15606 matches found
Grab: Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.com
Good day, I truly hope it treats you awesomely on your side of the screen : I have found that your website cdn.grab.com is pointed via a cname to a cloudfront instance cdn.grab.com = .cloudfront.net This was not registered on Amazon Aws Cloudfront. I was able to take over the domain: See my POC P...
Passit: `X-XSS-Protection` header has not been set at app.passit.io
Hi X-Xss-Protection at app.passit.io has not been set. Impact This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari Webkit. Valid settings for the header are 0, which disables the protection, 1 which enables the protection and 1;...
Trello: Session can be continuously reused by editting "token" cookie.
Description: ==================== When loged in user edit "token" cookie , that session will be cut off and user will be loged out. It's nomal. But If you make websocket connection with proper token before editing the "token" cookie and then edit "token" cookie , websocket will still in connectin...
Reverb.com: Api token exposed in Reverb.com's public github repository
An access token of a user account was available in a public github repo. The token was tied to an experimental project, and the account was only used for that project, so no sensitive information was able to be obtained...
Reverb.com: Disclosure of all uploads to Cloudinary via hardcoded api secret in Android app
Hi, in file com/reverb/app/CloudinaryFacade.java you have hardcoded the following config: java private static final java.lang.String CONFIG = "cloudinary://434762629765715:█████@reverb"; where 434762629765715:████████ is basic auth details. It shouldn't be disclosed to third parties as official...
GitLab: Persistent XSS - Deleting a project (No Longer Vulnerable in 10.7)
Summary: When deleting a project in gitlab, it is possible to trigger a XSS with a malicious user name string. Description: I'd like to first point out that this is no longer vulnerable, but I filed a report anyways since it was never discovered. It looks like this was fixed on "accident"...
Shopify: Improper access check by Kit leads to controlling attributes of store & getting analytics by deleted Store member via dual messenger A/C
Hi, Disclaimer : - This report will be detected as a duplicate of a N/A marked report by me351154.The reason for self-close was i did not know if the scope in your policy only restricted to XSS,CSRF on kitcrm.com the domain. Issue : - A deleted store member can still use Kit via Facebook messenge...
Reverb.com: XSS in main search, use class tag to imitate Reverb.com core functionality, create false login window
This is an expansion of 349684 which was flagged as a duplicate. In that bug report I explained that several HTML tags end up rendering when entered into the main search. I've since found out that the class attribute of multiple types of tags can be modified to create a realistic imitation of cor...
Mail.ru: Открытая информация phpinfo() на сайте https://agent.mail.ru
phpinfo was available on agent.mail.ru. agent.mail.ru is not currently covered with bug bounty program...
Phabricator: Administrator can create user without entering high security mode
When an administrator wants to create a user, he can go to https://phabricator.example.com/people/create/ and will be required to enter his MFA token in order to enter high security mode. However, if an administrator goes to https://phabricator.example.com/people/new/standard/ he will bypass the...
Gatecoin: DOM Based XSS charting_library
Description chartinglibrary contains a DOM Based XSS vulnerability that allows to load an external JS script and execute it. PoC Open URL in any browser...
Valve: Stored XXS @ https://steamcommunity.com/search/users/#text= via Profile Name
Dear Valve security staff, Short description --------------------- There is a stored cross-site-scripting vulnerability present at the user search endpoint which can be exploited by modifying profile name of the would be attacking account. See POC picture. Steps to reproduce ---------------------...
Valve: resetreportedcount & updatetags doesn't verify appid param
This requires an account that has admin permissions on any community hub & Fiddler not 100% required, but I'll use it for the demonstration. resetreportedcount: Step 1: Go to any UGC in the hub you have admin access on, open Fiddler if you haven't yet, click Clear Reports and click OK on the...
Valve: Malformed Skybox .TGA in Half-Life (GoldSRC) leads to Access Violation
A malformed .TGA when loaded as a Skybox on a map in a GoldSRC engine game Half-Life can lead to arbitrary code execution on a remote client. Reproduction Steps Load the attached map + resources on a local Half-Life listen server. The game will crash with an Access Violation as soon as the map wi...
Valve: Malformed .BSP Access Violation in CS:GO can lead to Remote Code Execution
A malformed .BSP can trigger an Access Violation on CS:GO that can lead to arbitrary code execution on a remote computer. I have attached a copy of the malformed .BSP which reliably triggers an Access Violation on CS:GO. Impact An attacker hosting a malicious server could compromise a remote clie...
HackerOne: User object in GraphQL exposes number of trial reports for External Programs that also have a Private Program
Summary: For this vulnerability to work, it is necessary that you should be Admin/member of atleast one sandbox team and running a GraphQL node can tell you if the external programs exist on directory page running a private program on hackerone or not...
VK.com: Получение чужого номера телефона (все цифры) через форму восстановления пароля
В некоторых случаях можно было получить привязанный к странице номер телефона. Данная уязвимость позволяет злоумышленнику получить личный номер телефона жертвы, который привязан к странице Вконтакте. Для использования данной уязвимости достаточно знать только электронный адрес жертвы...
Valve: GetReports works for hubs you don't have access to
Admin permissions on a game hub could be leveraged to view UGC reports on unrelated games. If an account had admin permissions on a game hub, he'd be able to view other game hubs UGC reports by simply making the appid parameter the appid of the game hub he has admin permissions on...
Greenhouse.io: Bypass of request line length limit to DoS via cache poisoning
Summary This is a bypass of the fix that was introduced in response to report 334709. The bug in question was that it was possible to poison the cache of the generated JS file at https://boards.greenhouse.io/embed/jobboard/js?for=surveymonkey, by appending a URL-encoded NULL byte %00, followed by...
Versa Networks: Insecure File Creation Mask
In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through insecure file permissions that can result in an arbitrary read, write, or execution of newly created files and directories. Insecure umask setting was present throughout the Versa...
HackerOne: Lack of cross-origin request blocking allows leaking of sensitive information on several endpoints
Summary: It is possible to make users leak sensitive information on several endpoints by measuring the time certain requests take to be cached. Description: If a request is made to https://hackerone.com/github/weaknesses and the user is logged in, the size of the response will be around 9kb becau...
HackerOne: Information disclosure
Summary: Chaining few simple informative issues on HackerOne platform and applying new method of timing attack, exploiting interesting feature in HTML5 https://developer.mozilla.org/en-US/docs/Web/API/ResourceTimingAPI/UsingtheResourceTimingAPI more precise Copy with CORSwe can perform low cost,...
Node.js third-party modules: Insecure implementation of deserialization in cryo
I would like to report code injection in serialization package cryo It allows execute arbitrary code using custom prototype. Module module name: cryo version: 0.0.6 npm page: https://www.npmjs.com/package/cryo Module Description JSON on steroids. Built for node.js and browsers. Cryo is inspired b...
Node.js third-party modules: Insecure implementation of deserialization in funcster
I would like to report code injection in serialization package funcster. It allows execute arbitrary code during deserialization of JSON. Module module name: funcster version: 0.0.3 npm page: https://www.npmjs.com/package/funcster Module Description This library contains utilities for serializing...
Ubiquiti Inc.: Two Factor Authentication Bypass
The researcher found a method to brute-force the 2FA code request in the www.ubnt.com login page. This method still requires the username/password from the account...
Bitso: Injecting html codes
Hi, I observed that I could inject some html codes in this page https://bitso.com/authenticate?redirect=/merchantinfo. To reproduced: Login to your account that has two factor authentication set up After you login you will be redirected to a page which you will enter the authentication code Open ...
Valve: Buffer overflows in demo parsing
This was originally reported by @yalter at https://github.com/ValveSoftware/halflife/issues/1654...
Valve: Aapp name leakage on economy history page
App name leakage on economy history page Partners with authorization to view economy logs for their own titles could be presented with a list of all game titles that have used economy features...
New Relic: IDOR via internal_api "users" endpoint
While trying to figure out what the heck is going on with 347664, I stumbled upon another way to perform the "gift that keeps on giving" as @ahamlin put it. Steps to reproduce: 1. Add a unconfirmed user to your account 2. Navigate to https://alerts.newrelic.com/accounts/1523936/channels 3. Click ...
Node.js third-party modules: Stored XSS in Node-Red
I would like to report a stored XSS in node-red It allows to execute javascript in the user's browser Module module name: node-red version: v0.18.4 npm page: https://www.npmjs.com/package/node-red Module Description A visual tool for wiring the Internet of Things. Module Stats 1,758 downloads in...
Nextcloud: Banner Grabbing - Apache Server Version Disclosure
I have found a little information disclosure on your system. Banner Grabbing is a technique used to gain information about a remote server. Additionally, this technique is use to get information about remote servers. I've captured the HTTP request while visiting...
GitLab: Snippet JS template allows attacker to read a user's private snippets
These days snippets can be embedded in a site other than the GitLab instance. An embed link is only generated for public snippets, as can be seen in the app/views/shared/snippets/header.html.haml: haml - if publicsnippet? .embed-snippet .input-group .input-group-btn %button.btn.embed-toggle...
HackerOne: Timing attack towards endpoints on the web without CSRF
Summary: When logged in user on HackerOne visits another web page, remote web page could get conclusion regarding this data: - logged in user - number of triaged reports in the last month - number of new reports at the moment - number of closed reports ... This conclusions are only from one...
Mail.ru: XSS web.icq.com double linkify
XSS via malformed link in message on web.icq.com...
Trello: Websocket response message disclose existence of Organization ID or Board ID
I found that websocket response message can reaveal existence of ID of organization or board It is up and running in other domain. PoC ==================== connect websocket. var ws = new WebSocket"wss://trello.com/1/Session/socket?token="; ws.open = functionevent console.log''; ws.onmessage =...
Hyperledger: many commands can be manipulated to delete identities or affiliations
Introduction: The Faric-ca data in http body and authorization header for many commands that send from client to server are protected by signature. But I find the identity and affiliation commands still have the risk to be manipulated. Hacker can manipulate most other commands to delete identitie...
New Relic: Stored XSS in Brower `name` field reflected in two pages
The Name field of the Brower apps feature is not properly escaped in at least two pages. An attacker can create a new browser application with a specially crafted Name field which will be reflected and interpreted by other users visiting these two pages. Leveraging this vulnerability, I was able ...
U.S. Dept Of Defense: Code reversion allowing SQLI again in ███████
Summary: I just noticed that my publicly disclosed report, https://hackerone.com/reports/311922 is sstill vulnerable either a code reversion was made or something was done to revert the patch. Additionally I'd please request that the images in the report to be censored or redacted as it's been ma...
HackerOne: Team object in GraphQL that have a published external program may expose existence of a private program
Summary: Hi Team! On Team object the parameter "icannotcreatejirawebhookreasons" is not NULL and gets the following default states when called for all programs "CANNOTVIEW","FEATUREGATED","PROGRAMPERMISSIONREQUIRED" If a Company Program runs a Private Program or a Public On the "FEATUREGATED" is...
Mail.ru: Attacker can send requests from mail.ru server
SSRF was potentially possible via request to Sentry in-app error tracking / debugging system. Problem was mitigated by isolating Sentry installation to restricted network...
Nextcloud: Click Jacking Nextcloud
Hello Security, Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking contro...
X (Formerly Twitter): Improper session handling on web browsers
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: Sessions are not properly logg...
HackerOne: Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profile
Hi Team, Summary: First of all, i am not sure if a private program or any program have the capability to not show their response efficiency, but i assume they have because i saw some private programs that do not show response efficiency percentage on their public page. Description: Below list of...
New Relic: Permissions leaks the full name of other NR accounts - Regression of #267636
One more before I run to dinner... Steps to Reproduce: 1. Add a user to your account 1. Enter "123" as the name and "[email protected]" as the email 1. Make them a "user" base role. 1. Click add user button. 2. Navigate to https://synthetics.newrelic.com/accounts/1523936/permissions 3. Create a...
VK.com: Open Redirection Vulnerability in m.vk.com
Open Redirect...
Zomato: XSS in "explore-keywords-dropdown" results.
It seems that people have exploited this vulnerability before on this website, however, it remains unpatched, so here I am reporting the vulnerability. A XSS vulnerability exists when a restaurant or dish is created with a malicious name. The title of the dish or restaurant is not properly filter...
New Relic: [synthetics.newrelic.com] SMTP header injection leads to (mass) arbitrary email sending
While setting up a Synthetics "Ping", I noticed that the name of your monitor was echoed back in warning emails about hosts that fail the validation string phase. I abused this mechanism to insert newline mechanism in these emails, allowing the sending of near arbitrary emails to a easily...
Semmle: Docker Registry HTTP API v2 exposed in HTTP without authentication leads to docker images dumping and poisoning
Summary: Docker Registry HTTP API v2 is exposed in HTTP without authentication. An attacker can use it to dump your docker images and poison them. Description: While digging into the environment that hosts the sandboxed build container, I came across the port 5000 open on another machine probably...
Internet Bug Bounty: Linux kernel: CVE-2017-6074: DCCP double-free vulnerability
Hi! CVE-2017-6074 1 is a double-free vulnerability I found in the Linux kernel. It can be exploited to gain kernel code execution from an unprivileged processes. The kernel needs to be built with CONFIGIPDCCP for the vulnerability to be present. A lot of modern distributions enable this option by...