VK.com: [Клевер/Android] Небезопасный BroadcastReceiver позволяет создавать окно диалога в приложении посредством другого неавторизованного приложения

Небезопасный BroadcastReceiver. morethEnvulnerability Click to view screenshot Когда приложение видно пользователю в MainActivity регистрируются два ресивера: java registerReceiverthis.r, new IntentFilter"com.vk.quiz.action"; registerReceiverthis.q, new IntentFilter"com.vk.quiz.action.coins";...

Chaturbate: Account Takeover via billing

The hacker found that when subscribing to a fanclub the parameters could be manipulated to purchase a fanclub subscription for another user. This will set the email of the target account if they had no email on file. This could then be used to reset the password for the target user. The purchasin...

Node.js third-party modules: [samsung-remote] Command injection

I would like to report a command injection vulnerability in the samsung-remote npm module. It allows arbitrary shell command execution through a maliciously crafted argument. Module module name: samsung-remote version: 1.2.5 npm page: https://www.npmjs.com/package/samsung-remote Module Descriptio...

Ruby on Rails: Validation bypass for queries generated for PostgreSQL

When using DB for PostgreSQL, I discovered that if a parameter of a query contains null character, there is a pattern in which subsequent strings are lost. how to reproduce Prepare the environment $ rails new postgresqlrails -TB --database=postgresql $ cd postgresqlrails $ bundle exec ruby -v rub...

Passit: app.passit.io is vulnerable against username enumeration

Summary: The application app.passit.io is vulnerable against username enumeration through the use of error messages and dictionary attack. Description: We noted that the application uses GET request with a rate limit of 60 seconds which is too broad. The application returns an error message that...

Discourse: Web Cache Deception Attack (XSS)

This XSS does not affect the try.discourse.org, but worked on many other Discourse instances, that i tested. In discussions with the Mozilla team, we came to the conclusion that this is a vulnerability in the Discourse and it needs to be sent through this program. List of vulnerable hosts:...

Ed: Physical Laptop Takeover

At 6:16PM of August 11th of 2018, during H1-702, right before the sand storm beat the shit out of the rooftop party, we managed to perform a critical attack on Ed's infrastructure. F332214 Report Summary During our analysis and reconnaissance of how Ed program worked during the h1-702 event, we...

Snapchat: Domain Takeover in [obviousengine.com] a snapchat acquisitions

Hello, Summary while searching in snapchat acquisitions i found obviousengine moe information here https://www.crunchbase.com/organization/obvious-engineeringsection-overview and i found that it's pointing to Github page so i claimed it POC - when i visit it was look like F331040 - i successfully...

MariaDB: vulnerable to Cross-site Request Forgery | Jira

Vulnerabilities in our publicly available issue and bug tracking Jira instance have been reported and resolved to the best of our abilities by upgrading to the latest available Jira software from Atlassian...

Slack: Possibility to freeze/crash the host system of all Slack Desktop users easily

Hello, I report here what I suspect to be a critical issue for all your users using the Slack Desktop app. Please find below my research way and the corresponding POC result: First, I started by exploring the content of the file app.asar of the Slack Dresktop application. I was firstly attrackted...

MariaDB: Vulnerability Report - Missing Certificate Authority Authorization rule

A missing DNS Certificate Authority Authorization rule was reported for our main domain. We resolved this by adding the relevant CAA rules in our DNS configuration...

Zendesk: Admin Macro Description Stored XSS

A description field only available to account Administrators allowed for unexpected input which could be triggered to execute JavaScript if viewed by lower-level roles under certain circumstances. Thanks to @hariharan21 for their great work!...

Mail.ru: Хранимая XSS в пожертованиях на dobro.mail.ru

Stored XSS in dobro.mail.ru charity crowdfunding service. dobro.mail.ru is not currently covered by bug bounty program. XSS при пожертвовании , помогите там кому нибудь https://dobro.mail.ru/ ███████████████████████████ ███████▀▀▀░░░░░░░▀▀▀███████ ████▀░░░░░░░░░░░░░░░░░▀████...

RubyGems: Malware in `active-support` gem

This was sent to RubySec: The gem duplicates official activesupport no hyphen code, but adds a compiled extension. The extension attempts to resolve a base64 encoded domain 29faea63.planfhntage.de, downloads a payload, and executes...

Uber: [First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameter

Stored XSS execution at https://login.uber.com due to unsanitized user-supplied input passed through Privacy Policy URL...

Monero: Malicious get_random_rct_outs.bin rpc can cause a near-infinite loop

Summary: An unsanitized getrandomrctouts.bin rpc request can cause the rpc handler to go into an effectively infinite-loop, peg the cpu, and block other requests from completing. Description: The rpc endpoint /getrandomrctouts.bin takes a uint64 outscount as input and will return that many random...

Shopify: Stored XSS on activity

Hi security team members, Description I found a store xss on the activity which allows an attacker to steal admin account cookies. Step to reproduce 1-Create store 2- Add a member in a store 3- Member can choose any name 4- So change the any member name with hunter" 5- Now on admain account make...

Yelp: Unauthorized Use of Victim Credit Card

SUMMARY Yelp user's credit cards are at risk of being compromised There's a way by which a malicious attacker can make unauthorized purchases from the victim's credit card. Just by getting the victim to some external website and clicking on it, the victim would have eventually paid for some...

Valve: Getting all the CD keys of any game

Using the /partnercdkeys/assignkeys/ endpoint on partner.steamgames.com with specific parameters, an authenticated user could download previously-generated CD keys for a game which they would not normally have access. Audit logs were not bypassed using this method, and an investigation of those...

Block.one: [FG-VD-18-126] Buffer Overflow Vulnerability in Latest EOS's EOSIO.WASMSDK Repository II

Hello Block.One / EOS Product Security Team, Good Afternoon. There exists a Memory Corruption vulnerability in the latest EOS WASMSDK Library. The PoC.wasm file is attached along with this report. Reproduction Steps: - 1 Fetch latest EOS WASMSDK repsository from...

Block.one: [FG-VD-18-125] Buffer Overflow Vulnerability in Latest EOS's EOSIO.WASMSDK Repository

Hello Block.One / EOS Product Security Team, Good Afternoon. There exists a Memory Corruption vulnerability in the latest EOS WASMSDK Library. The PoC.wasm file is attached along with this report. Reproduction Steps: - 1 Fetch latest EOS WASMSDK repsository from...

Yelp: I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)

@hk755a found an Insecure Direct Object Reference IDOR Vulnerability that allowed an attacker to pay with someone else's registered credit card, while ordering food with Grubhub through the /checkout/transactionplatform endpoint. No credit card information was disclosed as a result of this...

Node.js third-party modules: Code Injection Vulnerability in dot Package

I would like to report a code injection vulnerability in dot. It allows attackers to execute arbitrary JS code, especially when combined with a prototype pollution attack. Module module name: dot version: 1.1.2 npm page: https://www.npmjs.com/package/dot Module Description Created in search of th...

Node.js third-party modules: Code Injection Vulnerability in morgan Package

I would like to report a code injection vulnerability in morgan. It allows an attacker to inject arbitrary JS commands in certain situations. Module module name: morgan version: 1.9.0 npm page: https://www.npmjs.com/package/morgan Module Description HTTP request logger middleware for node.js Name...

U.S. Dept Of Defense: SQL Injection on www.██████████ on countID parameter

Description: Hello Team, I have came across a sql injection vulnerability on www.██████ on countID parameter. I was able to retrieve the banner which is Microsoft SQL Server 2008 R2 SP3 - 10.50.6220.0 X64& Mar 19 2015 12:32:14 Copyright c Microsoft Corporation Standard Edition 64-bit on Windows N...

Node.js third-party modules: Command Injection Vulnerability in win-fork/win-spawn Packages

I would like to report a command injection vulnerability in win-fork and win-spawn packages. It allows an attacker to inject multiple commands in exec-like manner. Module module name: win-spawn version: 2.0.0 npm page: https://www.npmjs.com/package/win-spawn npm page:...

Node.js third-party modules: Command Injection Vulnerability in libnmap Package

I would like to report a command injection vulnerability in libnmap. It allows an attacker to inject arbitrary OS commands instead of a valid network range to be scanned. Module module name: libnmap version: 0.4.11 npm page: https://www.npmjs.com/package/libnmap Module Description API to access...

Node.js third-party modules: Prototype Pollution Vulnerability in mpath Package

I would like to report prototype pollution vulnerability in mpath. It allows an attacker to inject arbitrary properties on Object.prototype. Module module name: mpath version: 0.4.1 npm page: https://www.npmjs.com/package/mpath Module Description G,Set javascript object values using MongoDB-like...

Node.js third-party modules: Prototype Pollution Vulnerability in noble Package

I would like to report prototype pollution vulnerability in noble. It allows attackers to pollute the Object.prototype object of an application running noble, possibly through Bluetooth. Module module name: noble version: 1.9.1 npm page: https://www.npmjs.com/package/noble Module Description A...

Node.js third-party modules: Command Injection is ps Package

I would like to report a command injection in ps package. It allows attacker to inject arbitrary OS commands instead of PID numbers. Module module name: ps version: 0.0.2 npm page: https://www.npmjs.com/package/ps Module Description A Node.js module for looking up running processes. Module Stats ...

Node.js third-party modules: Prototype Pollution Vulnerability in cached-path-relative Package

I would like to report a prototype pollution attack in cached-path-relative. It allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain. Module module name: cached-path-relative version: 1.0.1 npm page:...

Nextcloud: Stored XSS on scan.nextcloud.com

The scan.nextcloud.com engine fetches a 'status.php' content in order to extract some version number as well as installed flavors. While scanning a website, the following API-wise cinematic happens : POST https://scan.nextcloud.com/api/queue twice, gives the UUID GET...

Revive Adserver: Open redirect in switch account functionality

To reproduce this vulnerability: 1. You have to be logged in user 2. Enter address: http:///www/admin/account-switch.php?returnurl=http://127.0.0.1:12345/test This is due to unrestricted redirection url passed in in the returnurl parameter. I would recommend to use some kind of whitelisting or a...

Node.js third-party modules: [ascii-art] Command injection

I would like to report a command injection vulnerability in the ascii-art npm module. It allows arbitrary shell command execution through a maliciously crafted command line argument. Module module name: ascii-art version: 1.4.3 npm page: https://www.npmjs.com/package/ascii-art Module Description...

New Relic: DNS misconfiguration on email.alerts.newrelic.com

While checking the subdomains i found that the subdomain email.alerts.newrelic.com upon navigating downloads a file saying "Mailgun Magnificent API" And has the following DNS info screenshot attached The problem lies in this issue: You add the domain email.alerts.newrelic.com to Mailgun Mailgun...

Monero: Stack Overflow in JSON RPC Server

Summary: There is a stack overflow bug in jsonparser when parsing nesting objects. Description: Monero's json parser handled by epee libraries doesn't check object tree depth while parsing Steps To Reproduce: Up the service bash monerod run bash python2 poc.py backtrace SUMMARY: AddressSanitizer:...

Valve: Reflected XSS on help.steampowered.com

URL: https://help.steampowered.com/en/wizard/HelpWithGameIssue/?appid=704740&issueid=125&option=%3Ch1%3Eunfiltered It puts option option into a translation token HelpGameMissingItemsTitleuser controlled string here And if there's no such translation token, it just prints out the entire user input...

Uber: Reflected XSS on https://www.uber.com

By getting an authenticated victim to visit a malicious website, an attacker can cause that victim to execute arbitrary JavaScript in the context of the uber.com domain. More details here: https://medium.com/@saamux/applying-a-small-bypass-to-steal-facebook-session-tokens-in-uber-5b9638b7a18c...

Brave Software: Local files reading from the "file://" origin through `brave://`

Summary: Sadly, fix for 390013 works only for web. Loading brave:// from the file:// origin allows reading local files on the device. I said that fix could be insufficient 😈 file:// and brave:// both are local origins. That means it's possible to access brave:// from file:// and vice versa...

U.S. Dept Of Defense: SOAP WSDL Parser SQL Code Execution

Summary: SOAP WSDL Parser SQL Code Execution Description: It was possible to parse WSDL resources and read all functions from the SOAP Admin Panel, therefor i was able to repeat the sql query with a tampered request with my own custom SQL command. i was able to extract all the database names for...

Uber: Reflected XSS on Partners Subdomain

There was a reflected cross site scripting vulnerability at https://partners.uber.com/. By providing a specifically crafted value, it was possible for an attacker to inject malicious content into the partners.uber.com site, which would then be executed when the site is loaded. We enjoyed working...

VK.com: Узнаем несколько цифр номера телефона юзера (можно флудить смс), всего раз узнав его remixsid и его ид юзера, и установка оффлайна юзерам.

Недостаточные проверки сессии. Было можно узнать часть номера телефона юзера и отправлять ему смс с ссылкой на приложение https://vk.com/mobile всего раз узнав его remixsid, вне зависимости сколько раз были ресетнуты сессии. Самый давний валидный для этой темы remixsid был давности май 2016 года...

Brave Software: Local files reading from the web using `brave://`

Summary: brave:// protocol was introduced as a replacement for AsarProtocolHandleror something like that in brave/muon after 375329. However, fix for 375329 introduced a new much severe bug that allows reading files from a user's device from the web. PoC is similar to 375329, but it uses brave://...

Shipt: Subdomain takeover at segway.shipt.com

A security researcher identified a stale DNS record that pointed to a legacy 3rd party service. This allowed for a subdomain takeover, which the researcher provided a well written and detailed Proof of Concept POC. Shipt's security team acted immediately to validate the vulnerability and remove t...

HackerOne: TeamProfile exposes partially sensitive information through GraphQL

I noticed there is new field teamprofile added and using the graphql below the latest serious report and reports received in three months were exposed "query":"query Dashboardreportseveritybreakdowntable$first0:Int! \n query \n id,\n ...F0\n \n\nfragment F0 on Query \n...

Upserve : [theacademy.upserve.com] Reflected XSS Query-String

Steps To Reproduce: Open URL in FireFox: https://theacademy.upserve.com/roles/?%22%3E%3Cscript//src=data,alertlocation// HTTP Request http GET /roles/?%22%3E%3Cscript//src=data,alertlocation// HTTP/1.1 Host: theacademy.upserve.com HTTP Response html Name Views Duration Impact Reflected XSS...

Node.js third-party modules: Code Injection Vulnerability in zombie Package

I would like to report a code injection vulnerability in zombie. It allows crawled websites to access privileged APIs such as the file system or child process. Module module name: zombie version: 6.1.2 npm page: https://www.npmjs.com/package/zombie Module Description Insanely fast, headless...

Node.js third-party modules: Command Injection Vulnerability in kill-port Package

I would like to report a command injection vulnerability in kill-port. It allows an attacker to inject arbitrary commands. Module module name: kill-port version: 1.3.1 npm page: https://www.npmjs.com/package/kill-port Module Description Kill the process running on given port Module Stats 5,282...

Starbucks: Backup Source Code Detected

Impact Depending on the nature of the source code disclosed, an attacker can mount one or more of the following types of attacks:•Access the database or other data resources. With the privileges of the account obtained, attempt to read, update or delete arbitrary data from the database. •Access...

U.S. Dept Of Defense: IDOR

Summary: IDOR Description: By changing the value in the parameter █████████= from my own account █████ to something else such as ████████ it is possible to see barcode and expiration date of other ████ without their consent. Impact Information Disclosure Step-by-step Reproduction Instructions 1...