15602 matches found
Node.js third-party modules: Prototype pollution attack (extend)
I would like to report prototype pollution in extend It allows an attacker to inject properties on Object.prototype. Module module name: extend version: 3.0.1 npm page: https://www.npmjs.com/package/extend Module Description node-extend is a port of the classic extend method from jQuery. It behav...
Slack: SSRF in api.slack.com, using slash commands and bypassing the protections.
Bypassing the reports 61312 and 356765 Tutorial: Go to api.slack.com and create an application with your own slash command. F320014 Enter your own domain: in your own domain: index.php location: http://:::22/ F320019 And save. Go to your Slack and type /youslash Try with my server...
Starbucks: Open Redirection in Login - Korean Starbucks
Summary: Open Redirection is performed in Korean Starbucks login page. An attacker can redirect victim to other site such as fishing. Description: When victim visit https://www.istarbucks.co.kr/login/login.do?redirecturl=//www.bughunting.net this site, and login, he/she is redirected to...
Node.js third-party modules: Prototype pollution attack (defaults-deep / constructor.prototype)
I would like to report a prototype pollution vulnerability in defaults-deep. It allows an attacker to inject properties on Object.prototype. Module module name: defaults-deep version: 0.2.4 npm page: https://www.npmjs.com/package/defaults-deep Module Description Like extend but recursively copies...
Node.js third-party modules: Prototype pollution attack (lodash / constructor.prototype)
I would like to report a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype. Module module name: lodash version: 4.17.10 npm page: https://www.npmjs.com/package/lodash Module Description The Lodash library exported as Node.js modules. Modul...
Versa Networks: Session Fixation Exposure
In VOS user session identifier authentication token is issued to the browser prior to authentication but is not changed after the user successfully logs into the application. Failing to issue a new session ID following a successful login introduces the possibility for an attacker to set up a trap...
Nextcloud: Ubuntu 12.04 Privilege Escalation
Hello Security Team, Description According to its self-reported version number, the Unix operating system running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain...
Rockstar Games: Open redirect vulnerability
In this report the researcher discovered an open redirect vulnerability on one of our subdomains. The subdomain exists primarily to direct users to a different site, but it was possible to exploit by adding unexpected input in a subdirectory of the URL. This allowed an attacker to potentially...
Augur: Full UI hijack via dormant browser service workers
Augur UI hijack via dormant service workers Augur background The architecture of Augur currently consist of 3 individual layers: At the lowest level, Augur consists of a batch of smart contracts built on top of Ethereum. This level is enforced by a global blockchain and can be accessed via gatewa...
New Relic: Restricted user can bypass permissions restriction to create NR Alert policies
So this one is similar to my other privilege escalation issues, but it comes with a sidenote which may lead to some more interesting issues if you feel like digging into it. Issue: User with read only privileges can create NR Alert policies through POST request to Infrastructure-Data service...
Pornhub: idor allows you to delete photos and album from a gallery
The researcher discovered a vulnerability where a user may delete other users' images from their galleries...
Roblox: Reflected XSS through multiple inputs in the issue collector on Jira
Note I put this as Medium because that's what the CVE is. This vulnerability is known and it's classified under CVE-2018-5230. Here's a link to the thread on it by Atlassian: https://jira.atlassian.com/browse/JRASERVER-67289 Description --------------------- I noticed when testing that your Jira...
HackerOne: Team object exposes amount of participants in a private program to non-invited users
Summary: Hello. Similar to other reports, suddenly after the update with ordering users, the GraphQL API is exposing the amount of participants in a private program to non-invited users. This allows an attacker to retrieve the amount of participants in a private program, as well as their details...
Pornhub: Reflect XSS on Mobile Search page
The user was able to exploit the 'search' parameter being reflected in the page body in order to execute reflected XSS within the context of Redtube. Many of developer confuse that adding slashes at double quotes can protect the xss. However, At the DOM, Adding slashes is not protecting XSS...
Pornhub: Stored XSS in galleries - https://www.redtube.com/gallery/[id] path
Researcher successfully closed the image 'alt' attribute and injected javascript by intercepting the album creation request and submitting an XSS payload as the album title. This led to stored cross-site scripting on the user's album page, executed against any users who visited the album. Stored...
Pornhub: Stored XSS on the https://www.redtube.com/users/[profile]/collections
Researcher successfully closed the image 'alt' attribute and injected javascript by submitting an XSS payload as the collection title. This led to stored cross-site scripting on the user's collections page, executed against any users who visited the user's collections. The user's favorites page w...
Starbucks: svcardproxydevus.starbucks.com Subdomain take over
You have left a dns record pointing to a dead cloudapp vm. svcardproxydevus.starbucks.com - s00307ntmp0svcardproxydev0.trafficmanager.net - s00307dpipsvcardproxy00.eastus.cloudapp.azure.com = Dead Impact 1 Attacker takes over subdomain and then puts something like porn or something that shouldn't...
U.S. Dept Of Defense: Stored Xss Vulnerability on ████████
Summary: A Xss vulnerability using svg file & html file. Step-by-step Reproduction Instructions 1. Go to https://██████████/SitePages/Register.aspx and register. 2. Go to https://██████████/Profiles/My/Your Username/Blog/default.aspx and click Create a Post button. 3. Click Body textarea and clic...
Nextcloud: Missing memory corruption protection on Windows release built
Hi, we have noticed that the Windows Desktop Client doesn't enable the protections ASLR and DEP and others. These protections are per-default enabled since approximately 10 years in Visual Studio and are very important because they make exploitation a lot harder or even make some vulnerabilities...
Mail.ru: Path Traversal When Sharing with Cloud Mail.Ru App via a file with Crated Name
Path traversal vulnerability via crafted file name allowed user-assisted access to arbitrary application files in Mail.Ru Cloud android application...
Valve: Stored XSS in the guide's GameplayVersion (www.dota2.com)
Hi, team! The beginning of this issue looks like my previous report 369043, but this one will be much more interesting : So let's go! Steps to reproduce: 1 Open dota2 client and create new simple guide with XSS in the name. F318796 2 Publish this guide on steam. F318797 3 Now go to the Fiddler ap...
Pornhub: Mobile Reflect XSS / CSRF at Advertisement Section on Search page
The researcher identified a search query parameter vulnerable to cross-site scripting in the Mobile view. It is same vulnerability of redtube's mobile search page. The report is 380246 . This vulnerability is performed XSS because protecting with adding slashes at double quoters. At the tag's...
Flock: Subdomain takeover dew to missconfigured project settings for Custom domain .
While testing flock.com I got a domain flock.co what is under flock company . So I stared looking at it's subdomains and got subdomain newdev.flock.co . When I visited the subdomain in browser I got a error like below screenshot :- F365851 This took my attention . So I checked the DNS record for...
Monero: Attcker can trick monero wallet into reporting it recived twice as much with alternative tx_keypubs
Summary: multiple identical txpubkeys were patched, but you can still use alternative txpubkeys to get the same result. Description: An attacker can craft an XMR transaction which causes the receiving wallet to report that it received twice as much XMR as the attacker actually sent. The balance o...
Vimeo: Reflected File Download (RFD) in download video
The researcher was able to craft a Reflected File Download during the re-download of a video previously uploaded...
Brave Software: Torrent extension: Cross-origin downloading + "URL spoofing" + CSP-blocked XSS
Summary: \378809 allows navigating to chrome-extension:// \378805 allows displaying alert windows on chrome-extension:// origin As I said in 378809, navigation to chrome-extension:// allows attacking dependencies/components of extensions. Brave has only 3 extensions installed by default w\o...
Brave Software: `alert()` dialogs on `chrome-extension://` origin (internal pages)
Summary: Navigation to chrome-extension from the web is possible with 378805 ftp:// - chrome-extension://. A blank page is created during navigation to chrome-extension:// origin. Blank pages have "This page" title. It's possible to initiate alert with a social-engineering content and "This page"...
Brave Software: Navigation to `chrome-extension://` origin (internal pages) from the web
Summary http and https pages are disallowed from navigating to chrome-extension:// origin. However, ftp protocol isn't checked. Pages from ftp:/// and file:/// origin could navigate to chrome-extension:// origin. Steps to reproduce: 1. Start ftp server sample ftp server attached, npm i ftpd && no...
ok.ru: Cisco ASA Denial of Service & Path Traversal (CVE-2018-0296)
Unpatched CVE-2018-0296 in test Cisco ASA instance enter-test.odkl.ru...
Mail.ru: [e.mail.ru] XSS в поиске
Reflected XSS in e.mail.ru via GET paramters Multiple reflected XSS in the mailbox via the search param Timeline: Friday, July 6 2018, 23:26 – reported Saturday, July 7 2018, 01:13 – triaged Saturday, July 7 2018, 11:12 – temporary fix Monday, July 23 2018, 14:25 – resolved...
Uber: Information Leak - GitHub - Endpoint Configuration Details
@peuch found a publicly available Github repository providing insight about security controls in place on Uber workstations. We enjoyed working with @peuch on this issue and look forward to their future submissions to our program...
HackerOne: Ajouter le même utilisateur que celui déjà inscrit dans les équipes
Description: Possibilité d'ajouter le même utilisateur que celui déjà inscrit dans les équipes. Steps To Reproduce 1. Aller sur https://hackerone.com/teamname/teammembers 2. Observer les emails des utilisateurs. 3. Utiliser le même email que celui précédemment inscrit, mais varier les majuscules ...
GitLab: Vulnerability in project import leads to arbitrary command execution
Summary: A filename regular expression could be bypassed and enable the attacker to create a symbolic link in Gitlab upload directory by importing a specially crafted Gitlab export. Further more, Gitlab is designed to not delete project upload directory currently. So, the attacker could delete th...
HackerOne: HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information
Hi There, Steps To Reproduce 1- open this site: https://www.virustotal.com//domain/hackerone.com ------------------------- 2- Then Go down to the end of this page and you will see this: ████ https://hackerone.com/reports/334677?invitationtoken=███████ -------------- 3- when i open it, i see this:...
Monero: A bug in the Monero wallet balance can enable theft from exchanges
Summary: A Monero bug already fixed in master allows theft from exchanges. This has been exploited again a Monero-derived coin, so the exploit may be underway currently. Description: fluffypony: Also please mention you spoke to me and I recommended you put it on HackerOne PR 3985 fixed a wallet...
VK.com: Получение БД кэша из Android-приложения через стороннее приложение
Просмотр кэша приложения на Android...
Hiro: Can view all username leaked in https://core.blockstack.org
Hello team, This should be private hide all username who registered in blockstack.org the attacker can get the information of a user https://core.blockstack.org/v1/subdomains?page=10 i thought it is a demo users but i found my username in the list this should be private "demoaccount1.stealthy.id"...
VK.com: CVE-2018-0296
Path traversal...
Augur: A miner can manipulate the gas reporting bond
Not entirely confident I've understood this system correctly, apologies if it's wrong and feel free to stop reading if you run into an obvious mistake... Summary: add summary of the vulnerability By creating a market with themselves as designated reporter and setting a very high gas price for the...
U.S. Dept Of Defense: █████ - DOM-based XSS
Greetings, I've discovered a DOM-based XSS at ███ Proof of concept: 1. Go to https://████/█████████/home/troubleshoot.html?lang=en 2. In the username field, add the following code: --button/autofocus/onfocus=Function"confirm1";//name="XSS 3. The javascript code is correctly executed: ██████ Impac...
Brave Software: `settingcontent-ms` files lacks "mark of the web" => execute code by dbl click in Downloads toolbar
Summary: settingcontent-ms files allow launching any binary with any params. Brave doesn't mark settingcontent-ms files with "mark of the web", so the file could be executed by double click in "Downloads" toolbar. Launched settingcontent-ms file could lead to code execution with user-level...
ok.ru: Privacy violation для аттачей в сообщениях.
The vulnerability allowed unauthorized access to other users' file attachments with no ability to identify senders or recipients. Уязвимость позволяла получить несанкционированный доступ к приаттаченным файлам без возможности определить отправителя и получателя. Vulnerability allowed downloading...
ownCloud: Possible to steal any protected files on Android
Hi. I have found an issue which allows to retrieve any files from /data/data/com.owncloud.android/ directory. The problem is in exported activity com.owncloud.android.ui.activity.ReceiveExternalFilesActivity which accepts a URI to download files. I see that you've added verification path...
Mail.ru: molotok.m.mail.ru delegated to external entity
SDC bypass secure cookies access vulnerability in m.mail.ru due to subdomain name pointing to uncontrolled external host...
Mail.ru: Launch Any Activity in MyMail App
An exported activity in My.Com Mail application could be used to launch protected activities...
Stellar.org: Admin panel of https://www.stellar.org/wp-admin/
https://www.stellar.org/wp-admin/ link has various operations which should not be accessible to an anonymous user. As admin panel is accessible an attacker can use this information in targeted attack and he can bruteforce the username and password. on the other side server information is easily...
Cloudflare: Private API key leakage due to lack of access control
The lack of access control on the https://mobilesdk.cloudflare.com/api/v1/ api allows for a remote attacker to access and steal a logged in user's private data. This can be done due to the lack of origin protection. An attacker can embed the config URI...
U.S. Dept Of Defense: █████ - DOM-based XSS
Greetings, I've discovered a DOM-based XSS at ██████ Proof of concept: 1. Go to https://███/█████/home/troubleshoot.html?lang=en&returnUrl=https://█████/███████/home/signin.html?returnUrl=https%3A//████/██████████/home/user.html 2. In the username field, add the following code:...