Summary https://hackerone.com/TEAM/groups URL is accessible to team members with Program permission, even when "Group Management" and "User Management" menus aren't visible. I didn't research this further, however, I was able to grant all permissions to the user assigned to a group with Program...

GitLab: [information disclosure] Validate existence of a private project.

Summary In Gitlab, we have a feature of creating groups and setting their permissions to public/internal/private. While testing I discovered that a user can check existence of a project in a group of which he is not a part judging by the difference in types of error messages generated. This reque...

Brave Software: Tor IP leak caused by the PDF Viewer extension in certain situations

A vulnerability was discovered in the PDF Viewer extension in Brave browser, where web requests made by the extension in Tor mode were not properly proxied under certain conditions. This could result in the user's real IP address being leaked to the server hosting the PDF file...

QIWI: Обход комиссии на переводы

Доброго времени суток. Не так давно мне на кошелек подключили тариф «Активный пользователь кошелька» Этот тариф подразумевает 2% комиссии на переводы. Меня, соответственно, это крайне не устроило и я решил пойти искать обход. После недолгих поисков удалось найти дыру вот здесь...

HackerOne: Race Condition leads to undeletable group member

Hi, Summary: There exists a Race Condition in which the user can add themselves twice to a group which will make them unremovable from group. They themselves cannot remove themselves from the group as well as the group leader cannot remove that user from the group. Ofcourse this is a low severity...

InnoGames: Chaining Bugs: Leakage of CSRF token which leads to Stored XSS and Account Takeover (xs1.tribalwars.cash)

The referrer leaked the CSRF code, when opening an embedded PHP file set by the images function in tribe forums. Due to a premium function, which allows players to store and run Javascript scripts during the game, the session ID could be grabbed, as it was mistakenly embedded into the DOM. This...

Pornhub: Blind XSS in redtube administering site my.reflected.net

Researcher was able to execute Blind XSS in Redtube WAF administering panel Blind XSS in Redtube WAF administering panel...

Mail.ru: Unrestricted File Upload To Xss Stored [ https://ideas.browser.mail.ru/ ]

Stored XSS in https://ideas.browser.mail.ru/ ideas.browser.mail.ru belongs to extended scope...

Upserve : DOM Based XSS via postMessage at https://inventory.upserve.com/login/

Description DOM based XSS is possible at https://inventory.upserve.com/login/ due to insecure origin checking when receiving a postMessage. POC 1. Visit https://hq.upserve.com.████████/upservexss.html 2. Click link 3. View alert on https://inventory.upserve.com Vulnerable Code javascript...

ExpressionEngine: Open Redirect in comment section

@winst0n13 discovered that the URL you are redirected to after successfully submitting a comment could be modified in certain circumstances. @winst0n13 gave a detailed report with step-by-step instructions for replicating, enabling a speedy resolution to the issue...

Shopify: DOM XSS via Shopify.API.Modal.initialize

Similar 422043 & 576532 Payload Based on 576532: html function attack const ctx = window.openlocation.origin+'/admin/themes', 'blank' const json = message: "Shopify.API.Modal.initialize", data: src: "" let interval; interval = setIntervalfunction if window.attackSuccess clearIntervalinterval else...

ok.ru: Plain text password for 'unknown' user exist in URL when opening jira.apiok.ru

Documentation at https://api.mail.ru/docs/guides/billing/ has a link to http://apiok.ru/jira/documents/ which redirects to https://jira.apiok.ru/secure/CreateIssue.jspa?pid=-2&osusername=unknown&ospassword=X7:1OEh3 This pair of username & password - is effective login & password to JIRA system an...

New Relic: Urgent! Stored XSS at plugin's violations leading to account takeover

Hey team, I have found a stored XSS which is fired at plugin's Violations page. This vulnerability can be used by malicious plugin maker to take over any account which installs this malicious plugin. Vulnerability details The Violations page contain the following script inside its source code: ht...

Mail.ru: SSRF On [ allods.mail.ru ]

SSRF in allods.mail.ru. allods.mail.ru belongs to Ext.B scope...

Cuvva: Unclaimed facebook page at www.cuvva.com/about

Description: Hello sir, while I was surfing your website I found unclaimed facebook page at www.cuvva.com/about F503171 when you click this button you will be redirected to https://www.facebook.com/getcuvvad which was unclaimed but I claimed it as poc steps to reproduce: 1. go to...

WakaTime: Vulnerability Name: Host Header Injection Redirect

Vulnerability Description: Open redirection is sometimes used as a part of phishing attacks that confuse visitors about which web site they are visiting. Remediation: If possible, the application should avoid incorporating user-controllable data into redirection targets. In many cases, this...

Shopify: HTML injection in https://interviewing.shopify.com/index.php?candidate=

https://interviewing.shopify.com/index.php?candidate= is inserting the value of candidate into the DOM without any filtering except that the equal sign can't appear in the payload, this allows attacker to injection any html in the DOM. Of course reflected XSS payloads like ...something... will be...

curl: Integer overflow in the source code tool_cb_prg.c

Summary: Integer overflow in the source code toolcbprg.c Steps To Reproduce: Review the source code of toolcbprg.c In the function fly, pay attention to Line 80, 82, 84 C 69 static void flystruct ProgressData bar, bool moved 70 71 char buf256; 72 int pos; 73 int check = bar-width - 2; 74 75...

Mail.ru: Открытый .htaccess на cookery.zakazaka.ru

.htaccess file was available for reading via Web request on cookery.zakazaka.ru due to invalid configuration. While this misconfiguration could potentially lead to information disclosure, no sensitive information was actually leaked...

VK.com: Бесконечный доступ к аккаунту если мы смогли хотя бы раз зайти на аккаунт.

Временная возможность продлить сессию после получения полного доступа к странице...

Infogram: Privilege escalation allows to use iframe functionality w/o upgrade

Hello team! I've found a privilege escalation issue which allows to set iframes to the projects w/o upgrading. Steps to reproduce - Login - Navigate to the project - Choose integrations and click the IFrame - See that you'll get upgrade now notification F501019 - Inspect the page with developer...

Mail.ru: CSRF на отправку вопроса на [games.mail.ru]

CSRF in gmr.operator.mail.ru allowed to send a question on behalf of the user to TimeZero project support. CSRF to send a question in the disabled method /support/tz/questions/ajax in the interface...

Homebrew: Homebrew privilege escalation vulnerability

Additional symlinks/directories that were not chownd by brew services needed to be added to avoid the replacement of the opt prefix link. Homebrew has a privilege escalation vulnerability which can cause an attacker easily gain root permission...

Node.js third-party modules: [public] Path traversal using symlink

I would like to report Path traversal vulnerability in public module Module module name: public version: 0.1.4 npm page: https://www.npmjs.com/package/public Module Description Run static file hosting server with specified public dir & port. Support a "direcotry index" like Apache httpd. Module...

Magic: CSRF in generating developer api_key

Hi At https://dashboard.forttmatic.com when developer tries to generate new apikey for his application, a POST request is sent to https://api.forttmatic.com which doesn't have any tokens to guard against CSRF attacks. CSRF POC : history.pushState'', '', '/' On submitting the above request, a new...

Vanilla: Web cache deception attack on https://open.vanillaforums.com/messages/all

I have found a Vulnerability in vanilla forums which called Web cache deception attack. Web Cache Deception Attack Websites often tend to use web cache functionality to store files that are often retrieved, to reduce latency from the web server. Websites often tend to use web cache functionality...

Internet Bug Bounty: Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow

PHP upstream bug report: https://bugs.php.net/bug.php?id=78069 Description: In phpiconvmimedecode function in iconv.c, there's an out-of-bounds read due to an integer overflow vulnerability. MIME encoded string is being parsed and decoded in for loop with following condition: for strleft =...

Unikrn: multiple vulnerabilities on your mautic server

Hi @unikrn! I found some vulnerabilities in you crm server: 1. By pass Cloudflare access: You Use Cloudflare Access on https://crm.unikrn.com . BUt this link bypassed Cloudflare Access: ████████/login This vulnerability generates the disclosure of important data: PHP info page: ██████████phpinfo ...

Nextcloud: Non-admin users can trigger writes to memcached by entering a malicious server as a share URL

Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long...

Automattic: Gaining unlimited bonus points on websites with WooCommerce Points and Rewards

In WooCommerce Points and Rewards plugin there is an assumption that Processing order status is only for paid orders. However, this assumption is wrong for payment gateway Cash On Delivery, which immediately changes order status to Processing on all new orders. Plugin then increases bonus points...

Node.js third-party modules: Lack of input validation and sanitization in react-autolinker-wrapper library causes XSS

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report XSS in...

Starbucks: Blind SQLi leading to RCE, from Unauthenticated access to a test API Webservice

@geekjeremy, at the same time as other hackers who submitted their own reports, discovered a browsable WSDL service on an API endpoint under the starbucks.com.cn domain, running on a non-standard port. @geekjeremy demonstrated that the service had several functions that executed without any...

WordPress: Stored XSS on byddypress Plug-in via groups name

Hi, I found that there is a storage xss in another output group name, but this xss needs to press the key combination to trigger. Just create or modify the group information, set the group name to the following payload, and then access Group page, if you are macos need to press,...

Monero: Remote P2P DoS

Remote P2P DoS resolved. https://www.activism.net/cypherpunk/manifesto.html...

Monero: Remote Daemon RPC Attack

Remote Daemon RPC Attack https://www.activism.net/cypherpunk/manifesto.html...

Trustpilot: IDOR in sending support email upon Verifying user business domain

Summary Trustpilot Business is making sure that you own the domain you have registered before continuing the process so they set 5 choices on how to verify. But there's another one, which is through sending a support ticket. By this you can send message to a support and hope to help you out. Ther...

Uber: [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repo

A username and certificate was found that allows API access to Phabricator on code.uberinternal.com. This API access could give away source cod and the private phabricator instance of Uber...

Shopify: XSS on services.shopify.com

Hy security, i Got a stored xss in one of your sub-domain "services.shopify.com" steps: 1- Go to https://yourstore.myshopify.com/admin/apps/expertsmarketplace/servicesmarketplace 2- Then Go to All servicesMarketing and salesemail marketing Design custom email templates click select 3- fill al the...

curl: Signed integer overflow in tool_progress_cb()

Summary: Good afternoon curl security! I built this curl from commit 8144ba38c383718355d8af2ed8330414edcbbc83. We discovered a signed integer overflow in toolprogresscb. Steps To Reproduce: Compiled with the Undefined Behavior Sanitizer enabled. Ran with the following command line: ./curl -q - -T...

X (Formerly Twitter): Twitter Periscope Clickjacking Vulnerability

Bonjour, Summary X-Frame-Options ALLOW-FROM https://twitter.com/ not supported by several Browser, this caused Clickjacking on Twitter Periscope subdomain https://canary-web.pscp.tv & https://canary-web.periscope.tv Steps To Reproduce: 1. Create a new HTML file 2. Put 3. Save the file 4. Open...

Automattic: Denial of service to WP-JSON API by cache poisoning the CORS allow origin header

The WP-JSON implementation on some wordpress.com websites I've tested is vulnerable to denial of service where by an attacker can provide an arbitrary Origin header in the request, which is then echoed back in the response via the Access-Control-Allow-Origin header, which is cached and served to...

X (Formerly Twitter): Potential pre-auth RCE on Twitter VPN

Hi, weOrange Tsai and Meh Chang are the security research team from DEVCORE. Recently, we are doing a research about SSL VPN security, and found several critical vulnerabilities on Pulse Secure SSL VPN! We have reported to vendor and patches have been released on 2019/4/25. Since that, we keep...

LifeOmic: open redirect while login at https://apps.dev.jupiterone.io can leak access code.

LifeOmic Comments @base64 found an open redirect bug in our auth flow. After review, we determined that due to design the exploit would only work in our dev environment. Though we determined mitigating controls were already in place for this attack in prod, we valued @base64 's efforts and awarde...