15416 matches found
RATELIMITED: HTTP PUT method enabled
Hi security team, Summary: It is possible to upload files to the server using the PUT method Steps To Reproduce: 1. I used the following request: PUT /emitrani.txt HTTP/1.1 Host: ratelimited.me Content-Length: 10 Connection: close emitrani POC Now a file exists at...
Node.js third-party modules: stored xss in scrape-metadata when reading metadata from an html page
Hy Module scrape-metadata https://www.npmjs.com/package/scrape-metadata Module Description a module used to scrape meta data contents from an article Vulnerability Description It was possible to embed malicious js code in metadata content read by scrape-metadata. When library reads such metadata,...
Mail.ru: Shell upload in partner service
Shell code upload RCE vulnerability in partner service provided as an additional functionality withing mail.ru branded service. On the moment of reporting, partner services are not covered by bug bounty program, the bounty was awarded due to potential problem criticality...
GitLab: SSRF in CI after first run
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: During the first run, the CI...
Brave Software: OPEN REDIRECTION at every 302 HTTP CODE
Summary i guess every 302 HTTP CODE on https://publishers.basicattentiontoken.org possible to OpenRedirection Steps To Reproduce: 1. I edited the request when i got redirected from this request url...
Brave Software: Navigation to restricted origins via "Open in new tab"
Summary: It's possible to open links pointing to file:/// origin from web pages using "Open link in a new tab" in context menu. https://hackerone.com/bugs?reportid=369185 shows unsafe ssh:// protocol handling, which leads to information leak using sshOS username and etc.. The vulnerability is...
Mail.ru: XSS в теле письма, в новой версии почты.
DOM clobbering in new "Octavius" interface beta feature led to stored XSS on message reading...
Brave Software: Unsafe handling of protocol handlers
Summary: Brave browser macOS handles protocol handlers in unsafe way and differently from other browsers. Key differences between protocol handlers handling in Brave and other browsers: Open external app vs Open "Terminal" Brave only asks about opening external app. Other browsers e.g. Chrome ask...
Brave Software: URL spoofing in Brave for macOS
Summary: URL spoofing vulnerability. Repro window.onclick = function x = window.open'https://www.google.com/csi'; setTimeoutfunction x.document.writeI am not a www.google.com;click me , 100; URL in address bar is https://www.google.com/csi, but actually that's about:blank page. Attacker could...
██████: Remote Command execution due to image tragick
During my auditing of a profile avatar functionality I discovered that the website was affected by image tragick by using a curl request as seen below F349064 I then made a request to read etc/passwd F349067 I then wanted to prove maximum impact by further pivoting the rce. Due to not wanting to...
VK.com: Просмотр записей пользователя, который тебя заблокировал
Отсутствовали проверки черного списка в одном из действий при работе с записями пользователя...
Rocket.Chat: Open redirect open.rocket.chat/file-upload/ID/filename.svg
Summary: Open redirect through svg file upload Description: When you upload a file to a chat, the link to it will look like https://open.rocket.chat/file-upload/ID/filename.svg, but the file will be on storage.googleapis.com. We can embed js in our svg and when the victim goes to...
Mail.ru: XSS via message subject - mobile application
XSS in message compose window on forwarding message with crafted subject / sender name / content in mobile application for android...
Udemy: [engineering.udemy.com] - Subdomain Takeover (ghost.io)
Hi Security Team, Found that DNS record of engineering.udemy.com domain was pointing to inactive ghost.io instance. So when we visit https://engineering.udemy.com we will be notified that site doesn't exist. F310092 $ host engineering.udemy.com engineering.udemy.com is an alias for...
Vanilla: FileUpload Plugin: CSRF (delete all attached files)
Description ------------ The current version 1.9.1 of the official FileUpload plugin is vulnerable to CSRF. A successful attack allows the removal of files the attacked user has the permission to delete. Administrators for example have the permission to delete all attached files. As the request t...
Starbucks: athome.starbucks.com - URL parameter tampering of review forms permitted possible content injection
jackb898 discovered that the review forms on the informational site athome.starbucks.com was susceptible to parameter tampering possibly allowing for creation of limited custom review form content. @jackb898 — thank you for reporting the original vulnerability, the additional information and for...
Reverb.com: Basic auth details is still work on report ( 351555 )
Hi , Seem report 351555 is not full fixed where 434762629765715:PQlkrSHPqqjhIBc0MmUkdjcqpps basic auth details are Still work on login Poc : https://api.cloudinary.com/v11/reverb/usage F309894 Impact information Disclose...
Starbucks: PHPinfo page
GET /test.php HTTP/1.1 Host: 52.90.193.152 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.21 KHTML, like Gecko Chrome/41.0.2228.0 Safari/537.21 Accept: / Impact This file may expose sensitive information that may help an maliciou...
Uber: [data-07.uberinternal.com] SSRF in Portainer app lead to access to Internal Docker API without Auth
Vulnerability description not provided...
Mail.ru: слепая XSS в админ панели torg.mail.ru через отзыв
Blind XSS in admin panel for torg.mail.ru. torg.mail.ru is not in bug bounty program's scope, a bounty was awarded due to high potential impact. Недостаточная фильтрация приводит к XSS в административной панели в одном из поддоменов mail.ru через имя пользователя при оставлении отзыва...
VK.com: Уязвимость в методе auth.restore
Недостаточные проверки при восстановлении страницы...
PortSwigger Web Security: Activat burp suite pro with the old license after transfared to anothe account
Hi team. I made 2 accounts and purchased burpsuite pro. The first account with this email :- ███████ The second account with this email :- ██████ I have opened a support ticket on Jun 13, 2018 05:26PM and the message is :- Hi Could you please add this account to my existing account ████ ███████ t...
Node.js: Your page has 2 blocking CSS resources. This causes a delay in rendering your page.
This report was not deemed to be a security vulnerability and the reporter was asked to open an issue upstream to fix publicly...
Shopify: Subdomain Takeover - https://competition.shopify.com/
Dear Shopify Security Team, The Shopify.com subdomain competition.shopify.com was vulnerable to a subdomain takeover as it was pointing to an unclaimed Heroku service through the CNAME competition.shopify.com.herokudns.com, while the custom domain 'competition.shopify.com' was unclaimed in Heroku...
Uber: Privacy policy contains hardcoded link using unencrypted HTTP
The link to Uber’s privacy policy was using the unencrypted http:// scheme, making it possible for an attacker with the ability to Man-in-The-Middle MiTM traffic. This would allow them to replace normal responses with malicious content such as a phishing page. The content would then render within...
Valve: Comment restriction in subsection "Workshop" of domain "steamcommunity.com" can be bypassed using IDOR
Summary - While testing Domain "steamcommunity.com", i found subsection "workshop" which has restriction to comment on workshop items of the game which i do now own in my account. This access control can be bypassed using IDOR and user can post comment though comment section is disabled on worksh...
Mail.ru: Stealing Arbitrary Private Files of MyMail App
It was possible for local malware application to steal sensitive local files of MyMail / Mail.Ru Mail application due to specifics of file:// schema URI handling in SharingActivity...
Basecamp: Remote code execution on Basecamp.com
A critical flaw in Basecamp's profile image upload function leads to remote command execution. Images are converted on the server side, but not only image files but also PostScript/EPS files are accepted if renamed to .gif. This is probably due to ImageMagick / GraphicsMagick being used for image...
Uber: Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root password
@peuch found data exposure on Github - expired passwords and usernames for ESXi a bare metal hypervisor. The researcher also found credentials to a SendGrid instance uberinfradevtools, which would have allowed them to log in to SendGrid and send email from any @uber.com address. However, this wou...
QIWI: XSS https://agent.postamat.tech/ в профиле + дисклоз секретной информации
Здравствуйте. Я раскрутил ваш сайт https://agent.postamat.tech/ на интересную XSS + достаточно серьезный баг, который дисклозит некоторую пользовательскую информацию. Хочу заметить что на данном сайте хранятся некоторые личные данные пользователей, следовательно из этой XSS можно извлечь достаточ...
Mail.ru: SQL injection on jd.mail.ru
SQL injection via POST parameter in user registration at jd.mail.ru. die ███████████████████████████ ███████▀▀▀░░░░░░░▀▀▀███████ ████▀░░░░░░░░░░░░░░░░░▀████ ███│░░░░░░░░░░░░░░░░░░░│███ ██▌│░░░░░░░░░░░░░░░░░░░│▐██ ██░└┐░░░░░░░░░░░░░░░░░┌┘░██ ██░░└┐░░░░░░░░░░░░░░░┌┘░░██ ██░░┌┘▄▄▄▄▄░░░░░▄▄▄▄▄└┐░░██...
Internet Bug Bounty: Client DoS due to large DH parameter (CVE-2018-0732)
https://www.openssl.org/news/secadv/20180612.txt OpenSSL Security Advisory 12 June 2018 ======================================== Client DoS due to large DH parameter CVE-2018-0732 ==================================================== Severity: Low During key agreement in a TLS handshake using a DH...
Smule: Disclosure of information about the system, configuration files.
Disclosure of django configuration via debug mode...
Monero: Misreporting of received amount by show_transfers
Summary: A sender may cause showtransfers to report a higher amount that was actually sent on the recipient's showtransfers output. Description: Due to a flaw in processnewtransaction in wallet2.cpp, if the tx pubkey is present multiple times, it will decode outputs correctly as many times, and a...
Upserve : OLO Total price manipulation using negative quantities
Manipulating an order request JSON object, containing an additional item with a negative quantity directly manipulates the total amount of the order. In the following JSON request, an order is submitted for 2 ChickenBurgers $12 each, as well as -1 BreadPuddings $9 each. The total price after tax...
VK.com: Просмотр приложений любого пользователя / группы
Просмотр чужих списков приложений...
New Relic: Insecure Infrastructure Integrations YML Loading leads to Windows Privilege Escalation
After installing the Windows Infrastructure client as discussed in https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/installation/install-infrastructure-windows-server I noticed that integration yml config files are not only loaded from the folder within Program Files, but al...
Ruby: SEGV in parse_rat()
A crafted string can cause SEGVREAD memory access to 0x000000000000 when parsed as rational number - ruby 2.5.1p57 on Fedora 28 $ ruby -e 'Rational"2e-9942067"' -e:1: warning: in ab, b may be too big -e:1: BUG Segmentation fault at 0x0000000000000000 ruby 2.5.1p57 2018-03-29 revision 63029...
Liberapay: No Data Validation, No Captcha, No Filters...
POST /for/new HTTP/1.1 Host: liberapay.com User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:52.0 Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer:...
Liberapay: Improper Data Validation / Unvalidated Input
Steps to reproduce: 1 - Be logged in a account 2 - Go to: https://liberapay.com/user/edit/statement 3 - Click on Visualize 4 - Submit and edit POST parameters to fuzz infinitely 5 - Wait the server proccess the request. I send only 2.813.054 characters. Improper input size validation... I'm sorry...
Liberapay: Cross site scripting (content-sniffing)
This type of XSS can only be triggered on and affects content sniffing browsers. This script is possibly vulnerable to Cross Site Scripting XSS attacks. This vulnerability affects /sign-up URL encoded POST input sign-in.currency was set to USDG8OAI!+! The input is reflected inside a text element...
Pornhub: Blind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues)
Researcher found a blind SQL injection in the profile comment Like functionality, executing on the second request made for a given comment dislikes. Summary The injection was found manually, used discovery methods are basically the same as described in this awesome article by @gerbenjavado:...
VK.com: Долгоживущий хеш + получение частичного доступа к аккаунту после сброса сессии
Hash lifetime...
RBKmoney: SUBDOMAIN TAKEOVER [http://dev.rbk.money/]
The DNS record of dev.rbk.money pointed to the Github, but the domain was not used in any Github account. So it was possible to bind it to any repository...
Monero: monerod can be disabled by a well-timed TCP reset packet
Summary: A well-timed TCP reset RST can cause monerod or any service relying on epee to stop accepting new connections. Description: When a new connection is attempted, the handleaccept function is called. This does some error checking and finishes setting up the connection. Once the connection i...
Monero: Constant-time comparison is not always implemented; critical areas are vulnerable to key-timing attacks
In my most superficial of reviews, constant-time comparison appears to not be globally implemented at a glance, only implemented within the ref10 implementation. With that said, the following areas either appear to be vulnerable, or are potentially vulnerable, to key-timing attacks: 1. Containers...
Liberapay: Buffer overflow
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program attempts to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an arra...
IOVLabs: DoS through PeerExplorer
Summary: The peer discovery implementation is vulnerable to a Denial of Service attack due to improper management of connections. Description: The two main files of interest in detailing this vulnerability are PeerExplorer.java and NodeChallengeManager.java. To explain the flow of execution I'll ...
OLX: Search Page Reflected XSS on sharjah.dubizzle.com through unencoded output of GET parameter in JavaScript
Hi, I found a reflected XSS vulnerability on the search page of sharjah.dubizzle.com. Because the GET parameter keywords is not being encoded before parsing it into the JavaScript, an attacker can break out of the code an execute JavaScript in the targets browser. Vulnerable Code When searching f...