15602 matches found
Weblate: Broken Authentication – Session Token bug
I found a broken authentitication vuln POC: 1- Create a https://demo.weblate.org/accounts/profile/ account 2- Confirm your email 3- Now request a password reset for your account. 4- Don’t use the password reset link that was sent to your email. 5- Login to your account, remember don’t use first t...
PortSwigger Web Security: Browser Self XSS Protection not implemented
Hi Self XSS Protection not used ,An attacker can trick users to insert JavaScript in browser console. A Self-XSS scam usually works by promising to help you access somebody else's account. Instead, the scammer tricks you into gaining access to your account for fraud, spam and tricking more people...
Weblate: Browser Self XSS Protection not implemented
Hi Self XSS Protection not used ,An attacker can trick users to insert JavaScript in browser console. A Self-XSS scam usually works by promising to help you access somebody else's account. Instead, the scammer tricks you into gaining access to your account for fraud, spam and tricking more people...
Mail.ru: XSS in e.mail.ru
Приветствую! Нашел XSS на e.mail.ru, при написании письма. Предыстория: Для начала я взял аккаунт на Яндексе с готовым xss вектором в имени ", но возникла некая трудность в плане авторизации, меня не пропускало из за недопустимых символов в имени, тогда я взял смартфон, и авторизовался через...
X (Formerly Twitter): Access MoPub Reports Data even after Company removed you from their MoPub Account.
Description + Attacking approach API Workflow : - The MoPub Reporting API supports two separate CSV outputs where publishers can retrieve inventory or campaign performance data. - Publishers can retrieve daily reports via making a GET request using the request parameters. - This URL will return a...
Rocket.Chat: Remote code execution by hijacking an unclaimed S3 bucket in Rocket.Chat's installation script.
Hi team, When I downloaded the latest release of Rocket.Chat to test the fix for my previous report I spotted an install.sh script. Inside that installation script I noticed the following line: diff !/bin/bash set -x set -euvo pipefail IFS=$'\n\t' ROOTPATH=/var/www/rocket.chat PM2FILE=pm2.json if...
Khan Academy: Possible Subdomain Takeover
None of the weakness categories really fit this so I apologize for that. The subdomain learnstormindia.khanacademy.org points to 52.203.185.84 a webflow.io proxy server proxy-ssl.webflow.com. The CNAME entry in the subdomain is pointing to an external page service learnstormindia.khanacademy.org...
GitLab: Unauthenticated blind SSRF in OAuth Jira authorization controller
The Oauth::Jira::AuthorizationsControlleraccesstoken endpoint is vulnerable to a blind SSRF vulnerability. The vulnerability allows an attacker to make arbitrary HTTP/HTTPS requests inside a GitLab instance's network. Proof of concept To reproduce the vulnerability, follow the steps below. - spin...
Starbucks: DVR default username and password
Summary: default username and password i found in one of your DVR camera system Description: hi after scanning on starbucks register ip from this site http://bge.he.net i start to scan the ip subnet : ████ then i found this ip : █████ then i try to browse it then i found login page for DVR cam...
DuckDuckGo: SSRF on duckduckgo.com/iu/
Normally, a call to https://duckduckgo.com/iu contains a query parameter u with some path using the domain yimg.com. This call will succeed in most cases. F337121 And if we change that path to something like https://google.com it's rejected. F337118 However, it appears that the check that ensures...
Open-Xchange: CSRF combined with IDOR within Document Converter exposes files
Summary There appears to be a vulnerability with the document converter service which allows an authenticated user or guest user with write permissions to export a victim’s files, regardless of permissions in place. An example vulnerable endpoint is the following...
Node.js third-party modules: [serve] XSS via HTML tag injection in directory lisiting page
I would like to report HTML injection in serve module. It allows malicious HTML tags injection and execution of arbitrary JS code Module module name: serve version: 9.6.0 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...
Mail.ru: Blind SQL injection [https://honor.hi-tech.mail.ru]
Blind boolean based SQLi in honor.hi-tech.mail.ru due to insecure use of GET parameter. Extended scope was not covered by bug bounty on the moment of reporting, the bounty was issued as a bonus...
HackerOne: DOM Based XSS in www.hackerone.com via PostMessage
Summary: The Marketo contact form available on the www.hackerone.com website is affected by a cross-site scripting vulnerability, caused by an insecure 'message' event listener installed on the page. Whilst this could allow an attacker to execute JavaScript in the context of the www.hackerone.com...
HackerOne: @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.
Hola amigos, First off, I know RFCs are annoying. Second of all, namespace attacks are a btch. With that out of the way, here is an Inti-bug that was discovered as a result of reading RFC2142 very carefully. Brief summary of RFC2142 RFC2142 defines a standard set of email addresses that cover...
Mail.ru: XSS on New contact
Self-XSS was reported for web.icq.com. According to bug bounty program's rules, self XSS reports are not considered...
Valve: Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injection
With the vulnerability of the GoldSource Engine, the server is able to perform remote code execution on the client, overwriting the stack when reading the BMP file. The problem is in the LoadBMP8 function, which is executed when the player connects to the server, by loading the...
Grab: Leaking sensitive information on Github lead full access to all Grab Slack channels
Summary: Accidental leakage of secret keys in such code repositories is a real problem, after my report 387117, I decided to dig deeper than the previous report and looking to some random profiles in Github, and doing some dirty work I was able to access to the developer’s company’s internal chat...
Chaturbate: Web cache deception attack - expose token information
Hello, I have found new Vulnerability in your website which called Web cache deception attack. It's found first time in Paypal. Web Cache Deception Attack Websites often tend to use web cache functionality to store files that are often retrieved, to reduce latency from the web server. Let's see a...
Uber: Stored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account Takeover
By getting an authenticated victim to visit a malicious link, an attacker can cause that victim to execute arbitrary JavaScript in the context of the login.uber.com or auth.uber.com domains...
New Relic: [NR Infrastructure] Restricted user can update integration provider account name via integrations API
NR Infra allows you to create a GCP integration and set a custom name. By default, the restricted user account can't change anything associated associated with this type of infra integration, but there is a missing check on changing the name of the integration through the integrations API. Observ...
Keybase: Privilege Escalation via Keybase Helper
A privilege escalation vulnerability exists within the KeybaseHelper application available when installing the Keybase Desktop Application on MacOS. The issue is exposed via a LaunchDaemon plist which is installed within /Library/LaunchDaemons/keybase.Helper.plist. This file is responsible for...
Node.js third-party modules: [express-cart] Customer and admin email enumeration through MongoDB injection
I would like to report an injection in express-cart It allows to enumerate the email address of the customers and the administrators. Module module name: express-cart version: 1.1.7 npm page: https://www.npmjs.com/package/express-cart Module Description expressCart is a fully functional shopping...
MariaDB: SSRF on jira.mariadb.org
Vulnerabilities in our publicly available issue and bug tracking Jira instance have been reported and resolved to the best of our abilities by upgrading to the latest available Jira software from Atlassian. Yes...
Augur: Indisputable Reporting via Arbitrarily Large Initial Reports
Summary: The initial reporter stake is determined by the REP balance of the specific InitialReporter contract at the time of initial report. This can be arbitrarily controlled via REP transfers at any time between Market creation and the initial report. Right off the bat, an attacker with 33.3......
New Relic: [NR Insights] Pull any Insights/NRQL data from any NR account
@jonbottarini discovered an issue where a feature within a cloud integration wasn't properly validating account IDs. This report helped us identify a backend issue that could prevent account validation from taking place in certain situations. This was a fun one! The full writeup is for this bug i...
Shopify: Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypass
Summary athena-flex-production.shopifycloud.com seems to be an internal system that Shopify uses because it redirects user to Okta login. During this however, I noticed that it first returns 200 and then does a redirect meaning some part of the website loads before redirecting. With this, I was...
Shopify: Stored XSS on buy button
I found an XSS vulnerability on buy button. Steps to reproduce Go to Settings General Store currency Change formatting and add on "HTML with currency" the payload €amount " After that go to buy button and you will see that the payload triggers there. Impact A staff member can takeover another...
HackerOne: Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature
Summary Although the report count is not showing, the Insights query endpoint returns a list of top 10 vulnerability types for any programs that haven't enabled the Insights feature. Reproduction 1. Go to a program that has Insights feature enabled, e.g: https://hackerone.com/security/insights 2...
IOVLabs: Attacker can add arbitrary data to the blockchain without paying gas
Summary: Due to a missing sanity check in Transaction::rlpParse, an attacker can append arbitrary RLP-encoded data to the end of an otherwise valid transaction, and that data will not only pass through validation, but also be propagated throug the network and mined into a block. Since the block...
Chaturbate: CSRF in "send them an email and browser notification" feature
The hacker found that the "send an email and browser notification" feature was a GET call and did not check for csrf tokens, this was resolved...
Starbucks: Reflected DOM XSS on www.starbucks.co.uk
Summary: www.starbucks.co.uk is vulnerable to reflected DOM XSS due to 2 seemingly unexploitable issues. The first issue is unfixed for over a year now, 252908, the second issue originates in a 3rd party module called prettyPhoto. Description: Visiting the following link results in a JavaScript...
Snapchat: Github Token Leaked publicly for https://github.sc-corp.net
Description : GitHub is a truly awesome service but it is unwise to put any sensitive data in code that is hosted on GitHub and similar services as i was able to find github token indexed 7 hours Ago by user ██████ - Software Engineer - Snap Inc Issue & POC : You can find the leak in this link :...
Vanilla: XSS: Group search terms
Summary: The sub domain https://kentico.vanillastaging.com has a DOM XSS can be executed on any user browser by a simple get request. Description: The search param in the get request has been set in it's text value and the response has been reflected in the DOM response. Request: GET...
Chaturbate: CSRF in cancel group and private show requests
The hacker found that the private and group show cancel urls were not checking for CSRF headers. This issue was quickly resolved. I have found a CSRF vulnerability in chat room. When users cancel group shows for any chat room, a POST request is made to the server on this endpoint...
Node.js third-party modules: Reflected XSS in the npm module express-cart.
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report Reflected XSS in...
Node.js: url.parse() hostname spoofing via javascript: URIs
Summary: Using url.parse in security sensitive checks is dangerous as an arbitrary hostname can be spoofed via javascript: URIs. Description: The original url.parse API is dangerous as it allows to spoof an arbitrary hostname via a javascript: URI: bash $ node -e...
Brave Software: `chrome://brave` available for navigation in Release build [-> RCE] + navigation to `chrome://*` using tab_helper ["Open in new tab"]
Summary: chrome://brave is available for navigation Navigation to chrome://brave + requires local file at . The file loaded in this context has access to private Muon APIs such as chrome.ipcRenderer/remote/webFrame/webViewRequest. Muon API allows executing code on the device. e.g. with...
DuckDuckGo: XSS in Subdomain of DuckDuckGo
A cross-site scripting vulnerability was discovered in a subdomain of DuckDuckGo. The subdomain had a Content Security Policy header intended to prevent script execution, but this could be bypassed in Internet Explorer. As a result, malicious scripts could be injected and executed in the...
Chaturbate: CSRF in REPORT EMOTICON feature
The hacker found that the report emoticon endpoint did not check the csrf token. This was resolved. Users can report to emoticons on the the basis of the expressions but the request made to https://chaturbate.com/emoticonreportabuse/emoticonname was a GET request which was not protected by CSRF...
Grammarly: `socket` command allows sending data over WebSockets to arbitrary origins from Grammarly Extension
Summary 1. Attacker could trigger Grammarly extension's socket command using a crafted page to perform WS connectionand data sending from extension's background page with cookies and origin to any URL. 2. Additionally, commands received from the attacker's server are handled by extension and coul...
DuckDuckGo: SSRF vulnerability on proxy.duckduckgo.com (access to metadata server on AWS)
Hello, I saw that SSRF on proxy.duckduckgo.com is out of scope but because of the severity I wanted to report this. The payload is simple: curl "https://proxy.duckduckgo.com/iur/?f=1&imagehost=http://169.254.169.254/latest/meta-data/" Response from the server: ami-id ami-launch-index...
HackerOne: Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties
Hello HackerOne team, this is probably going to be a different kind of report than what you are used to: it looks to me this is more of an internal, operational security best-practice that you may choose to follow. This is something that's bugging me from January now, but it took me some time and...
Chaturbate: Bypass subdomain limits using race condition
The hacker found that it was possible to add more than the limit of 5 whitelabel subdomains. The 5 limit is a soft limit, however we resolved this...
U.S. Dept Of Defense: ███████ Site Exposes █████████ forms
Summary The █████ site https://██████.mil/ allows authenticated users to submit ██████ e-forms. Due to a vulnerability in this system, any authenticated user can access the full █████████ e-form of any other user. Steps to reproduce 1. Intercept an authenticated request on █████████ containing an...
MariaDB: Incorrect Permission Assignment for Critical Resource
Dear Team, Product Affected: https://github.com/MariaDB/server File: /server/blob/10.3/sql/mysqld.ccL2761 if !SetSecurityDescriptorDacl&sdPipeDescriptor, TRUE, NULL, FALSE This was purely identified on code review, Never create NULL ACLs. A mail was sent to [email protected] and MariaDB team i...
Chaturbate: Stats Token doesn't expire after deactivating account
The hacker found that the stats token, that a user can use to access their own account information, does not expire when an account is deactivated. This was resolved so the view could not be used after deactivation. Application has a feature Authorize your 3rd party stats that provides users a wa...
Zendesk: Stored Cross Site Scripting on Zendesk agent dashboard
A cross-site scripting vulnerability was found in the Zendesk Support product. The Zendesk Security team validated the report within one day and implemented a remediation into production shortly after. Thank you @apfeifer27 for responsibly disclosing this issue and helping to keep Zendesk secure!...
VK.com: [Клевер/Android] Небезопасный BroadcastReceiver позволяет создавать окно диалога в приложении посредством другого неавторизованного приложения
Небезопасный BroadcastReceiver. morethEnvulnerability Click to view screenshot Когда приложение видно пользователю в MainActivity регистрируются два ресивера: java registerReceiverthis.r, new IntentFilter"com.vk.quiz.action"; registerReceiverthis.q, new IntentFilter"com.vk.quiz.action.coins";...