15606 matches found
Uber: udi-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint
Summary The udi-id request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src whitelis...
Uber: muber-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint
Summary The muber-id request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src...
Uber: lite:sess Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint
Summary The lite:sess request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src...
Zomato: [www.zomato.com] Privilege Escalation - Control reviews - /████dashboard_handler.php
Introduction The handler that controls all the ███ actions for reviews is accessible for any user. The following actions are thus being left open to anyone: getmanagerstatus read███████ unread██████████ ████████ feature██████ unfeature████████ moderate████ unmoderate█████ drop ███ sendmail...
Uber: SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint
Summary The ga request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src whitelist at...
Uber: SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint
Summary The cc request parameter at the https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js mobile endpoint is copied into a javascript string encapsulated in double quotation marks, resulting in SSL-protected payloads being reflected unmodified in the application's response. The script-src whitelist at...
Mail.ru: XSS в отправителе, БЕТА-версия почты
Reflected user-assisteted XSS in "Unsubscribe" beta feature via crafted e-mail From: header...
RBKmoney: DOM-based Cross-Site Scripting in redirect url checkout
The application was exposed to the XSS vulnerability. The code was injected through the "javascript:" URL schema. If the invoice was successfully paid, the code was executed...
GSA Bounty: Link poisoning on https://secure.login.gov/ login page
This link leads to the genuine secure.login.gov login page, in French: https://secure.login.gov/fr?host=portswigger.net However, if you try to change the language to English using the bar at the bottom you'll end up an external website of my choice. As users won't expect changing their language t...
Open-Xchange: Stored XSS
Vulnerability Details: Script code within Presentations is being executed when transferring it to the clipboard. This is done by "copying" or "cutting" text using keyboard commands. Risk: Malicious script code can be executed within a users context. This can lead to session hijacking or triggerin...
HackerOne: Markdown parsing issue enables insertion of malicious tags and event handlers
When markdown is being presented as HTML, there seems to be a strange interaction between and @ that lets an attacker insert malicious tags. Proof of Concept : hello is rendered converted to the following HTML: /http:hello As you can see, the output includes a /http:marquee tag that I can add...
QIWI: Information disclosure on https://paycard.rapida.ru
Hello, I would like to report information disclosure on one of your sub-domains due to some files that might contain some useful information. Basically i have found 3 files that might giveaway some information about the infrastructure : 1 composer.json 2 composer.lock 3 package.json I found all t...
GitLab: Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hook
The secret token field of a webhook is vulnerable to a new line injection, allowing an attacker to inject non-HTTP commands in a TCP stream. When a GitLab instance is configured with an external Redis instance, e.g. on 127.0.0.1:6379, it may result in arbitrary code execution on a Sidekiq worker ...
OV-chipkaart: Personal data of all Dutch public transport cards ("OV-Chipkaart") accessible
███████████████████████████████...
Open-Xchange: [XSS] Mail <style> v2.0
Hi. New way for 269116. Testing rev17. OX check data before remove / /, therefore a filter bypass: html .a font-family: ; font-family: ; font-family: ; For example: json "content": ".a font-family: ", Result: html ox-c3a5f76596 .ox-c3a5f76596-a font-family: Impact malicious code injection...
Ed: Fix for self-DoS in Security-txt Chrome Extension.
@sp1d3rs found a self-DoS vulnerability in the Security-txt Chrome Extension. He was also kind enough to provide a fix wich you can find on GitHub. We merged @sp1d3rs' fix when he submitted a PR. We later decided that it was better to stop using XHR and use Fetch instead, a newer API. This was th...
Shopify: Bypass Filter and get Stored Xss
Description Shopify allows developers to create a special type of application called a "Sales Channel". Developers are allowed to upload a 16x16 SVG "Navigation Icon" for their app provided the SVG follows the design guidelines which limits the allowed elements and attributes. For some reason whe...
HackerOne: Domain spoofing in redirect page using RTLO
Summary: Hello, Domains can be spoofed on redirect page using RTLO. Description Include Impact: Using http://[email protected] & RTLO method, i found a way where redirect page host detection can be spoofed Steps 1. Insert this on report Just Click Here 2. On click of link, it will redirect to...
Mavenlink: Information disclosure when trying to delete an expense's attachment on m.mavenlink.com
There was an information disclosure vulnerability in a particular error message on the mobile site. Using this vulnerability, it was possible to gain access to the filename of certain un-owned attachments...
Informatica: [marketplace.informatica.com] - Template Injection
The researcher has identified and reported a "Template Injection" vulnerability in one of Informatica's domain and helped us in resolving the issue...
Open-Xchange: SSRF - RSS feed, blacklist bypass (301 re-direct)
FYI - Tested on local installation of App Suite 7.8.4 REV 17 Hello, There appears to be another SSRF re-direct vulnerability, similar to my earlier reports that will allow scanning of the App Suite local ports or internal hosts, regardless of blacklist protection in place. The endpoint is the...
Open-Xchange: SSRF - RSS feed, blacklist bypass (IP Formatting)
FYI - Tested on local installation of App Suite 7.8.4 REV 17 Hello, There appears to be a SSRF vulnerability in the below endpoint. This is due to a failure in the App Suite code when evaluating an IP address against a blacklist. The SSRF is limited to scanning hosts on port 80/443 but accuracy i...
WordPress: MediaElements XSS
The reporter disclosed a reflected XSS vulnerability in MediaElement's Flash files, which are bundled in WordPress. MediaElement and WordPress released versions 4.2.8 and 4.9.2, respectively, which resolve the issue...
RBKmoney: Text manipulation in https://checkout.rbk.money
Phishing / social engineering via text manipulation on html form labels...
Semrush: Single Sing On - Clickjacking
Description: Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on. Browsers Verified In: Any Steps To Reproduce: Create HTML file containg...
Uber: Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication
Summary Configuration file and/or source code information leakage without Uber OneLogin SSO authentication. Security Impact Misconfiguration on the server results in information leakage without authentication. Reproduction Steps...
Uber: Design Issue at riders.uber.com/profile
Summary Hello, This is not actually a security threat but a design issue. When a user logs into rush.uber.com, he will get an option called Account Information, when clicked on it takes the user to page https://riders.uber.com/trips where user can edit his profile information. Here user can...
GitLab: Command injection by overwriting authorized_keys file through GitLab import
The Projects::GitlabProjectsImportService contains a vulnerability that allows an attacker to write files to arbitrary directories on the server. This leads to an arbitrary command execution vulnerability by overwriting the authorizedkeys file. To reproduce, sign in to a GitLab instance that has...
Uber: It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without
Summary Configuration file and/or source code information leakage without Uber OneLogin SSO authentication. Security Impact Misconfiguration on the server results in information leakage without authentication. Reproduction Steps...
HackerOne: HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms
Summary: I noticed that HackerOne career pages loads it's application forms from Greenhouse.io via an iframe. The ghjid parameter value is taken into the iframe element for the token parameter in the iframe URL boards.greenhouse.io. Any html characters are escaped in order to avoid XSS and possib...
Ruby: controlled buffer under-read in pack_unpack_internal()
Brief ----- There is a signedness error in the packunpackinternal, allowing the '@' type to trigger a buffer under-read when unpacking with a controlled format similar to format string implementation vulnerabilities. Code Vulnerability -------------------- Vulnerable version: 2.5.0 rc and prior...
WordPress: antispambot does not always escape <, >, &, " and '
The antispambot function escapes some randomly selected characters from its first argument, for example: , &, ", or '. These last five characters should always be escaped. There is a chance that this will print out unescaped: console.log"hello";'; Even though the chance of this happening is low,...
GitLab: SQL injection in MilestoneFinder order method
The MilestoneFinder is a class used to find milestones based on group or project identifiers. The class is used in multiple controllers. It allows to filter based on state and can be used to order the result set. One of the uses can be found in the Groups::MilestonesController. When the index...
Inflection: Clickjacking on https://www.goodhire.com/api
Researcher discovered x-frame options missing...
X (Formerly Twitter): Persistent DOM-based XSS in https://help.twitter.com via localStorage
Summary: I've found a DOM-based XSS vulnerability in the website help.twitter.com that persists via a localStorage key lastArticleHref. The value of this localStorage key is used to dynamically generate a piece of HTML code without proper encoding or filtering allowing an attacker to inject...
Unikrn: [crm.unikrn.com] Open Redirect
Hi there is an open redirect vulnerable in crm.unikrn.com POC curl http://crm.unikrn.com//example.com/ -L -v Response GET //example.com/ HTTP/1.1 Host: crm.unikrn.com User-Agent: curl/7.54.0 Accept: / HTTP/1.1 301 Moved Permanently Date: Thu, 14 Dec 2017 09:06:13 GMT Content-Type: text/html;...
Nextcloud: Registered users can change app password permissions for any user
Vulnerable URL http://server/nextcloud/index.php/settings/personal/authtokens/token ID Summary Nextcloud users can create app-specific passwords, also called authtokens, giving an app limited access to their account. Users can grant or deny access to their files for each app password. The functio...
Automattic: Improper markup sanitisation in Simplenote Android application.
Description The Simplenote Android application 1.5.6 still allows users to embed fully-fledged forms. html Sign in to Simplenote Please sign in Email Password Remember Me Forgot your password? F246484 A more convincing proof of concept could consist of hiding the form inside several paragraphs o...
Zomato: [www.zomato.com] Boolean SQLi - /█████.php
@gerbenjavado found that the parameter entityid was vulnerable to SQLi on endpoint /████.php using a Boolean technique. POC The POC uses ifmid@@version,1,1=5 which returns a 200 ok message. If changed for ifmid@@version,1,1=4 the server gives a 500 or 504 error, confirming the SQLi and proving da...
GSA Bounty: SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agent
I've identified an SQL injection vulnerability in the website labs.data.gov that affects the endpoint /dashboard/datagov/csvtojson and can be exploited via the User-Agent HTTP header. I didn't extracted any data from the database, I've confirmed the vulnerability using sleep SQL queries with...
Deconf: Unauthenticated Reflected XSS in admin dashboard
The researcher has identified a Reflected XSS vulnerability within an analytics report of our plugin. The report was well documented, providing a step-by-step PoC to demonstrate the vulnerability...
shopify-scripts: mruby heredoc notation
Hi There exists a vulnerability in mruby when using the heredoc notation it doesn't need ulimit The minified test can be generated with the following command: ruby -e 'IO.binwrite"j3.rb", "\xa7 This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent...
X (Formerly Twitter): No Rate Limit in email leads to huge Mass mailings
Hi Team, I have found a logical flawNOT DoS in the website 'https://app.mopub.com/' 1.Use Burp Suite and capture below request upon navigation to Code integration 2.Click on Send button after entering email address in the input field of 'Enter one or more email addresses and we'll send you links ...
LocalTapiola: PHPMYADMIN Setup is accessible without authentication on https://lml.lahitapiola.fi/
Vulnerability Detail PhpMyAdmin setup page is accessible over the internet in which it's possible for the user setup the servers with required details. Vulnerable Endpoint https://lml.lahitapiola.fi/admin/phpMyAdmin/setup/index.php Attached screenshots F246247 F246248 Impact Its possible for an...
Semrush: Reflected XSS using Header Injection
Host : www.semrush.com Path : /billing-admin/profile/subscription/?l=de Payload : c5obc'+alert1+'p7yd5 Steps to reproduce : Request Header : GET /billing-admin/profile/subscription/?l=de HTTP/1.1 Host: www.semrush.com Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0;...
Deriv.com: Leaking Referrer in Reset Password Link
On 12th Dec flex0geek reported that binary.com was leaking password reset tokens through referer headers . At first this sight the report was closed as we had fixed this earlier and our code base seemed fine . Later on the researcher sent a video POC which did show that we were leaking password...
HackerOne: Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestion
Summary It was found that although the referrer-policy header for https://hackerone.com/hacktivity was set to strict-origin-when-cross-origin , a request to https://www.hackerone.com/blog contains full url path of the the hackivity page as the referer header eg...
Internet Bug Bounty: Exim handles BDAT data incorrectly and leads to crash/hang
Original article is here Incorrect BDAT data handling leads to DoS Vulnerability Analysis When receiving data with BDAT command, SMTP server should not consider a single dot ‘.’ in a line to be the end of message. However, we found exim does in receivemsg when parsing header. Like the following...
Internet Bug Bounty: Exim use-after-free vulnerability while reading mail header involving BDAT commands
Original article is here Use-after-free in receivemsg leads to RCE Vulnerability Analysis To explain this bug, we need to start with the memory management of exim. There is a series of functions starts with store such as storeget, storerelease, storereset. These functions are used to manage...
GitLab: Lack of validation before assigning custom domain names leading to abuse of GitLab pages service
One way to add a custom domain name for GitLab pages is to create a new DNS A record pointing to the IP of GitLab Pages server i.e. 52.167.214.135. A person who owns the domain name, could then add the domain name in the Pages settings at https://gitlab.com///pages. GitLab then assigns the domain...