15606 matches found
Razer US: Razer Synapse 3 Local Privilege Escalation
Excellent report from @achapman. We appreciate the time, effort, technical skill, and professionalism of the researcher in helping us find and fix this issue...
Semrush: [oauth token leak] at oauth.semrush.com
Domain, site, application --- oauth.semrush.com Steps to reproduce --- 1 Create following html at attacker.com/postmessage.html function listenerevent alertJSON.stringifyevent.data; var dest =...
Reverb.com: Full account takeover
Hello Team, I got a security issue in reverb ios application which allows an attacker hack all users account. Since iOS application is not in the scope but still I am reporting this, because this vulnerability may compromise all users account. Please resolve this quickly. Desription: Reverb ios...
Snapchat: Takeover 2 MAIN DOMAINS of a company Acquired by Snapchat
Hi, As you may realize I noted "Domain" and not subdomain because actually, I was able to take over the MAIN domain of a company Acquired by Snapchat. As you can see in the screenshot below, when you type "Addlive" in Google https://goo.gl/EAxBaj , the first two results will be: F261984 First one...
LocalTapiola: Reflected XSS+CSRF on secure.lahitapiola.fi
Basic report information Summary: The secure.lahitapiola.fi -mail application contains a reflected XSS vulnerability which can be exploited for example with CSRF-attack. Description: As mentioned in the summary, the site contains a reflected cross-site scripting vulnerability. This vulnerability ...
Open-Xchange: [XSS] Style/Event Filter Bypass v3.0
Hi. New ways to bypass filter in the mail. Previous reports 279073, 244821 1. onEvent filter bypass - If add in style, then onEvents filter disabled. Send e-mail: json "content": "", Response: json "content":"" 2. Without onEvents - Without you can using : json "content": "aaa", Response: json...
Zomato: Blind XSS - Report review - Admin panel
Introduction In the Zomato Business app there is the functionality to report a review and give additional details as to why you did report the review. Because I knew this reason would be read by Zomato admins I did insert a blind XSS payload here, which ended up executing on...
Snapchat: Publicly accessible Continuous Integration Tool
@apfeifer27 found an internal Continuous-Integration instance, which disclosed internal source code and credentials for some of our instances...
Valve: Xss was found by exploiting the URL markdown on http://store.steampowered.com
Hello guys I found an xss vulnerability on store.steampowered.com markdown POC http://store.steampowered.com/widget/386360/?t=url=google.com:/onclick=%27alertdocument.domain%27url=xss/url Here is my exploit url=google.com:/onclick='alertdocument.domain'url=xss/url Steps 1 - go to any product 2 -...
Ubiquiti Inc.: Code Execution in restricted CLI of EdgeSwitch
In EdgeSwitch 1.7.3 and prior, an user with admin credentials can make use of specially crafted commands to execute arbitrary shell instructions, bypassing the SSH/TELNET CLI interface. A command injection vulnerability existed in the restricted CLI of the EdgeSwitch. Exploiting this vulnerabilit...
HackerOne: Information Disclosure which violate program privacy
Summary: please refer to the following report: https://hackerone.com/reports/311289 It was noticed that TTS changed the summary and set the domain to example.gov as not to reveal to the public. But at the bottom of the page, "britta changed the scope from https://ci.fr.cloud.gov to None."...
Zomato: IDOR in treat subscriptions
The treat subscriptions tab in my profile has an IDOR. The corresponding api: POST /php/filterusertabcontent.php HTTP/1.1 userid=██████&tab=treatsubscription&orderhistoryoffset=0&orderhistorylimit=20 You can give any user id and you will be able to see the treat subscriptions of that user. Impact...
U.S. Dept Of Defense: Blind SQL injection on ████████
Summary: I discovered that a post request made to https://████████/elist/viewem6.php is vulnerable to SQL injection and is quite clearly vulnerable as I was able to induce a 2 second hang on the web page. Additionally I was able to discover the mysql version with a true/false condition...
Node.js third-party modules: [public] Path Traversal allows to read content of arbitrary files
Hi Guys, There is Path Traversal in public module. It allows to read content of arbitrary files on the remote server. Module public Run static file hosting server with specified public dir & port. Support a "direcotry index" like Apache httpd. https://www.npmjs.com/package/public version: 0.1.2...
Node.js third-party modules: [mcstatic] Path Traversal allows to read content of arbitrary files
Hi Guys, There is Path Traversal in mcstatic module. It allows to read content of arbitrary files on the remote server. Module mcstatic This is a general file server made by nodejs. It will be easy for you to access the files on the server through the browser. https://www.npmjs.com/package/mcstat...
Node.js third-party modules: [localhost-now] Path Traversal allows to read content of arbitrary file
Hi Guys, There is Path Traversal in localhost-now module. It allows to read content of arbitrary files on the remote server. Module localhost-now This is a general file server made by nodejs. It will be easy for you to access the files on the server through the browser...
Discourse: Gaining access to private topics using quoting feature
Description Some topics have limited access to certain groups and users, and while there exists a validation for access on this topic, it can be bypassed by abusing a vulnerability in the "onebox" quoting feature. When pasting a link in a reply, if this link happens to be a link to another topic ...
Mail.ru: IDOR on mcs.mail.ru
CSRF tokens were static, CSRF token for arbitrary user's account can be obtained. No direct security implications were found, since token is transmitted in request headers and can not be sent crossite, but using static tokens was considered as a bad security practice. mcs.mail.ru was not in bug...
Mail.ru: XSS via Cookie in e.mail.ru
Привет! Нашел stored xss через куку VID. Обычно такое эксплуатируется через mitm. Сама кука не имеет атрибутов secure и samesite, что дает возможность выставить ее по http на сервере атакующего. Сценарий такой: 1. Жертва находится в сети атакующего 2. DNS сервер сети атакующего резолвит хост...
Semrush: XXE in Site Audit function exposing file and directory contents
Summary: The Project Site Audit function is vulnerable to XXE when parsing sitemap.xml files. Description: The Site Audit function spiders a given website and performs analysis on the discovered pages. In order to improve website spidering the URL of a sitemap.xml file can be provided. If provide...
Mail.ru: [mobs.mail.ru] nginx path traversal via misconfigured alias
Domain, site, application -- mobs.mail.ru Steps to reproduce -- http://mobs.mail.ru/media../mobs/settings.py Actual results -- py ... SECRETKEY = '████████████' ... DISTIMOPRIVATEKEY = '████████████' ... PoC, exploit code, screenshots, video, references, additional resources --...
Informatica: [https://life.informatica.com] - information disclose
Researcher had discovered and reported an issues that leads to information disclosure...
Mail.ru: Error in processing gif images
Application crash on malformed GIF image parsing in ICQ for Desktop...
GitLab: Using GitLab to monitor and hijack domains in mass quantity.
Vulnerability Description There is a logic flaw in how GitLab pages can set custom domains that allows an attacker to actively monitor domains and hijack them as soon as they point to 52.167.214.135. GitLab allows setting an unlimited number of domains for a single repository. First, I wrote a...
Node.js third-party modules: [uppy] Stored XSS due to crafted SVG file
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Module: Uppy. Affected version: 0.22.2...
Pornhub: Stored XSS (client-side, using cookie poisoning) on the pornhubpremium.com
The researcher discovered that a parameter's value was stored in a cookie and that cookie's value was echoed in certain pages. The researcher was successful in providing an XSS payload as this parameter's value and having it execute. DOM XSS through cookie. Discovered by manual inspection of JS...
U.S. Dept Of Defense: SQL injection
Initially I discovered a Defunct admin panel with default credentials, admin/admin. This was vulnerable to a blind SQL Injection but I wasn't able to successfully exploit the login panel. I later google dorked for php files on the subdomain and ended up finding another end point that was vulnerab...
VK.com: Reflected XSS в m.vk.com
XSS в поиске по карте...
Ubiquiti Inc.: Format String Vulnerability in the EdgeSwitch restricted CLI
In EdgeSwitch 1.7.3 and prior, an user with admin credentials can make use of specially crafted commands to execute arbitrary shell instructions, bypassing the SSH/TELNET CLI interface. There was a format string vulnerability present in the Admin CLI for the EdgeSwitch. Exploiting this...
Mail.ru: CSRF на calendar.mail.ru
CSRF on ICS URI import in calendar.mail.ru Cцрф с обходом защиты через ORIGIN посредством размещения пока на одном из субдоменов...
Semrush: Cross-origin resource sharing misconfig
Description An HTML5 cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other...
LocalTapiola: Securemail server used to internal spam and resource exhaustion
Basic report information Summary: Confidential message systems fails to restrict large amount of receivers. This might lead to hardware exhausting and/or attacking localtapiola internal employees as securemail recipient. Description: Despite https://secure.lahitapiola.fi/ is designed to send...
Zomato: Reflected XSS on https://www.zomato.com
Hello, I found an XSS issue due to the incorrect handling of the \ character in a context, the following link works as a PoC that alerts the location of the document: https://www.zomato.com/googleOAuth2Callback?alertlocation;%3C!--&state=\ The issue exists because, given that the \ character...
WePay: Reflected XSS in the IE 11 / Edge (latest versions) on the stage-go.wepay.com
Description Hello. I discovered Reflected XSS on the stage-go.wepay.com. Browsers & OS tested The XSS checked in the latest IE 11 and Edge on Windows 7. Not checked on Windows 10. POC IE 11 or Edge...
HackerOne: Reputation gain split by company can be used to track the existence of otherwise undisclosed reports
Summary: A researcher who shares an anonymised description of a vulnerability prior to disclosure may inadvertently be also sharing the company to whom the issue affects if a bounty/thanks has been issued. You may ask: "Where would someone get the idea to share partial information about unfixed...
Mail.ru: XSS in delivery club
Reflected XSS via GET parameters of AJAX method due to invalid content-type for JSON data. On the moment of the report delivery-club.ru was not covered by bug bounty program...
Urban Dictionary: See details of a unpublished word by guessing the word ID
https://www.urbandictionary.com/remove.form.php?reconsider%5Bdefidtoremove%5D=$id$ Example Word : https://www.urbandictionary.com/remove.form.php?reconsider%5Bdefidtoremove%5D=12504202 Impact Its is minor information disclosure in which any one see details of an unpublished word...
Node.js third-party modules: Prototype pollution attack (merge-recursive)
As discussed in 309391, here's the separate report for each of the library. This one is the information for the merge-recursive library. Module: merge-recursive Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control...
Node.js third-party modules: Prototype pollution attack (merge-options)
As discussed in 309391, here's the separate report for each of the library. This one is the information for the merge-options library. Module: merge-options Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part...
Node.js third-party modules: Prototype pollution attack (deep-extend)
As discussed in 309391, here's the separate report for each of the library. This one is the information for the deep-extend library. Module: deep-extend Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part of...
Semrush: Open Redirect
Open Redirect on https://www.semrush.com/ User can be redirect to malicious site POC: https://www.semrush.com/redirect?url=http://bing.com I hope you know the impact of open redirect and more info refer https://cwe.mitre.org/data/definitions/601.html Impact User can be redirect to malicious site...
X (Formerly Twitter): ms5 debug page exposing internal info (internal IPs, headers)
Summary: Information exposure through /debug in ms5.twitter.com Description: Debug page from ms5.twitter.com exposes internal info, such as internal IPs and headers. Steps To Reproduce: 1. Visit ms5.twitter.com/debug 1. See internal IP and header-names used 1. To gather more internal IPs, just...
GSA Bounty: CI for [example.gov] can be logged in and accessible
When anyone searched a public search engine for inurl:example.gov where example.gov was one of the URLs in the TTS Bug Bounty scope, the search results included a CI/CD build results URL. When anyone visited that build results page, they were faced with a login page, but if they clicked "log in",...
Node.js third-party modules: [query-mysql] SQL Injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database
Hi Guys, There is SQL Injection in query-mysql module. Due to lack of sanitization of user input, an attacker is able to craft SQL query and get any data from the database. Module query-mysql Install this module in your project like dependency https://www.npmjs.com/package/query-mysql version:...
Node.js third-party modules: Prototype pollution attack (mixin-deep)
As discussed in 309391, here's the separate report for each of the library. This one is the information for the mixin-deep library. Module: mixin-deep Summary: Utilities function in all the listed modules can be tricked into modify the prototype of "Object" when the attacker control part of the...
Node.js third-party modules: [hekto] Path Traversal vulnerability allows to read content of arbitrary files
Hi Guys, There is Path Traversal vulnerability in hekto module, which allows to read arbitrary file from the remote server. Module hekto This package exposes a directory and its children to create, read, update, and delete operations over http. https://www.npmjs.com/package/hekto version: 0.2.0...
Node.js third-party modules: [626] Path Traversal allows to read arbitrary file from remote server
Hi Guys, There is Path Traversal vulnerability in 626 module, which allows to read arbitrary file from the remote server. Module 626 This package exposes a directory and its children to create, read, update, and delete operations over http. https://www.npmjs.com/package/626 version: 1.1.1 Stats 0...
Node.js third-party modules: [crud-file-server] Stored XSS in filenames when directory index is served by crud-file-server
Hi Guys, crud-file-server allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript. Module crud-file-server This package exposes a directory and its children to create, read, update, and delete operations over http...