Equifax-vdp: Subdomain takeover at http://test.www.midigator.com

Vulnerability Subdomain test.www.midigator.com points to an AWS S3 bucket that no longer exists. I was able to take control of this bucket and serve my own content on it. Proof Of Concept code $ dig test.www.midigator.com snipped ;; ANSWER SECTION: test.www.midigator.com. 60 IN CNAME...

Stripe: Promotion code can be used more than redemption limit.

A race condition vulnerability existed in the promotion code creation process, allowing users to use the same code more times than the specified redemption limit. This could result in unauthorized discounts or other unintended consequences...

Consensys: Sub-Domain Takeover at http://www.codefi.consensys.net/

Summary: Subdomain takeovers: A subdomain takeover occurs when an attacker gains control over a subdomain of a target domain. Typically, this happens when the subdomain has a canonical name CNAME in the Domain Name System DNS, but no host is providing content for it. This can happen because eithe...

Semrush: Exposure of service tokens to webpack bundle

Service tokens were exposed in a webpack bundle during the build process due to environment variables being accidentally included in the webpack configuration file. A review found no evidence the exposed tokens were used by unauthorized parties...

LinkedIn: Unauthorized User can View Subscribers of Other Users Newsletters

A vulnerability existed in the LinkedIn Voyager platform that allowed unauthorized users to view the subscriber list and details of other users' newsletters by replaying a vulnerable request using the victim's NewsletterId. This was due to missing server-side authorization checks on a specific AP...

Yelp: CORS Misconfiguration on trust.yelp.com

Summary: An cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of th...

Reddit: sensitive data exposure

Summary: A Password hash entry was found in /etc/passwd. This is a major vulnerability since /etc/passwd is a world-readable file by default. Once the password hash is found, an attacker may extract the password using a program like crack. Impact: it is high impact vulnerability .once hacker foun...

Omise: The endpoint '/test/webhooks' is vulnerable to DNS Rebinding

Vulnerability description not provided...

Slack: Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite links

A vulnerability was found in Slack that allowed experienced researchers to utilize an intercepting proxy to manipulate invite links and join an arbitrary workspace without admin approval. The issue was fixed immediately and no customers were impacted...

Yelp: Subdomain Takeover on delivey.yelp.com

Summary: Subdomain takeover vulnerabilities occur when a subdomain delivery.yelp.com is pointing to a service Vulnerable url : delivery.yelp.com This is an verify Link. F1959331 Platforms Affected: website Steps To Reproduce 1. Create the Amazon S3 Bucket on this Name : delivery.yelp.com F1959320...

Fastify: Deny of service via malicious Content-Type

Summary: I found a way to crash a [email protected] server with a single query on a minimal setup. The function ContentTypeParser.getParser do not check properly if the requested content-type parser exists. /lib/contentTypeParser.js:94 javascript ContentTypeParser.prototype.getParser = function...

Internet Bug Bounty: DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)

A vulnerability in Node.js allowed an attacker-controlled DNS server to bypass DNS rebinding protection by resolving hosts in the .local domain. This allowed an attacker to gain access to the Node.js debugger, potentially resulting in remote code execution. The vulnerability affected all versions...

Yelp: no rate limit in forgot password session

A little bit about Rate Limit: A rate limiting algorithm is used to check if the user session or IP-address has to be limited based on the information in the session cache. In case a client made too many requests within a given timeframe, HTTP-Servers can respond with status code 429: Too Many...

U.S. Dept Of Defense: Upload and delete files in debug page without access control.

A debug page with no access control allowed uploading, reading, and deleting files, leading to insufficient access control and potential file deletion by attackers...

MTN Group: IDOR Leads To User Profile Modification https://mtnmobad.mtnbusiness.com.ng/app/updateUser

A vulnerability in the web application allowed authenticated users to modify the profile information of any other user without proper authorization checks. The issue was caused by the lack of sufficient authorization controls when updating user profiles through the /app/updateUser endpoint...

Mars: Jolokia Reflected XSS

Summary: salam Hi team i hope you are well , after doing some recon on mars.com i saw that the website use jolkia 1.3.5 it's vulnerable to reflected XSS Steps To Reproduce: 1. Vuln Link : https://couponsmanager-uat.b2b.mars.com/jolokia/read%3Csvg%20onload=alertdocument.cookie%3E?mimeType=text/htm...

Nextcloud: [nextcloud/server] Moment.js vulnerable to Inefficient Regular Expression Complexity

Describe the bugs: 🐛 moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates. affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the preprocessRFC2822 function in from-string.js, when processing a...

Yelp: Server-side request forgery (ssrf)

.yelp-support.com Summary: Server-side request forgery Platforms Affected: www.yelp-support.com Steps To Reproduce: 1. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details. 2. your server has redirect to malicious website 3. i am...

GitHub: Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api

An incorrect authorization vulnerability was found in GitHub Enterprise Server that allowed GitHub Apps to gain access to and modify most organization-level resources that are not tied to a repository, regardless of granted permissions. This vulnerability affected all versions of GitHub Enterpris...

Gymshark: Subdomain takeover on 'de-headless.staging.gymshark.com'

The Gymshark subdomain https://de-headless.staging.gymshark.com/ was pointing to an unclaimed Shopify site. Because of this an attacker could claim this subdomain, via Shopify, and serve their own content. This is extremely dangerous as an attacker could serve any malicious content on this domain...

Nextcloud: XSS in Desktop Client in call notification popup

Summary: The Nextcloud Desktop Client application does not properly neutralize the name of a group conversation before using it. Steps To Reproduce: Server Machine: 1. Install the Nextcloud Server application 2. Create an administrator account 3. Create a user account Client Machine: 4. Install t...

Automattic: Archived / Deleted / Private Poll Can Be Viewed by Another Users [Crowdsignal WordPress plugins]

This issue was reported by @apapedulimu in CrowdSignal. The private or deleted polls on https://app.crowdsignal.com questions/answers, not results could be viewed by other users through the editor in the CrowdSignal plugin. Happy to learn and work with the Automattic team!...

Node.js: DNS rebinding in --inspect via invalid octal IP address

Summary The Node.js rebinding protector for --inspect still allows invalid IP address, specifically, the octal format. An example of an octal IP address is 1.09.0.0, the 09 octet is invalid because 9 is not a number in the base 8 number system. Browsers such as Firefox tested on latest version m1...

GitHub Security Lab: [CPP]: Add query for CWE-297: Improper Validation of Certificate with Host Mismatch

This bug was reported directly to GitHub Security Lab...

MetaMask: Possible to spoof Origin in "Connected Sites"

A vulnerability was discovered in MetaMask that allowed for the spoofing of the origin domain name in the "Connected Sites" list. This was caused by a CSS style sheet that set the direction to "right-to-left", which resulted in the order of characters in the domain name being messed up and...

Basecamp: Arbitrary write in the application's data folder and arbitrary read of server's replies from 3rd party apps.

A path traversal vulnerability was found in the Android app com.basecamp.bc3 version 3.26.3, allowing an attacker to write arbitrary files in the app's private directory. Additionally, the attacker could redirect server responses containing sensitive information to 3rd party apps using a...

MTN Group: Authentication Bypass Leads To Complete Account TakeveOver on ██████████

The application's backend logic placed too much trust on the login information submitted by the user, which allowed a remote attacker to bypass authentication and perform account takeover...

Stripo Inc: Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo

A previously disclosed vulnerability regarding API key disclosure in Stripo was reported as resolved...

Nextcloud: Vulnerable moment-timezone version shipped

An information exposure vulnerability was found in the moment-timezone package used by Nextcloud server. Attackers could sniff network traffic during data transmission, making exploitation easier. The vulnerability was patched in version 0.5.35 by changing the FTP endpoint with an HTTPS endpoint...

Yelp: No rate limit on subscribe form

Summary: Hi team, I found that you missing a rate limit protection for subscribe form Platforms Affected: https://business.yelp.com/?source=consumersiteheader&utmcontent=header&utmmedium=www&utmsource=conshome Steps To Reproduce: 1. go to...

Nextcloud: XSS in Desktop Client via user status and information

Summary: The Nextcloud Desktop Client application does not properly neutralize the Full Name and Status Message of users before using them. Steps To Reproduce: Server Machine: 1. Install the Nextcloud Server application 2. Log into your account 3. Navigate to your profile page 4. Set the Full Nam...

Yelp: If the website does not impose additional defense against CSRF attacks, failing to use the 'Lax' or 'Strict' values could increase the risk of exposur

Summary: Cookies are typically sent to third parties in cross-origin requests. This can be abused to do CSRF attacks. Recently a new cookie attribute named SameSite was proposed to disable third-party usage for some cookies, to prevent CSRF attacks. Same-site cookies allow servers to mitigate the...

Yelp: CORS Misconfiguration on Yelp

Entry An cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of the...

Internet Bug Bounty: CVE-2022-40604: Apache Airflow: Format String Vulnerability

There is a format string vulnerability in Apache Airflow versions 2.3.0 through 2.3.4 in the src/airflow/utils/log/filetaskhandler.py file. The vulnerability was caused by unnecessary formatting of a URL, which could allow for information extraction...

Nextcloud: Guests can continue to receive video streams from call after being removed from a conversation

Summary: If the HPB is used and a guest is removed from a conversation while said guest is in a call the guest will no longer appear in the participant list and the call will appear as ended for the other participants. However, for the guest the call UI is still shown. If other participants start...

Hyperledger: POOL_UPGRADE request handler may allow an unauthenticated attacker to remotely execute code on every node in the network.

This issue is related to the https://github.com/hyperledger/indy-node. The issue was found in the indy-node code that handles the write request of type POOLUPGRADE in file indy-node/indynode/server/requesthandlers/configreqhandlers/poolupgradehandler.py. The additionaldynamicvalidation function...

U.S. Dept Of Defense: AWS Credentials Disclosure at ███

Sensitive AWS credentials were disclosed through a config.json file found on a server. An attacker could have used these credentials to gain access to sensitive information on the AWS account or perform arbitrary modifications on AWS resources. The affected system host was not disclosed. No CVE...

U.S. Dept Of Defense: External service interaction ( DNS and HTTP ) in www.████████

An External Service Interaction vulnerability was found in www.█████████, allowing an attacker to induce the application to interact with arbitrary external services such as DNS and HTTP. This could lead to various attacks, including DDoS, OS Command Injection, DOS, and Code Manipulation...

curl: CVE-2022-32221: POST following PUT confusion

Summary: The bug I submitted at https://github.com/curl/curl/issues/9507 can have at least a few unintended security issues: - Information Disclosure: this bug causes an HTTP PUT to occur when the user intends for an HTTP POST to occur. The user, who intended an HTTP POST, expects the POSTed...

MTN Group: Exposure Of Admin Username & Password

Hello Team, Ther an exposure of your username and password on this subdomain https://engage2.mtnonline.com/nc/ Exposed Credentials uid: "mtnng", passwd: "bd31568138edbfc0552a1ecc6886ea5c", Steps To Reproduce: Visit https://engage2.mtnonline.com/nc/ Now, press CTRL+U to view the source code of thi...

Nextcloud: SSRF via filter bypass due to lax checking on IPs

A lax checking on IPs in NextCloud allowed for a filter bypass vulnerability that could be exploited by attackers to gain SSRF. The filtration technique failed when met with some of the more advanced SSRF payloads like the alphanumeric ones, allowing attackers to bypass IP filters and gain access...

Ruby on Rails: Unexpected deserialization in Kredis

Unexpected classes could be deserialized in Kredis due to the use of JSON.load, potentially leading to security vulnerabilities...

LY Corporation: iOS group chat denial of service

Vulnerability description not provided...

Rocket.Chat: Bypassing 2FA with conventional session management - open.rocket.chat

The vulnerability allowed bypassing two-factor authentication in open.rocket.chat by exploiting the email confirmation flow. An attacker could sign up, enable two-factor authentication, change the email, and then use the email confirmation link to log in without providing the two-factor...

U.S. General Services Administration: access nagios dashboard using default credentials in ** omon1.fpki.gov, 3.220.248.203**

Summary: when i performing recon on fpki.gov i found nagios dashboard in omon1.fpki.gov, 3.220.248.203 and i accessed it using default credentials username: nagiosadmin password : nagiosadmin Steps To Reproduce: 1. visit these urls : https://omon1.fpki.gov/nagios/side.php...

Shopify: Shop App - Attacker is able to intercept authorization code during authentication (OAuth) and is able to get access to Microsoft Outlook email account

A vulnerability was discovered in the Shop App's Microsoft Outlook OAuth flow, where a malicious app could intercept the authorization code during authentication due to the use of deep links. This could allow an attacker to gain access to the victim's emails. The issue was mitigated by implementi...

Cloudflare Public Bug Bounty: Take over subdomains of r2.dev using R2 custom domains

███████ ████ ████ ███████████████████████████ ███ ██████████ It is possible to take over any subdomain of r2.dev possible also the base domain and have it serve the contents of an R2 bucket in your account. Requirements Access to R2 public buckets in the dashboard is currently behind a flag. The...

U.S. Dept Of Defense: XSS in ServiceNow logout https://████:443

An XSS vulnerability was discovered in ServiceNow logout, allowing an unauthenticated remote attacker to execute code in the user's browser context by clicking on a malicious link. The vulnerability was present in ServiceNow versions prior to SanDiego SP6 and has been assigned CVE-2022-38463...

Shopify: XSS in www.shopify.com/markets?utm_source=

Hello, hope you are having a good day : Summary: I found a reflected XSS in www.shopify.com/markets using the utmsource parameter Reflected XSS vulnerabilities arise when the application accepts a malicious input script from a user and then it is executed in the victim's browser. Since the XSS is...

Nextcloud: nextcloudcmd incorrectly trusts bad TLS certificates

Ref: https://github.com/nextcloud/desktop/issues/4927 Bug description I have a self hosted Nextcloud instance using my own private CA for TLS certs. When running nextcloudcmd without the --trust, it disregards the cert validation failure as "This is not an actual error" and proceeds with the sync...