Rocket.Chat: Open redirect open.rocket.chat/file-upload/ID/filename.svg

Summary: Open redirect through svg file upload Description: When you upload a file to a chat, the link to it will look like https://open.rocket.chat/file-upload/ID/filename.svg, but the file will be on storage.googleapis.com. We can embed js in our svg and when the victim goes to...

Mail.ru: XSS via message subject - mobile application

XSS in message compose window on forwarding message with crafted subject / sender name / content in mobile application for android...

Udemy: [engineering.udemy.com] - Subdomain Takeover (ghost.io)

Hi Security Team, Found that DNS record of engineering.udemy.com domain was pointing to inactive ghost.io instance. So when we visit https://engineering.udemy.com we will be notified that site doesn't exist. F310092 $ host engineering.udemy.com engineering.udemy.com is an alias for...

Vanilla: FileUpload Plugin: CSRF (delete all attached files)

Description ------------ The current version 1.9.1 of the official FileUpload plugin is vulnerable to CSRF. A successful attack allows the removal of files the attacked user has the permission to delete. Administrators for example have the permission to delete all attached files. As the request t...

Starbucks: athome.starbucks.com - URL parameter tampering of review forms permitted possible content injection

jackb898 discovered that the review forms on the informational site athome.starbucks.com was susceptible to parameter tampering possibly allowing for creation of limited custom review form content. @jackb898 — thank you for reporting the original vulnerability, the additional information and for...

Reverb.com: Basic auth details is still work on report ( 351555 )

Hi , Seem report 351555 is not full fixed where 434762629765715:PQlkrSHPqqjhIBc0MmUkdjcqpps basic auth details are Still work on login Poc : https://api.cloudinary.com/v11/reverb/usage F309894 Impact information Disclose...

Starbucks: PHPinfo page

GET /test.php HTTP/1.1 Host: 52.90.193.152 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.21 KHTML, like Gecko Chrome/41.0.2228.0 Safari/537.21 Accept: / Impact This file may expose sensitive information that may help an maliciou...

Uber: [data-07.uberinternal.com] SSRF in Portainer app lead to access to Internal Docker API without Auth

Vulnerability description not provided...

Mail.ru: слепая XSS в админ панели torg.mail.ru через отзыв

Blind XSS in admin panel for torg.mail.ru. torg.mail.ru is not in bug bounty program's scope, a bounty was awarded due to high potential impact. Недостаточная фильтрация приводит к XSS в административной панели в одном из поддоменов mail.ru через имя пользователя при оставлении отзыва...

VK.com: Уязвимость в методе auth.restore

Недостаточные проверки при восстановлении страницы...

PortSwigger Web Security: Activat burp suite pro with the old license after transfared to anothe account

Hi team. I made 2 accounts and purchased burpsuite pro. The first account with this email :- ███████ The second account with this email :- ██████ I have opened a support ticket on Jun 13, 2018 05:26PM and the message is :- Hi Could you please add this account to my existing account ████ ███████ t...

Node.js: Your page has 2 blocking CSS resources. This causes a delay in rendering your page.

This report was not deemed to be a security vulnerability and the reporter was asked to open an issue upstream to fix publicly...

Shopify: Subdomain Takeover - https://competition.shopify.com/

Dear Shopify Security Team, The Shopify.com subdomain competition.shopify.com was vulnerable to a subdomain takeover as it was pointing to an unclaimed Heroku service through the CNAME competition.shopify.com.herokudns.com, while the custom domain 'competition.shopify.com' was unclaimed in Heroku...

Uber: Privacy policy contains hardcoded link using unencrypted HTTP

The link to Uber’s privacy policy was using the unencrypted http:// scheme, making it possible for an attacker with the ability to Man-in-The-Middle MiTM traffic. This would allow them to replace normal responses with malicious content such as a phishing page. The content would then render within...

Valve: Comment restriction in subsection "Workshop" of domain "steamcommunity.com" can be bypassed using IDOR

Summary - While testing Domain "steamcommunity.com", i found subsection "workshop" which has restriction to comment on workshop items of the game which i do now own in my account. This access control can be bypassed using IDOR and user can post comment though comment section is disabled on worksh...

Mail.ru: Stealing Arbitrary Private Files of MyMail App

It was possible for local malware application to steal sensitive local files of MyMail / Mail.Ru Mail application due to specifics of file:// schema URI handling in SharingActivity...

Basecamp: Remote code execution on Basecamp.com

A critical flaw in Basecamp's profile image upload function leads to remote command execution. Images are converted on the server side, but not only image files but also PostScript/EPS files are accepted if renamed to .gif. This is probably due to ImageMagick / GraphicsMagick being used for image...

Uber: Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root password

@peuch found data exposure on Github - expired passwords and usernames for ESXi a bare metal hypervisor. The researcher also found credentials to a SendGrid instance uberinfradevtools, which would have allowed them to log in to SendGrid and send email from any @uber.com address. However, this wou...

QIWI: XSS https://agent.postamat.tech/ в профиле + дисклоз секретной информации

Здравствуйте. Я раскрутил ваш сайт https://agent.postamat.tech/ на интересную XSS + достаточно серьезный баг, который дисклозит некоторую пользовательскую информацию. Хочу заметить что на данном сайте хранятся некоторые личные данные пользователей, следовательно из этой XSS можно извлечь достаточ...

Mail.ru: SQL injection on jd.mail.ru

SQL injection via POST parameter in user registration at jd.mail.ru. die ███████████████████████████ ███████▀▀▀░░░░░░░▀▀▀███████ ████▀░░░░░░░░░░░░░░░░░▀████ ███│░░░░░░░░░░░░░░░░░░░│███ ██▌│░░░░░░░░░░░░░░░░░░░│▐██ ██░└┐░░░░░░░░░░░░░░░░░┌┘░██ ██░░└┐░░░░░░░░░░░░░░░┌┘░░██ ██░░┌┘▄▄▄▄▄░░░░░▄▄▄▄▄└┐░░██...

Internet Bug Bounty: Client DoS due to large DH parameter (CVE-2018-0732)

https://www.openssl.org/news/secadv/20180612.txt OpenSSL Security Advisory 12 June 2018 ======================================== Client DoS due to large DH parameter CVE-2018-0732 ==================================================== Severity: Low During key agreement in a TLS handshake using a DH...

Smule: Disclosure of information about the system, configuration files.

Disclosure of django configuration via debug mode...

Monero: Misreporting of received amount by show_transfers

Summary: A sender may cause showtransfers to report a higher amount that was actually sent on the recipient's showtransfers output. Description: Due to a flaw in processnewtransaction in wallet2.cpp, if the tx pubkey is present multiple times, it will decode outputs correctly as many times, and a...

Upserve : OLO Total price manipulation using negative quantities

Manipulating an order request JSON object, containing an additional item with a negative quantity directly manipulates the total amount of the order. In the following JSON request, an order is submitted for 2 ChickenBurgers $12 each, as well as -1 BreadPuddings $9 each. The total price after tax...

VK.com: Просмотр приложений любого пользователя / группы

Просмотр чужих списков приложений...

New Relic: Insecure Infrastructure Integrations YML Loading leads to Windows Privilege Escalation

After installing the Windows Infrastructure client as discussed in https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/installation/install-infrastructure-windows-server I noticed that integration yml config files are not only loaded from the folder within Program Files, but al...

Ruby: SEGV in parse_rat()

A crafted string can cause SEGVREAD memory access to 0x000000000000 when parsed as rational number - ruby 2.5.1p57 on Fedora 28 $ ruby -e 'Rational"2e-9942067"' -e:1: warning: in ab, b may be too big -e:1: BUG Segmentation fault at 0x0000000000000000 ruby 2.5.1p57 2018-03-29 revision 63029...

Liberapay: No Data Validation, No Captcha, No Filters...

POST /for/new HTTP/1.1 Host: liberapay.com User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:52.0 Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer:...

Liberapay: Improper Data Validation / Unvalidated Input

Steps to reproduce: 1 - Be logged in a account 2 - Go to: https://liberapay.com/user/edit/statement 3 - Click on Visualize 4 - Submit and edit POST parameters to fuzz infinitely 5 - Wait the server proccess the request. I send only 2.813.054 characters. Improper input size validation... I'm sorry...

Liberapay: Cross site scripting (content-sniffing)

This type of XSS can only be triggered on and affects content sniffing browsers. This script is possibly vulnerable to Cross Site Scripting XSS attacks. This vulnerability affects /sign-up URL encoded POST input sign-in.currency was set to USDG8OAI!+! The input is reflected inside a text element...

Pornhub: Blind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues)

Researcher found a blind SQL injection in the profile comment Like functionality, executing on the second request made for a given comment dislikes. Summary The injection was found manually, used discovery methods are basically the same as described in this awesome article by @gerbenjavado:...

VK.com: Долгоживущий хеш + получение частичного доступа к аккаунту после сброса сессии

Hash lifetime...

RBKmoney: SUBDOMAIN TAKEOVER [http://dev.rbk.money/]

The DNS record of dev.rbk.money pointed to the Github, but the domain was not used in any Github account. So it was possible to bind it to any repository...

Monero: monerod can be disabled by a well-timed TCP reset packet

Summary: A well-timed TCP reset RST can cause monerod or any service relying on epee to stop accepting new connections. Description: When a new connection is attempted, the handleaccept function is called. This does some error checking and finishes setting up the connection. Once the connection i...

Monero: Constant-time comparison is not always implemented; critical areas are vulnerable to key-timing attacks

In my most superficial of reviews, constant-time comparison appears to not be globally implemented at a glance, only implemented within the ref10 implementation. With that said, the following areas either appear to be vulnerable, or are potentially vulnerable, to key-timing attacks: 1. Containers...

Liberapay: Buffer overflow

A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold or when a program attempts to put data in a memory area past a buffer. In this case, a buffer is a sequential section of memory allocated to contain anything from a character string to an arra...

IOVLabs: DoS through PeerExplorer

Summary: The peer discovery implementation is vulnerable to a Denial of Service attack due to improper management of connections. Description: The two main files of interest in detailing this vulnerability are PeerExplorer.java and NodeChallengeManager.java. To explain the flow of execution I'll ...

OLX: Search Page Reflected XSS on sharjah.dubizzle.com through unencoded output of GET parameter in JavaScript

Hi, I found a reflected XSS vulnerability on the search page of sharjah.dubizzle.com. Because the GET parameter keywords is not being encoded before parsing it into the JavaScript, an attacker can break out of the code an execute JavaScript in the targets browser. Vulnerable Code When searching f...

Mail.ru: Загрузка png бомбы, которая начинает DDOS атаку на бота со Стикерами.

ICQ sticker bot was vulneraeble to DoS via PNG compression bomb attack...

Dropbox: Bypass Local Authentication (TouchID)

​​This report describes an attack to bypass TouchID in the Dropbox Mobile iOS application on jailbroken iOS devices. Dropbox doesn’t consider jailbroken devices in scope for our bounty program...

Block.one: [FG-VD-18-101] Buffer Overflow Vulnerability in EOS's WAVM Library and also in latest WAVM Library Parent Repository

Hello Block.One / EOS Product Security Team, Good Afternoon. There exists a Memory Corruption vulnerability in the latest WAVM Library and also in the EOS code for WAVM Library. The PoC.wast file is attached along with this report. Reproduction Steps: - 1 Fetch latest WAVM library from the WAVM...

Block.one: [FG-VD-18-100] Heap Buffer Overflow Vulnerability in EOS's forked repository of Binaryen Library and also in latest Binaryen Library Parent Repository

Hello Block.One / EOS Product Security Team, Good Afternoon. There exists a Memory Corruption vulnerability in the latest Binaryen Library and also in the EOS repo for Binaryen Library. The Binaryens2wasmPoC.s file is attached along with this report. Reproduction Steps: - 1 Fetch latest Binaryen...

Liberapay: Punny code Detection Parsing should be implemented on Markdown

Hello Liberapay Security Team, Description When we insert any URL in Markdown Box in liberapay.com/profilename/edit/statement, it reflects on our main profile page. There was main issue which I discovered was about Punny code parsing method which was not enabled on Markdown. Step to Reproduce For...

Mail.ru: Stored XSS in api.icq.net

Crossite scripting in api.icq.net domain. icq.net is considered as a sandbox domain, it does not use HTTP authentication or cookies, but XSS could be used to facilitate phishing attack...

Y Combinator: Stored Cross Site Scripting

XSS was disclosed and was forwarded to our software team. A member of the software team fixed fairly quickly and we confirmed no data was exposed...

Liberapay: Returning back from the browser after logging off will disclose some information

Summary : --------- Hi, I found an issue that is after signing out from the account and click back button continuously from the browser it will disclose sensitive information in all pages that the user open it when he is using his account like for example identity page . I believe that this issue...

Node.js third-party modules: XSS in express-useragent through HTTP User-Agent

Hello, I would like to report an XSS in express-useragent module due a lack of validating User-Agent header. Please note I already created an Github issue and asked for CVE CVE-2018-9863. I did not know about Node.js third-party modules on hackerone. Description express-useragent is simple...

Liberapay: A single user can subscribe a community multiple times

There is no proper validation while subscribing for a community. A user can subscribe a single community multiple times. Steps to recreate: Step 1: Open any community Step 2: Click on subscribe button Step 3: Capture the POST request and submit it multiple times Step 4: Check the subscription cou...

Mail.ru: Reflected XSS in delivery-club.ru

Reflected XSS via GET argument. On the time of reporting, XSS in delivery-club.ru are not covered with bug bounty program...

Mail.ru: XSS https://health.mail.ru/my/ через внешнее имя аккаунта

Здравствуйте. Раньше репортил багу связанную с ником в одноклассниках так вот нашел еще одно место. На мобильной версии https://health.mail.ru/my/ в никнейме мы можем видеть self-stored xss. F305597 Так выглядит имя: F305599 Impact XSS...