15590 matches found
Zendesk: Leaked artifactory_key, artifactory_api_key, and gcloud refresh_token via GitHub.
It was reported to Zendesk that valid credentials to an instance of Artifactory and a gcloud project were unintentionally leaked via a public GitHub repository. We immediately rotated the credentials and investigated to ensure they were not utilized by any other party. We want to thank @rubyroobs...
Vanilla: Stored XSS in vanilla
Summary: There is a stored XSS in the latest version 2.8 of vanilla. Attack with post privileges can trigger this. Description: In last report 481360, I found a XSS cause by Format. But in lastest version 2.8, the default Format of Discussion and Comment is Rich. In this Format, we can insert a...
Starbucks: Reflected XSS in https://www.starbucks.co.jp/store/search/
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Please indicate NA, if not applicable. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling...
Khan Academy: EMAIL SPOOFING
Hey KHANACADEMY, I have found Email Spoofing type of Vulnerability in your Website. Attacker can use your E-Mail to send emails to others. Email spoofing is the creation of email messages with a forged sender address. Because the core email protocols do not have any mechanism for authentication, ...
U.S. Dept Of Defense: █████████ - Insecure download cookie generation allows bypass of CAC authentication, access to deleted and locked files
Summary: To download a file, ████ directs users to /██████████/Download.aspx and sets a cookie authenticating the download. The cookie looks like this: pickup=Subject=&PackageID=MTU4NDgzMTU=███ If an attacker can generate this cookie, this allows downloading a file. As it turns out, the generatio...
Node.js third-party modules: [url-parse] Improper Validation and Sanitization
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report Improper...
Internet Bug Bounty: Ubuntu Linux privilege escalation (dirty_sock)
Hi team, This week, I have publicly disclosed the dirtysock local root exploit affecting multiple Linux Operating Systems. Very detailed information on the vulnerability can be found in my blog posting here. And the exploit code can be found in my GitHub repository here. The vulnerability exists ...
Mail.ru: CSRF уязвимость позволяет взять беспроцентный кредит пользователю cfire.mail.ru
CSRF vulnerability in Crossfire cfire.mail.ru allowed to force user to request game credit. On the time of reporting, game/business logic vulnerabilities in cfire.mail.ru are not covered by bug bounty program...
U.S. Dept Of Defense: █████ - Pre-generation of VIEWSTATE allows CAC bypass
Summary: As of today, ███ is back online https://███████. █████████ allows users to check a box labeled Require CAC for Pick-up. This option requires users to present their CAC in order to download files. As explained by ███: Choosing this option, however, does add a significant degree of assuran...
Mail.ru: XSS via the lang parameter in a POST request on light.mail.ru
Reflected XSS in light.mail.ru via request parameters...
Notepad++: Crash
1 Settings - Preferences - Print 2 insert to "Left part" field of "Header" block A500 Full string for paste consist in poc.txt 3 Click "Add" 4 Crash Crash info: 1c8.2dd8: Unknown exception - code c000041d !!! second chance !!! ERROR: Module load completed but symbols could not be loaded for npp.e...
Valve: Malformed .MDL triggers an Access Violation on GoldSRC (hl.exe)
A malformed player .MDL triggers an exploitable Access Violation on GoldSRC engine games Half-Life upon invocation, which could lead to remote code execution on a client. Crash Information FAILUREIDHASHSTRING: um:invalidpointerwriteexploitablec0000005hw.dll!createinterface Event Type: Exception...
Valve: Malformed .WAV triggers an Access Violation on GoldSRC (hl.exe)
A malformed .WAV triggers an Access Violation on GoldSRC engine games Half-Life upon invocation, which could lead to remote code execution on a client. Crash Information ------------------ Event Type: Exception Exception Faulting Address: 0x2469a000 First Chance Exception Type:...
Automattic: [FG-VD-19-022] Wordpress WooCommerce Cross-Site Scripting Vulnerability Notification
Subject: FG-VD-19-022 Wordpress WooCommerce Cross-Site Scripting Vulnerability Notification Dear Automattic, Fortinet's FortiGuard Labs have discovered a security issue in your product WooCommerce on 02/13/2019. We estimate its risk level is 2, on a scale of 1 lowest to 5 highest, in terms of its...
Ian Dunn: XSSI: Quick Navigation Interface - leak of private page/post titles
CVSS ---- Medium 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Description ----------- The Quick Navigation Interface plugin includes the names of all posts and pages in an automatically generated JavaScript file. By including this file in their own page, an attacker can view all post titles -...
WordPress: Reflected XSS: Taxonomy Converter via tax parameter
CVSS ---- Medium 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Description ----------- The Taxonomy Converter that is listed on the Official WordPress plugins page is vulnerable to reflected XSS as it echoes the tax parameter without encoding. POC ---- &step=2" method="POST" enctype="text/plai...
PuTTY (European Commission - DIGIT): Assertion `len == 1' failed, process aborted while streaming ouput from remote server
Summary: During the course of testing putty-0.70-2019-02-12.75dda5e on Fedora 29 compiled with clang version 7.0.1 Fedora 7.0.1-1.fc29, we discovered it was possible to abort a remote client by streaming data at it in such a way as to trigger an assertion failure. putty: unix/gtkwin.c:3801: void...
GitLab: Know whether private project name exists or not within a group using link comments
Summary: Hello, It is possible for anyone to know if private project exists or not in public/private groups if they can guess the project names correctly. Description: Using markdown feature, we can form a comment which will allow us to know if the private project is exists within a group or not...
Internet Bug Bounty: CVE-2019-5736: Escape from Docker and Kubernetes containers to root on host
description here: https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html PoC: https://github.com/q3k/cve-2019-5736-poc Some more links: https://seclists.org/oss-sec/2019/q1/119 https://access.redhat.com/security/cve/cve-2019-5736 Impact It allows to escape from container t...
Notepad++: No SearchEngine sanatizing can lead to command injection
Information: Summary: Notepad++ is vulnerable to a command injection vulnerability. Debug Info: Notepad++ v7.6.3 32-bit Build time : Jan 27 2019 - 17:20:30 Path : C:\Program Files x86\Notepad++\notepad++.exe Admin mode : ON Local Conf mode : OFF OS : Windows 10 64-bit Plugins : none Description:...
Notepad++: Insufficient sanitizing can lead to arbitrary commands execution
Information: Summary: Notepad++ is vulnerable to a command injection attack. Debug Info: Notepad++ v7.6.3 32-bit Build time : Jan 27 2019 - 17:20:30 Path : C:\Program Files x86\Notepad++\notepad++.exe Admin mode : ON Local Conf mode : OFF OS : Windows 10 64-bit Plugins : none Description: Let's...
GitLab: Inadequate cache control in gitter allows to view private chat room
Hi Gitlab, Summary: I have found a inadequate cache control vulnerability in Gitter. Description: You can use the backspace button to get the full access to the account. There is no cache control and the browser saves sensitive information of a private chat room. This report is influenced by the...
InnoGames: Information disclosure via ".htaccess" at https://login.innogames.de
Hi team , i found insecure file Name: htaccess Normally, only the web server is allowed to read the .htaccess file, but in this case, it appears that there is a misconfiguration that is causing the contents of the .htaccess located at https://login.innogames.de/.htaccess to download file and read...
X (Formerly Twitter): CSRF on https://www.niche.co leads to "account disconnection"
The researcher discovered that Niche’s CSRF protection was broken and that an attacker could trick a logged-in user into deleting existing network connections under the network/ endpoint...
X (Formerly Twitter): CSRF and probable account takeover on https://www.niche.co
The researcher discovered that Niche’s CSRF protection was broken and that an attacker could trick a logged-in user into changing account information under the /account endpoint, including email address. This would not have enabled account takeover, however, since Niche does not handle account...
HackerOne: report id is exposed for undisclosed reports in Hacktivity
Summary: This is similar to https://hackerone.com/reports/127620 where the report Id of undisclosed report is visible on graphql query Description: The new hacktivity graphql query includes undisclosed reports, but part of the query result is the report id which is included in private information...
GitLab: Privilege escalation from any user (including external) to gitlab admin when admin impersonates you
Summary: Hey team, I have discovered a way for any logged in user attacker to escalate his privileges to gitlab administrator if the real gitlab administrator impersonates attacker's account. Description: When the gitlab admin impersonates some user, he gets new gitlabsession cookie and then...
HackerOne: Partial report contents leakage - via HTTP/2 concurrent stream handling
Summary: The concurrent handling of HTTP/2 streams allows for a "timeless timing attack": instead of timing, the ordering of responses is used, making the attack resilient to network jitter. As the /bugs.json endpoint takes slightly longer to process when a query returns results, it is possible t...
Postmates: Web cache poisoning attack leads to user information and more
Hello, Your Web-Server is vulnerable to web cache poisoning attacks. This means, that the attacker are able to get another user informations. If you are logged in and visit this website For example: https://postmates.com/SomeRandomText.css Then the server will store the information in the cache,...
U.S. Dept Of Defense: [https://███] Local File Inclusion via graph.php
Summary: There exists a Local File Inclusion vulnerability on https://████ due to a known vulnerability in the ZendTo library. This was fixed in Version 5.16-6 Beta, although ██████ is still running ZendTo 5.11. Impact This allows path traversal in a file name that is then returned to the user...
Internet Bug Bounty: [bower] Arbitrary File Write through improper validation of symlinks while package extraction
Hi, I want to submit my report https://hackerone.com/reports/473811 for the Internet Bug Bounty. Snyk's writeup: https://snyk.io/blog/severe-security-vulnerability-in-bowers-zip-archive-extraction My assessment on why this report might be eligible: To qualify, vulnerabilities must meet the...
Rocket.Chat: Broken access control on apps
Summary: The user without administrative privileges can upload and install any Application into the rocket.chat As ID of application is controlled in the app.json file which is controlled by uploader user can also activate the app. Releases Affected: 0.73.2 Steps To Reproduce: - User log-in into...
Brave Software: DMARC RECORD MISSING
VULNERABILITY TYPE- DMARC RECORD MISSING. HOW TO REPRODUCEPOC-ATTACHED IMAGE:- 1.GO TO- https://mxtoolbox.com 2.ENTER THE WEBSITEbrave.org.CLICK GO. 3.YOU WILL SEE THE FAULTNo DMARC Record found 4.In the new page that loads change MXLookup to DMARCLookup I HAVE ALREADY INFORMEDD THEM.THEY TOLD TO...
U.S. Dept Of Defense: RCE on https://█████/ Using CVE-2017-9248
Summary: https://█████████/ is hosting an unpatched version of the Telerik DialogHandler Telerik.Web.UI.DialogHandler.aspx allowing for the machine key to be brute forced. The machine key can be used to access the DNN file manager to upload arbitrary files including ASPX giving a web shell and RC...
Rockstar Games: Image Injection vulnerability affecting www.rockstargames.com/careers may lead to Facebook OAuth Theft
In this report, the researcher demonstrated a method to chain together separate vulnerabilities that, under certain conditions, could cause a user's Facebook Oauth tokens to leak via the Referer header. The specific vulnerability that was addressed in this report was the image injection component...
X (Formerly Twitter): Protected tweets exposure through the URL
Summary Leaking sensitive information from protected tweets via a prepared website. This vulnerability could lead to exposure of information such as credit card numbers, bank account numbers, phone numbers, tokens, specific words or even the whole phrases but also the exposure of any additional...
Mail.ru: [https://pandao.ru] - PUT method available
Unrestricted PUT method allowed upload of static content to server in pandao.ru...
GitLab: Guests Will Disclose the Private Project Full Activity Via Project Activity Feeds
Hello! Here guests will disclose the complete activity of the project via feeds Reproduction Steps: Create Private Project. Invite Attacker as Guest. Next attacker will go to https://gitlab.com/victimyoursz/helloproject/activity and he access the feeds link...
U.S. Dept Of Defense: SQL Injection in the `move_papers.php` on the https://██████████
Description Hello. I was able to find another one Time-based SQLI on the https://██████████/pubs/movepapers.php using pubgroupid parameter. This is my third SQLi and probably the last one found on this host. I wasn't able to detect more, but due to the big number of high impact issues found I als...
Semrush: XSS Reflected on my_report
Еще раз привет. На этот раз, кроме HTML-инъекции проходит полноценный XSS в дашбоарде пользователя. Payload: https://www.semrush.com/myreports/api/v1/document%22%3E%3Cimg%20src=x%20onerror=alertdocument.cookie%3E/4007861 PoC: На скрине Impact Кража сессионных куков...
MariaDB: [downloads.mariadb.org] CRLF injection in case of encoded query mark
A CRLF injection vulnerability was reported and fixed for our downloads.mariadb.org website. The attack could lead to cookie injection, HTTP response splitting and session fixation attacks, amongst other things, across mariadb domains...
Keybase: macOS privilege escalation
Short description We can add an arbitrary folder to the default $PATH environment variable, so we can exploit this to run arbitrary code as the targeted user. Steps to reproduce 1. In the example I will use the low privileged nobody account could be any other account and I will target the u3mur4...
Nextcloud: Bypassing lock protection
Nextcloud allows multi account within the android client app and relies on a single lock Based on the exposed intent nc://login, it is possible to add a new account under attacker domain and open the Nextcloud without the lock check. Proof of concept 1. open the NC app with the lock displayed 2...
RATELIMITED: Credientals Over GET method in plain Text
Hi Team, Description While I was testing the application i found this bug where the application is sending the credentials over Plain text in URL : https://auth.ratelimited.me/login?username=testqaz%40grr.la&password=D33vanh%40h%40h%40 Vulnerable URl https://auth.ratelimited.me Impact Impact: if...
WordPress: Mssing Authorization on Private Message replies (BuddyPress)
Description: Users can reply to private message threads which they are not participants of by changing the threadid parameter in the messagessendreply ajax action. This affects both the Legacy and Nouveau Template packs. Steps To Reproduce: 1. Login to your account 2. Send the following request...
Node.js third-party modules: [takeapeek] XSS via HTML tag injection in directory lisiting page
I was taking a peek at takeapeek module and found it is vulnerable to XSS via malicious injection in directory listing. It allows execution of arbitrary JS code. Module module name: takeapeek version: 0.2.2 npm page: https://www.npmjs.com/package/takeapeek Module Description A simple static...
Mail.ru: Доступ к аккаунту после смены пароля.
Session was not expired on password change in pandao.ru...
Node.js third-party modules: [glance] Access unlisted internal files/folders revealing sensitive information
I would like to report sensitive information disclosure in glance. Similar to 486933 in ways Module module name: glance version: 3.0.5 npm page: https://www.npmjs.com/package/glance Module Description a quick disposable http server for static files Module Stats weekly downloads 41 Vulnerability...
U.S. Dept Of Defense: SQL Injection in the get_publications.php on the https://█████
Description Hello. I was able to find Time-based SQLI on the https://███/pubs/getpublications.php using pubgroupid parameter POC GET /pubs/getpublications.php?pubgroupid=wrtqvasi10rc19j1'%2bselectfromselectsleep5a%2b'&rno86qi4=1 HTTP/1.1 Host: █████ Connection: keep-alive Cache-Control: max-age=0...
Shopify: Access to Employee calendar disclosing internal presentation and meetings
Summary During a school research, we found out that some Shopify employees have their google calendar set to public. This discloses some sensitive informations: New hire information due to onsite interviews Internal presentation we found at least one internal presentation that we could access Zoo...