Razer US: POST XSS in careers.razerzone.com via the txt_email parameter.

The researcher discovered a POST based XSS on an administrative login page on our careers.razerzone.com website that would have allowed the execution of scripts in some browsers e.g. Firefox. This was fixed on 1/5. Another great report. We'd also like to acknowledge the researcher's effort in...

Razer US: Reflected XSS on https://press.razerzone.com

The researcher discovered a post reflected XSS on press.razerzone.com that allowed the delivery of a script payload via Firefox and demonstrated via a video. This was reported on 11/27 and deployed to production on 12/27...

HackerOne: Validation message in Bounty award endpoint can be used to determine program balances

Summary: Hi team, Found a idor in Checking if a Team has sufficient fund to award Steps To Reproduce 1. Start a new program and login to the account 2. A demo Report will be there 3. Then Set award Amount $100 4. Set award and intercept the request 5. change the reportids to 262262 262262 - mixma...

Cloudflare: Cloudflare does not sufficiently truncate credit card numbers in invoices

When a Cloudflare user has a paid account, but Cloudflare can't process the user's credit card, Cloudflare emails the user from [email protected], subject line "Cloudflare Failed Taking Payment for INV-D1234567". The email contains an attachment, "2017-11-19CloudflareINV-D1234567.pdf", a PDF...

Internet Bug Bounty: Multiple issues in Libxml2 (2.9.2 - 2.9.5)

Libxml2 is the XML C parser and toolkit developed for the Gnome project. Due to its flexible C implementation and continuous development, Libxml2 is known to be very portable, the library builds and works on a variety of systems Linux, Unix, Windows, CygWin, MacOS, MacOS X, RISC Os, OS/2, VMS, QN...

ok.ru: XSS в личных сообщениях

Доброго времени суток. Я нашел XSS в личных сообщениях. Поле, где юзер набирает сообщения не фильтруется. Туда можно встроить скрипт, используя багу, которую я описывал раньше. Пишем сообщение и у друга срабатывает XSS. Вы исправили возможность пилить ники, содержащие специальные символы через...

Unikrn: CSRF log victim into the attacker account

All the API endpoints v1 & v2 reflect sessionid to Set-Cookie response - which can lead victim to login attacker account, for example: Request: ====== POST /apiv1/ HTTP/1.1 Host: unikrn.com User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:57.0 Gecko/20100101 Firefox/57.0 Accept:...

VK.com: XSS работающая по всему сайту, где есть упоминания

Self-XSS в упоминаниях...

Ed: Possible to redirect to a (non-existing) subdomain after logging in via GitHub (leaking the token)

Summary To comment on an article a user has the option to login using his Github account. After logging in the user is normally redirect back to the URL he came from. I found out that it is also possible to redirect to a non-existing subdomain of edoverflow.com. It looks like the whitelist for th...

Ruby on Rails: ActionController::Parameters .each returns an unsafe hash

Rails 5.1.4 The goal of ActionController::Parameters's permit method strong parameters is to prevent accidental trust in the parameters sent by the client. We can therefore not simply create a hash of all the parameters in the params without permitting them first. When we really want to do this...

Ed: Oauth flow on the comments widget login can lead to the access code leakage

Description Hello. Here is a keyword: frog I discovered an little Oauth flow in the comments widget authentication process using redirecturi manipulations. The widget located on the all blogposts, which have URL https://edoverflow.com/2017/post-title/ Upon authentication, it appeared that code...

VK.com: Stealing Private Information in VK Android App through PlayerProxy Port Remotely

Incorrect interaction with the network...

Coursera: No Password Verification on Changing Email Address Cause Account takeover

In coursera.org website, there is no password verification on changing email id. Generally when user try to change the password , they were asked to verify the request by entering old password. For the same reason a verification should be there on changing email. But the worst part is, when user...

Unikrn: session_id is not being validated at email invitation endpoint

sessionid is not being validated at email invitation endpoint request sample: POST /apiv1/inviteemail HTTP/1.1 Host: unikrn.com User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:57.0 Gecko/20100101 Firefox/57.0 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.5...

Coinbase: User provided values passed to PHP unset() function

In the Coinbase wpe commerce open source library, a researcher observed a call to the PHP unset function that relied on user controlled input. The reporter observed that this could allow a malicious user to destroy arbitrary variables in the environment where this library is deployed...

LocalTapiola: Exposed authentication (/cs/Satellite)

Basic report information Brute Force and Information disclosure Domain: www.lahitapiola.fi Steps To Reproduce: REQUEST POST /cs/Satellite HTTP/1.1 Host: www.lahitapiola.fi User-Agent: Mozilla/5.0 Windows NT 6.2; WOW64; rv:18.0 Gecko/20100101 Firefox/18.0 Accept:...

Valve: Reflected XSS in www.dota2.com

Hi guys, Description I found another XSS in www.dota2.com. This time it is located in http://www.dota2.com/international/live/5/5/1. However it seems that when you can change the /5/5 folders to any other number to confirm and it still worked. I tested this on...

Razer US: Authenticated DOM-based XSS in deals.razerzone.com via the rurl parameter.

The researcher discovered that deals.razerzone.com was vulnerable to Authenticated DOM-based XSS via the rurl parameter, which could allow account hijacking via session cookies. The researcher identified the specific code snippet and provided two PoCs with different techniques. Another great repo...

WordPress: Arbitrary file deletion in wp-core - guides towards RCE and information disclosure

Vulnerable place 1: wp-admin/post.php $newmeta'thumb' is placed into DB not sanitized directly from user input. case 'editattachment': checkadminreferer'update-post' . $postid; // Don't let these be changed unset$POST'guid'; $POST'posttype' = 'attachment'; // Update the thumbnail filename $newmet...

Slack: Shared-channel BETA persists integration after unshare

@oneiroi discovered a bug in the Shared Channels Beta wherein notifications may still be delivered to an unshared channel previously shared. This did not affect data not in notifications, and we patched and performed a thorough investigation. Thanks for the report @oneiroi!...

Nextcloud: SQL Injection found in NextCloud Android App Content Provider

Using Drozer, we identified com.nextcloud.client is vulnerable to Sql Injection here is output from drozer: dz run scanner.provider.injection -a com.nextcloud.client Scanning com.nextcloud.client... Not Vulnerable: content://com.nextcloud.android.providers.UsersAndGroupsSearchProvider...

Valve: Link filter protection bypass

Description Hi, there is a protection bypass in the linkfilter function. By using the character 。 %E3%80%82 url encoded instead of a normal dot in urls, it is possible to bypass the blocking. PoC Normal request : https://steamcommunity.com/linkfilter/?url=pornhub.com F240919 Bypass :...

HackerOne: IDOR on Program Visibilty (Revealed / Concealed) against other team members

Hi HackerOne Team, Summary: When you are a part of a program security team, you have a choice to show in your profile that you are a member of the sec team, you can also hide it if you don't want to show it to your profile, any team member can do that using your profile settings here:...

Automattic: Crafted frame injection leading to form-based UI redressing.

Summary One can inject iframes into a note and create a login form that sends the user's details to a third-party server. Once again I will let the PoC do most of the explaining. PoC Paste the following snippet into a Simplenote and then view it in the preview panel. I am using the latest stable...

Automattic: [Simplenote for Windows] Client RCE via External JavaScript Inclusion leveraging Electron

Hi, A carefully crafted injection in the Markdown parser within Simplenote for Windows can be leveraged to achieve remote code execution via an external JavaScript file. The nature of Simplenote's content sharing system, which makes use of tags containing email addresses, means that an adversary...

HackerOne: Introspection query leaks sensitive graphql system information.

Summary: Interospection query leaks sensitive data. Introduction As we know graphql was initially developed and used by facebook as an internal query language and so the features of graphql mostly revolve around internal and development areas. Graphql executes queries using a type system with the...

Mail.ru: XSS on account.mail.ru/login

Уязвимость на станице https://account.mail.ru/login и подготовка файлов для атаки --------------------- В процессе исследования заметил, что на странице https://account.mail.ru/login не валидируется значение параметра v. Значение выводится на странице как есть и используется в пути до скрипта...

Monero: Kovri: potential buffer over-read in garlic clove handling + I2NP message creation

Brief ----- There is a lack of sanitation checks when handling Garlic messages in the kovri I2P router. Sending a specially crafted Garlic message can cause the router to send onward an I2P message containing leaked RAM data, triggering a massive information leakage. Technical Details: ==========...

Electroneum: Hackerone [Mainsite Vulnerability]

96 Hello, I was checking out the website Electroneum – Crowdfunding Token Sale – Electroneum – the mobile based cryptocurrency for any vulnerabilities through hackerone. I would like to submit a vulnerability for consideration towards a bounty. Currently you have the file...

Hacker Target: Sending Emails from DNSDumpster - Server-Side Request Forgery to Internal SMTP Access

| Summary: | | -- | HackerTarget is a service that provides access to online vulnerability scanners and tools used by many security professionals and “makes securing your systems easier”. They also are the creators of DNSDumpster which is a popular service used for recon. | Description: | | --|...

Kaspersky: Hard Coded username and password in registry

I was using a tool called RegShot to take a snap shot of the registry before and after installation in order to see what changes were being made in the registry and I discovered hard-coded credentials I have attached the full comparison details of the registry changes but these are the lines and...

Valve: MySQL username and password leaked in developer.valvesoftware.com via source code dislosure

Hey there it looks like you are relying on a script that cleans up your backup process on developer.valvesoftware.com: /scripts/finalcleanup.sh: Remove files post cleanup rm -r $SITEPATH/data rm $SITEPATH/.sql rm $SITEPATH/.sql.gz rm $SITEPATH/.tgz rm $SITEPATH/.tar.gz rm $SITEPATH/.log rm -r...

OWOX, Inc.: Server-side cache poisoning leads to the http://my.dev.owox.com inaccessibility

By using single specially crafted URL, it was possible to cause service inaccessibility for all users who will visit the site, as result of infinite redirect loop. I discovered an issue, when by using single specially crafted URL, it was possible to cause service inaccessibility for all users who...

Ed: Chrome Extension is vulnerable to the self-DOS issues in case it process the security.txt with a big size

Description Hello. Before all, thanks for the invite: Here is keyword: frog I discovered the self-DOS issue, which affects Chrome extension. Impact I marked the impact as low, because it will affect only the browser tab, and will not impact other browser tabs. The issue happens due to processing...

HackerOne: Information Disclosure when /invitations/<token>.json is not yet accepted

Hi Team, Summary: First, i just want to clarify that this finding seems a purely human mistake from one of the hackerone member team who created a summary of this report: 283309 --- I have found that you guys HackerOne was disclosing email address and private program as part of this report summar...

Aspen: Session does't get expired after changing the password in https://readthedocs.org

Session does't get expired after changing the password in https://readthedocs.org...

Infogram: Persistent XSS in share button

Persistent XSS in "Share" button was found: 1. In custom link field for "Share" button add: ". 2. Share the infographic publicly, navigate to its public URL and click the "Share" button. 3. See that pop-up window activates...

Mail.ru: CSRF на biz.mail.ru

Здравствуйте, Я обнаружил CSRF на biz.mail.ru PoC: система думает что мы хотели добавить эти домены в свой аккаунт через час мы получим майли: "Нужна помощь с подтверждением домена .com?" F239336 Благодарю за внимание. С уважением, Джейхун Джафаров c37hun...

Trello: Able to run script on https://trello-attachments.s3.amazonaws.com/ [N/A]

HI Trello Security Team this pratik From India ------------------------------------------------------------------------------ I have Founded Stored XSS On your Website critical issue need to be patched before someoneattacker exploit this...

U.S. Dept Of Defense: X-XSS-Protection -> Misconfiguration

Hi there, URL: https://www.sfl-tap.army.mil/ I have seen that the website is using the X-XSS-Protection Header. But it has a strange configuration. When I take a look at securityheaders, I've seen that you guys use this as configuration. X-XSS-Protection: DENY DENY is used for the X-Frame Option...

Automattic: Improper markup sanitization.

Summary One can inject HTML into a note and create a login form that sends the user's details to a third-party server. This was a fun issue to play around with. I will let the PoC do most of the talking for a change. PoC Paste the following HTML into a Simplenote. I am using the Simplenote app...

HackerOne: Program profile metrics endpoint contains mean time to triage, even when turned off

Description Include Impact: when a bug bounty program disables its profile metrics which shows the Response Efficiency, there still some data leaked in the response of the the following endpoint: hackerone.com/PROGRAMHANDLE/profilemetrics.json this endpoint leaks the meantimetotriage although the...

Concrete CMS: Reflected XSS vulnerability in Database name field on installation screen

"Leave me in a room with some crayons and I'll draw on the wall." Platform information Issue: Core CMS issue Version: Concrete5 - 8.2.1 md500080d5a625ddbaece643894f67d57b1 downloaded today from official download site2 Short description There is reflected XSS vulnerability in Database Name filed o...

RubyGems: [gem server] Stored XSS via crafted JavaScript URL inclusion in Gemspec

Hi, A JavaScript URL injection in the homepage field within a Gemspec file can be leveraged to achieve stored XSS on the default gem server web interface, referenced here. When you install RubyGems, it adds the gem server command to your system. This is the fastest way to start hosting gems. As...

Ubiquiti Inc.: Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300

In AirOS 6.1.5 and prior, due to lack of validation is possible to bypass the CSRF in certain web pages. If an authenticated user access an attacker controlled web page, it could trigger the CSRF and the resulting request could modify the device configuration and creating stored-XSS, with the XSS...

Semrush: Following links are vulnerable to clickjacking

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: The below list...

Legal Robot: Exposes a series of other private credentials

Hi, I found a Javascript file where have many private credentials. JS File https://app.legalrobot.com/meteorruntimeconfig.js Code meteorruntimeconfig = "meteorRelease":"[email protected]","meteorEnv":"NODEENV":"production","TESTMETADATA":"","PUBLICSETTINGS":"analyticsSettings":"Google...

AlienVault : DNS pinning SSRF

Hello there, this is for the otx.alienvault.com domain, but I couldn't mark it in the drop down menu. I saw the note about the 2 weeks so I decide to report this. Summary: I've found that you can perform a SSRF attackwith DNS pinning and read the response from url http://169.254.169.254 Browsers...

Urban Dictionary: Stored XSS on urbandictionary.com

hi team, I have found an XSS flaw on your site in add page. POC in this video...

GSA Bounty: Subdomain Takeover

@picklepwns discovered a subdomain takeover attack. Technically, the domain was out of scope for our Vulnerability Disclosure Policy. We want to remind hackers to please limit their testing to domains explicitly listed in that scope which is repeated on our HackerOne program page for convenience...