15603 matches found
VK.com: XSS-уязвимость, связанная с загрузкой файлов
XSS в документах...
Semrush: Post Based XSS On Upload Via CK Editor [semrush.com]
Summary: XSS Via Post Method When Upload via CKEditor Description: This XSS is execute by error message when upload some image on https://www.semrush.com/my-posts/api/image/upload/?CKEditor=text&CKEditorFuncNum=0&langCode=en Browsers Verified In: Firefox Steps To Reproduce: - This is POST based...
Brave Software: Local files reading using `link[rel="import"]`
Summary: HTML file could import another file using . Brave returns Access-Control-Allow-Origin: response header for local HTML files. That leads to local files reading. This vulnerability makes 369218 critical. Products affected: Brave: 0.23.19 V8: 6.7.288.46 rev:...
Brave Software: Cross-origin page stays focused before/after downloading + uninformative modal window for download
Summary: 1. Open twitter.com using window.open 2. Wait some time to finish page rendering 3. Change location of the opened page to any downloading 4. Download modal appears above the twitter.com The problem is that a user doesn't see what page exactly initiates downloading and what resourceURL wi...
Slack: The POODLE attack (SSLv3 supported) at status.slack.com
@cryptographer found that for some regions, status.slack.com supported an outdated cipher suite, which we've since updated. Thanks @cryptographer! nmap -sV --version-light --script ssl-poodle -p 443 IP...
U.S. Dept Of Defense: Partial PII leakage due to public set gitlab
Summary: ████████ allows you to explore the repos, snippets,etc. On the snippets we find a name+icon and some code information. This shouldn't publicly exposed as an attacker may use it to perform further attacks Description: A configuration issue allows code and the name+icon of a user on the...
Slack: Private application files can be uploaded to Slack via malicious uploader
Hi. I have found an issue which allows to retrieve any files from /data/data/com.Slack/ directory. The problem is in exported activity com.Slack.ui.UploadActivity which accepts a URI to download files. I see that you've added verification java private static boolean isPrivateFileUri uri return...
Brave Software: Navigation to protocol handler URL from the opened page displayed as a request from this page.
Summary: Navigation to protocol handler URL from the page opened using window.open is considered as a request from the opened page. Example: 1. The page opens google.com 2. The page changes opened window's location to ssh://evil.com 3. Request to open ssh://evil.com URL displayed at google.com...
LinkedIn: Persistent XSS (unvalidated Open Graph embed) at LinkedIn.com
This report was previously published on Medium.com/@JonathanBouman. Follow me on Twitter or Medium for new reports. F361972 Proof of concept Background In my previous report we learned more about a special type of the persistent XSS attack; the unvalidated oEmbed attack. This attack allows us to...
HackerOne: Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com
Summary: Hackerone.com using following script file https://js.driftt.com/include/1530431100000/hp9revvwkk62.js you can see the below script on page this.handleMessage=functioneife&&e.datavar t=document.getElementByIdSi;ift&&e.source===t.contentWindow||e.source===window.opener handleMessage method...
GSA Bounty: Root user disclosure in data.gov domain though x-amz-meta-s3cmd-attrs header
I performed a GET request on Host www.data.gov in burp suite to a custom domain and the Response showed the x-amz-meta-s3cmd-attrs header with the user id as root and group id running as root. x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33184/ This represents information...
Casper: Mixed content issues on the site https://casper.com
Hello. While browsing the site https://casper.com found a mixed content error on the site with HTTPS. This error is located at https://casper.com/faqs/resources/the-best-positions-for-sleeping/. 8 images are uploaded to the site via HTTP. What warns the browser Google Chrome. F314123 Impact If th...
Hanno's projects: SSRF in rompager-check
Summary The script rompager.php does not restrict which hosts can be requested. Thereby, an attacker can send HTTP requests to localhost and other servers of the same local network segment, on port 80 and 7547. Description In rompager.php, the value of CURLOPTURL is fully controlled: php Port...
VK.com: Clickjacking vkpay
Clickjacking...
Hanno's projects: SQL injection in Serendipity (serendipity_fetchComments)
Summary An authenticated administrator can alter Entries to display on frontpage and Entries to display in Feeds in a way to perform a SQL injection and extract database records or access files on the underlying system. Description The function serendipityfetchComments implemented in...
HackerOne: Blind SSRF on errors.hackerone.net due to Sentry misconfiguration
Summary: When setting up Sentry you should turn off "source code scrapping". If it is turned on, then server that has Sentry on it will make blind get requests everywhere controlled from outside via error reporting. Description: Hello Hackerone team. In your CSP I found ?sentrykey parameter, so i...
Brave Software: Lack of quarantine meta-attribute for downloaded files leads to GateKeeper bypass
Summary: Executable files downloaded through Brave don't have quarantine attribute. That means it's possible to launch any executable bypassing codesigning + quarantine. However, later I found that Brave has already tracked similar report but only in the context of .pkg files. Additionally, Brave...
Hanno's projects: Reflected xss in Serendipity's /index.php
Summary: There exists a reflected xss threat in https://blog.fuzzing-project.org/index.php?frontpage. Description: By setting the serendipity%5bmultiCat%5d%5b%5d POST input to 1'"&%prompt1 I'm able to trigger a JavaScript prompt box in versions of IE up to and including IE 11. Steps To Reproduce:...
U.S. Dept Of Defense: Corda Server XSS ████████
Summary: Cord server will display the error message if something isn't allowed to be used thus allowing xss Description: /scripts/ctredirector.dll allows users to call images or files. We can use the parameter @FILE to dictate a file or url, if it fails it'll display the url into the page. We the...
Nextcloud: Accessing to download.nextcloud.com from original ip adreess | insecure Download
Hi team , Summary I found that when I can access from original ip to the web site ,.This disable Https secure connection. Description First I make DNS Lookup to find the ip adress download.nextcloud.com has address 88.198.160.133 F313820 Now When I open The website from download.nextcloud.com I s...
Hanno's projects: blind sql injection
Summary: There exists a possibility that your Serendipity installation is vulnerable to a blind sql injection. Description: By sending specially crafted SQL commands to /plugin/tag/ and timing how long it takes for the server to respond, it is quite possible that the blog backend is interepreting...
U.S. Dept Of Defense: PII leakage due to caching of Order/Contract ID's on █████████
Summary: I was able to discover contract numbers which leak out user names/emails/phone numbers nd other sensitive information. I took the time to assure that these contract id's wouldn't/shouldn't be easy guessable or known. Description: I discovered through google search query that I was able t...
Hanno's projects: Reflected Cross-Site Scripting in Serendipity (serendipity.SetCookie)
Summary The Smarty template responsible of creating JavaScript snippets assigning cookies to users is during sorting of entries in the administration interface is affected by a reflected cross-site scripting. Description In templates/2k11/admin/entries.inc.tpl, the following code is dynamically...
Hanno's projects: Open redirect in Serendipity (exit.php)
Summary Serendipity contains a script named exit.php that can be directly accessed. When crafting an hyperlink pointing to this page with the parameter url containing a base64-encoded URL, it will redirect the user to this URL. Description The file exit.php contains the following code: php ?php /...
Hanno's projects: Open redirect on https://blog.fuzzing-project.org
Summary: There is an Open Redirect on https://blog.fuzzing-project.org/exit.php?url= due to the application not checking the value passed by the user to the "url" parameter. Description: Unchecked redirects occur when an application redirects to a destination controlled by attackers. This often...
Mail.ru: Чтение системных данных приложения: данные для авторизации, логи, БД, личная переписка
Insufficient case sensitive filtering in intent URI could allow local malicious application to access local files via ICQ for Android...
Radancy: I can subscribe and unsubscribe any user with the same token for as many times as i want
During the subscription process for a newsletter it was possible to enter any email-address which would automatically be added to the emaillist without proper confirmation via a confirmation token send by email. Same for the unsubscription process, anyone could unsubscribe all emailaddress becaus...
Brave Software: URL spoofing using protocol handlers
Summary: Navigation to protocol handler changes URL in the address bar e.g. ssh://google.com in the address bar is standard behavior. Browsers change URL in the address bar to about:blank if a parent window tries to access the opened page with protocol handler URL. This behavior prevents URL...
Infogram: CORS on (ws.infogram.com)
Hey Team i don't know if it's valid or not i just want to let you know about this thanks. Exploit var req = new XMLHttpRequest; req.onload = reqListener; req.open'get','https://ws.infogram.com/socket.io/?EIO=3&transport=polling&t=MH7BU79',true; req.withCredentials = true; req.send''; function...
OLX: Bypass CSP frame-ancestors at olx.co.za, olx.com.gh
Hi, olx.co.za and olx.com.gh both of them restrict framing by using this CSP rule: content-security-policy: frame-ancestors 'self' https://.mod-tools.com: olx.co.za: F313178 olx.com.gh: F313179 If we take a look at mod-tools.com we can see that the domain is not claimed: $ dig mod-tools.com ; DiG...
Ian Dunn: xmlrpc.php FILE IS enable on Main website
The domain contains XMLRPC activated which can cause serious damage to your server and website.Admin panel can be easily bypassed and also can cause heavy DDOS that can take down the entire server.Just a simple fix can resolve the issue.Secure your site :...
Brave Software: Directory Listing on https://promo-services-staging.brave.com
Summary: Hi Brave team, Hope you are good I have found a directory listing vulnerability at https://promo-services-staging.brave.com Products affected: Brave website page. Steps To Reproduce: Go to https://promo-services-staging.brave.com/swaggerui/ Supporting Material/References: Reference: This...
Internet Bug Bounty: CVE-2018-12882: heap-use-after-free in PHP 7.2 through 7.2.6, possible 7.2.7
exifreaddata in PHP 7.2 through 7.2.6 and possibly 7.2.7 is vulnerable to a heap use after free when fed a specially crafted JPEG. Any online service that uses PHP 7.2 and reads EXIF data from uploaded JPEGs is potentially vulnerable to this flaw. USEZENDALLOC=0 ./php-e147eb2 -r...
Udemy: [affiliates.udemy.com] Wordpress user admin information discloure
Summary This website using Wordpress CMS, so developer forget to disable the link that can view information of admin user. By access to this link, attacker can get all username and other information of user admin: http://affiliates.udemy.com/wp-json/wp/v2/users F312155 Admin user list: hamza...
VK.com: Доступ к администраторским faq
Просмотр некоторых закрытых статей FAQ. Уязвимость позволяла получить доступ к талмудам vk.com/tlmdXXX в которых хранится информация для администраторов и модераторов социальной сети ВКонтакте... Получение доступа к адм. информации... @ 500$...
Mail.ru: Вывод значений переменных Nginx в теле страницы
При обращении к url вида: https://biz.mail.ru/$имяпеременнойnginx Значение этой переменной попадет в страницу ответа 404, во все места вида: e.mail.ru/login?lang=ruRU&Page=https%3A%2F%2Fbiz.mail.ru%2Fзначениепеременнойnginx Примеры запросов: 1 https://biz.mail.ru/test$realpathroot в ответе:...
Nextcloud: Missing X-Content-Type-Options
Nextcloud doesn't have a header settings for X-Content-Type Options which means it is vulnerable to MIME sniffing. The only defined value, "nosniff", prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome...
RATELIMITED: HTTP PUT method enabled
Hi security team, Summary: It is possible to upload files to the server using the PUT method Steps To Reproduce: 1. I used the following request: PUT /emitrani.txt HTTP/1.1 Host: ratelimited.me Content-Length: 10 Connection: close emitrani POC Now a file exists at...
Node.js third-party modules: stored xss in scrape-metadata when reading metadata from an html page
Hy Module scrape-metadata https://www.npmjs.com/package/scrape-metadata Module Description a module used to scrape meta data contents from an article Vulnerability Description It was possible to embed malicious js code in metadata content read by scrape-metadata. When library reads such metadata,...
Mail.ru: Shell upload in partner service
Shell code upload RCE vulnerability in partner service provided as an additional functionality withing mail.ru branded service. On the moment of reporting, partner services are not covered by bug bounty program, the bounty was awarded due to potential problem criticality...
GitLab: SSRF in CI after first run
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: During the first run, the CI...
Brave Software: OPEN REDIRECTION at every 302 HTTP CODE
Summary i guess every 302 HTTP CODE on https://publishers.basicattentiontoken.org possible to OpenRedirection Steps To Reproduce: 1. I edited the request when i got redirected from this request url...
Brave Software: Navigation to restricted origins via "Open in new tab"
Summary: It's possible to open links pointing to file:/// origin from web pages using "Open link in a new tab" in context menu. https://hackerone.com/bugs?reportid=369185 shows unsafe ssh:// protocol handling, which leads to information leak using sshOS username and etc.. The vulnerability is...
Mail.ru: XSS в теле письма, в новой версии почты.
DOM clobbering in new "Octavius" interface beta feature led to stored XSS on message reading...
Brave Software: Unsafe handling of protocol handlers
Summary: Brave browser macOS handles protocol handlers in unsafe way and differently from other browsers. Key differences between protocol handlers handling in Brave and other browsers: Open external app vs Open "Terminal" Brave only asks about opening external app. Other browsers e.g. Chrome ask...
Brave Software: URL spoofing in Brave for macOS
Summary: URL spoofing vulnerability. Repro window.onclick = function x = window.open'https://www.google.com/csi'; setTimeoutfunction x.document.writeI am not a www.google.com;click me , 100; URL in address bar is https://www.google.com/csi, but actually that's about:blank page. Attacker could...
██████: Remote Command execution due to image tragick
During my auditing of a profile avatar functionality I discovered that the website was affected by image tragick by using a curl request as seen below F349064 I then made a request to read etc/passwd F349067 I then wanted to prove maximum impact by further pivoting the rce. Due to not wanting to...
VK.com: Просмотр записей пользователя, который тебя заблокировал
Отсутствовали проверки черного списка в одном из действий при работе с записями пользователя...
Rocket.Chat: Open redirect open.rocket.chat/file-upload/ID/filename.svg
Summary: Open redirect through svg file upload Description: When you upload a file to a chat, the link to it will look like https://open.rocket.chat/file-upload/ID/filename.svg, but the file will be on storage.googleapis.com. We can embed js in our svg and when the victim goes to...