Mail.ru: invalid handling of redirect_uri at o2.mail.ru/jsapi/button

o2.mail.ru/jsapi/button gets embedded as login window in website that using o2 oauth. parameter redirecturi by default may have either value of white listed domain from particular app by clientId either it may lead to .mail.ru, then it contacts with parent window via postmessages. Other domains a...

X (Formerly Twitter): XSS via Direct Message deeplinks

Description: By using a specially crafted payload as the value of the text parameter in a Direct Message deeplink, a malicious user can inject arbitrary HTML tags and possibly run arbitrary JavaScript code on the "twitter.com" origin. Steps To Reproduce: 1. Create a Direct Message deeplink by...

Mail.ru: api.icq.com / возможность присоединиться к любому чату (даже закрытому).

Получаем ссылку с АПИ на подключение к чату в моём случае она вот такая https://api.icq.net/mchat/AddChat?aimsid=002.0516319051.0828645279:740645342&c=WebIM.jscbtmpc12813&[email protected]&members=740645342 видим параметр &[email protected] просто меняем цифровое значение и вс...

Shopify: SSRF in Exchange leads to ROOT access in all instances

The Exploit Chain - How to get root access on all Shopify instances 1 - Access Google Cloud Metadata - 1: Create a store partners.shopify.com - 2: Edit the template password.liquid and add the following content: html...

Node.js third-party modules: [entitlements] Command injection on the 'path' parameter

Hello again, another command injection, this time on the entitlements module. Module module name: entitlements version: 1.2.0 npm page: https://www.npmjs.com/package/entitlements Module Description check the entitlements of a .app bundle Module Stats 26 downloads in the last day 328 downloads in...

Node.js third-party modules: [git-dummy-commit] Command injection on the msg parameter

Hi there, I've found a Command Injection on the "git-dummy-commit" module. Module module name: git-dummy-commit version: 1.3.0 npm page: https://www.npmjs.com/package/git-dummy-commit Module Description Create a dummy commit for testing Module Stats 62 downloads in the last day 94 downloads in th...

VK.com: Просмотр любых записей на стене

Отсутствие необходимых проверок при создании рекламного объявления. Можно было смотреть записи любых частных и закрытых групп, удаленные записи в группах или профилях, записи на удаленных страницах, заблокированные группы, посты в предложке...

VK.com: Часть админки доступна для всех пользователей

Раскрытие старого админ. интерфейса...

Ruby: Invalid URL parsing '#'

URI is not correctly parsed when "" is included in the URL. Therefore, could instead be tricked into connecting to a different host. PoC bash $ ruby --version ruby 2.4.1p111 2017-03-22 revision 58053 x8664-darwin16 ruby require 'uri' uri = URI"http://[email protected]/test" = p...

Zomato: [www.zomato.com] Abusing LocalParams to Inject Code through ███████ query

@bigshaq found an endpoint which was throwing 500 Internal Server Error after adding a double quote, while he thought that this behaviour might well be a SQLi, and after a bit of fuzzing @bigshaq demonstrated why he believed it to be a SQLi - 500 ISE domain.com?type=redacted&id=1" - 200...

Nextcloud: The session token in the URL

Hello team I found that tat the URL transport the Session token and it's a sentive information so Placing session tokens into the URL increases the risk that they will be captured by an attacker. fix Applications should use an alternative mechanism for transmitting session tokens, such as HTTP...

Nextcloud: Bruteforce in admin panel

Hello there, Admin panel of your website https://nextcloud.com/wp-login.php is vulnerable to bruteforce attacks as their is no rate-limiting. Impact Can gain access to admin panel. To fix this, Just add rate limiting...

Node.js third-party modules: [cloudcmd] Stored XSS in the filename when directories listing

I would like to report a Stored XSS issue in module cloudcmd It allows executing malicious javascript code in the user's browser. Module module name: cloudcmd version: 9.1.5 npm page: https://www.npmjs.com/package/cloudcmd Module Description Cloud Commander is an orthodox web file manager with...

Open-Xchange: [XSS] Parameter Theme

Hi. I found two cases via theme: inline fail && inject file done js $.when.applythis, g.thenfunction return g.mapfunctiona return a.responseText .join"/:oxsep:/" .donefunctionc 2 runCodeox.apiRoot, "/apps/load/", ox.version, ",", a.join"", c, e.completeLoadb, c.split"/:oxsep:/".eachfunctiona !...

Node.js: registry.nodejs.org Subdomain Takeover

I recently found an abandoned and/or overlooked nodejs.org subdomain that was indirectly pointing to Fastly. Fastly doesn't require any proof of DNS ownership to register new distributions that use a given domain, so I was able to effectively take it over. Vulnerability: Subdomain Takeover via...

Uber: Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sg

lioncityrentals.com.sg employed a Wordpress installation that possessed a vulnerable plugin, Formidable Forms, which was vulnerable to reflected XSS, and exposed sensitive form data. Thanks again for the report, @healdb! This was the first bug I ever found that exposed a large amount of PII, than...

Node.js third-party modules: Command injection in 'pdf-image'

I would like to report command injection in pdf-image It allows executing commands on the server Module module name: pdf-image version: 1.0.5 npm page: https://www.npmjs.com/package/pdf-image Module Description Provides an interface to convert PDF's pages to png files in Node.js by using...

Shopify: Session works after logout from Shopify account

@Cryptographer reported if a logout request for a given session was received during the time a product creation request was in progress from the same session, it was possible the logout request could fail. We determined this was the result of a race condition in how we were updating and revoking...

Node.js: Use After Free in crypto.randomFill

Summary: We can trigger Use-After-Free while running crypto.randomFill, so we can easily read/write heap memory using a typed array pointing a freed backing store. Description: See this nodecrypto.cc code. pp void RandomBytesBufferconst FunctionCallbackInfo& args ... char data = Buffer::Dataargs0...

Monero: Buffer out of bound read in miniupnpc xml parser

Summary: This is a buffer oob read vulnerability in miniupnpc when parsing xml response. This vulnerability could result in denial of service attack in monero client to in local area Network. Description: In miniupnpc, file "Minixml.c": The funnction parseelt: static void parseeltstruct xmlparser...

Passit: Weak Password Policy on Signup

Hi Team, i would like to let you know about password management issue. PoC: ======== 1. Navigate to signup page. 2. Fill you details and give password as simple as 123123. 3. You can see you will be registered and there is no strong enforcement. FIx: ------ Use complex password management. Regard...

ExpressionEngine: [EE] Spoof the redirect process

The original report was not a security issue, but that did lead the reporter to discovering that a user could potentially be tricked by nesting redirects so that they first redirected to the site itself, which would allow the second redirect to occur without warning the user that they were being...

WordPress: "Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolons

Description: The wpksesbadprotocolonce function https://developer.wordpress.org/reference/functions/wpksesbadprotocolonce/ is used to sanitise content from bad protocols and other characters. It detects the protocol URI scheme by using the first colon character. It compares the identified protoco...

Unikrn: CSRF logs the victim into attacker's account

Description: There is no session validation while logging in which leads to csrf. Steps To Reproduce: 1. Create a CSRF login POC using the following code. 2. Replace the email and password with the valid credentials. 3. Send the script to the victim to make them click. References: 1. You've...

Mail.ru: [web.icq.com] Stored XSS in link when sending message

Domain, site, application -- https://web.icq.com/ Testing environment -- Chrome Steps to reproduce -- 1 Enter a chat 2 Send the following message: https://www.google.com/"onmouseover="javascript:prompt" 3 Hover the link Actual results -- XSS prompt shows. Expected results, security impact...

Mail.ru: XSS при добавлении в чат пользователя

web.icq.com 1. кликаем по чату. открываем боковое меню уведомления выбираем наш аккаунт с XSS ником. при клике на кнопку Начать чат с .... происходит XSS screenshot1 Impact кража кукисоф...

Zomato: Clickjacking: Delete Account, Change privacy settings, Rate business, follow/unfollow (IE)

Inspired by report 337219. Please note that this report includes a clear security impact as well as a proof of concept. CVSS ---- medium 5.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L Description ----------- The application does not send a X-Frame-Options header, thus allowing pages to be...

Passit: Insecure Account Removal

Hi Team, The removal of account is one of the sensitive part of a web application that needs to protect, therefor removing an account should validate the authenticity of the legitimate user. Scenario: =============== The user logins to a shared computer office, library, cafe Left the account open...

Passit: Session not changed after password reset

Hey, I've found a session management in app.passit.io, which can lead to session takeover! Issue: ============== When the password of an account is changed from a session, other sessions doesn't expire! Steps To Reproduce: ====================== 1 we need to use two different browsers ex:- 1...

ExpressionEngine: [EE] change the author of post using the author_id

@flex0geek discovered that users with permission to edit entries in the control panel could manipulate the form or POST submission and set an invalid author as the author of that entry. @flex0geek gave a detailed report with step-by-step instructions for replicating and screen captures of a their...

Internet Bug Bounty: CVE-2018-6797: A crafted regular expression can cause a heap buffer write overflow in Perl 5 giving a remote attacker control over bytes written

An attacker supplies a regular expression containing one or more \xDF characters after an escape putting the regexp into unicode matching mode, such as a \N escape. Each \xDF character adds one byte of overflow, and any other text in the regular expression is written in order, providing the...

LinkedIn: Can delete other user's post and company page post

Vulnerability description not provided...

VK.com: Получение вечного доступа к Long Pool и авторизованой страницы сайта, если мы когда-либо были на аккаунте жертвы

Недостаточные проверки в боте «Молодец». Всего один раз утащив аккаунт, после того как пользователь вернет доступ к аккаунту, было можно читать обновления Long Poll https://vk.com/dev/usinglongpoll, а еще проще - читать все новые сообщения в личке жертвы без возможности ревока доступа с её сторон...

PortSwigger Web Security: burp does not validate the common name of the presented collaborator server certificate

Burp is not validating correctly if the presented certificate in collaborator server. It warns if it is a self signed one, but if it is a legitimate one any valid CA, it appears not to be checking the CN. This is an issue for the polling service, since it allows for the connection to be intercept...

Open-Xchange: [XSS] Forgot password link

Hi. 1. Go to without autologin: https://sandbox.open-xchange.com/appsuite/!!&forgot-password=javascript:alert1 2. Click: Forgot your password? No check parameter forgot-password in /apps/io.ox/core/boot/form.js: js function n $"io-ox-password-forget-form".remove; var a = .url.hash"forgot-password...

Passit: Authorization Token is Not expiring After Logout

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: Authorization Token is Not...

Zomato: URL is vulnerable to clickjacking

The browser has verified the identity: Successfully implemented in IE browser Reproduce steps: URLs do not have X-FRAME-OPTIONS set to DENY or SAMEORIGIN, and they are vulnerable to clickjacking. Run under the browser's code and you will see that the listed links are vulnerable to clickjacking...

Bitwarden: Tracking Bitwarden firefox addon users

Firefox web extension, generate a UUID for each web-extension and is specific to a user. Unlike chrome extensions. Which means whenever the user installs Bitwarden on Firefox, it generates a different extension ID for each user. You can check the extension ID by about:debugging - under extensions...

Passit: app.passit.io is vulnerable against Brute Force password quessing attack

Summary: app.passit.io is vulnerable against Brute Force password quessing attack Description: Hello! I have found out that your login functionality is vulnerable against brute force attack. This is especially dangerous in your case because an attacker can get all of users passwords if they brute...

Mail.ru: 3rd party shop admin panel blind XSS

Blind XSS in third party shop's admin panel. This host and company is not operated or owned by Mail.Ru Group, but it runs an online shop and processes orders for Mail.Ru branded gift shop. It does not have any privileged/additional access to Mail.Ru network or user's data. Gift shop is not...

Shopify: Potential to abuse pricing errors in saved carts

If someone abandons a shopping cart and the price changes between that time and when the abandoned cart recovery email is sent, the saved cart will always show the old price. If saved carts do not expire, this can create a situation where bad actors can fill and save shopping carts with sale pric...

LocalTapiola: Flash-based XSS on mediaelement-flash-audio-ogg.swf of www.lahitapiolarahoitus.fi

Basic report information Summary: The lahitapiolarahoitus.fi contains an SWF-file which is vulnerable to reflected cross-site scripting attacks via crafted URL. Description: The file https://www.lahitapiolarahoitus.fi/wp-includes/js/mediaelement/mediaelement-flash-audio-ogg.swf contains a...

LocalTapiola: User Information Disclosure via Json response

User Information Disclosure via Json response on a specific api end point POC URL: https://www.lahitapiolarahoitus.fi/wp-json/wp/v2/users/ Refernce: https://wpvulndb.com/wordpresses/462 Impact attacker can user those info for advance attack as bruteforce login...

ExpressionEngine: RCE By import channel field

The reporter determined that a malicious Channel Set could be used to allow an administrator to upload a PHP file that they might otherwise not have permission to upload. Combined with the temporary folder name algorithm being available in the source code, the malicious administrator could...

LocalTapiola: Reflected XSS of bbe-child-starter Theme via "value"-GET-parameter

This bug is related to 324442. And xss in other url. poc: https://www.lahitapiolarahoitus.fi/wp-content/themes/bbe-child-starter/bbe-engine/assets/actions/bbeopenhtmleditorpopup.php?attribute=%27%3C/script%3E%3Cbody%20onload&value=alertdocument.cookie Impact -Make admin-user run malicious...

Passit: Authentication Required When password change

Description of the issue :- I have found that when changing password in passit account there is no Authentication process by asking current password or any other confirmation If a user leaves their computer or account is still active in insecure place,or if account is hijacked or if CSRF is...

Node.js: Denial of Service: nghttp2 use of uninitialized pointer

While investigating https://hackerone.com/reports/335533 and while following the same reproduction steps, I uncovered a bug in nghttp2 that causes use of an uninitialized pointer for an altsvc frameresulting in crash. The error can be easily triggered by a remote attacker by sending malformed...

Open-Xchange: [XSS] select/onchange in TinyMCE via set body

Hi. TinyMCE allow insert . For set this content need special link: mailto:aaa?body=. Steps: 1. Go to compose mail 2. Insert URL: mailto:aaa?body=%3Cselect%20onchange%3D%22alertdocument.cookie%22%3E%3Coption%3E2%3C%2Foption%3E%3Coption%3E2%3C%2Foption%3E%3C%2Fselect%3E 3. Save Mail 4. Open this ma...

Mail.ru: CRLF injection mcs.mail.ru (leads to XSS)

Description: Я репортил уязвимость open redirect 335521 , которая позволяет украсть токены админа для входа. В redirecturi присутствует crlf инъекция. Даже если вы исправите репорт 335521 , то crlf injection всё равно будет существовать, потому что валидация url для редиректа не повлияет на эту...

Node.js: HTTP/2 Denial of Service Vulnerability

Summary: Malformed HTTP/2 frames cause NodeJS http2 module to perform an uninitialized read. This results in a segmentation fault of the node process, causing a denial of service for all users of the instance. Description: I have already worked extensively with the nodejs core security team on th...