Linktree: [song.link] Open Redirect

Vulnerability description not provided...

Linktree: XSS in SocialIcon Link

XSS in SocialIcon Link There was no validation of the url provided for the SocialIcon Link , which allowed to include javascript uri . As the cookies were marked as httponly , I couldn't steal them directly via the xss so instead I found an endpoint which was leaking the accessToken used for...

Expedia Group Bug Bounty: Cache Deception Allows Account Takeover

A vulnerability allowed an attacker to extract a user's session token from a cacheable page, leading to account takeover. The session token was reflected in the response of a cacheable URL, and the server responded with a 200 OK. The caching server saw the response as cacheable due to the file...

MTN Group: IDOR [mtnmobad.mtnbusiness.com.ng]

Steps To Reproduce: 1. Go to https://mtnmobad.mtnbusiness.com.ng//dashboard/home with burp proxy 1. Intercept a POST request to /app/dashboardData and review its response you will see emails and ids 1. Go to https://mtnmobad.mtnbusiness.com.ng//userProfile 1. change name, mobile, address etc. and...

TikTok: Remotely Accessible Container Advisor exposed performance metrics and resource usage

A vulnerability was found that caused cAdvisor Container Advisor to be publicly accessible through an 8080 port. We thank @tw4v3sx for reporting this to our team...

8x8: Subdomain Takeover at http://██.get8x8.com/

@testingforbugs reported to us a possible subdomain takeover which was achievable due to a misconfiguration of a Netlify target. The issue has been rectified...

Nextcloud: Name collision of shared folders

Vulnerability description not provided...

GitLab: No Restriction on password

Note- 1: When I report this issue to another program, the triaged expert said The server is now only hashing a reasonable size password, this should not cause a Denial of Service . Since there does not appear to be evidence of DoS occurring here So they will take action, Only when ddos appear...

Glassdoor: XSS in www.glassdoor.com

Summary: Browser: Chrome Affected URL https://www.glassdoor.com/Location/All-Tesla-Office-Locations-E43129.htm?DIFFICULT=%3E%3Csvg%20onload%3d%26%23x00000000061;%26%23x0000000006c%26%23x0000000065%26%23x0000000072%26%23x000000000741%26%230000000000000041;%20%3C%2fscript%20 Steps To Reproduce: 1. ...

Shopify: DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.com

There was a web cache poisoning vulnerability on Shopify's CDN domains that allowed an attacker to block access to any file hosted on the website. The vulnerability existed because the cache server treated backslashes and forward slashes as equivalent, while the origin server returned 404 errors...

Node.js: Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on MacOS

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: Similar to...

Hyperledger: DOS validator nodes of blockchain to block external connections

Attack was documented in the in the github repo: https://github.com/hyperledger/indy-node/security/advisories/GHSA-x996-7qh9-7ff7 Attack: The attacker sends 500 read requests to each node and opens a new one when holding 500 parallel connections. Every user is able to send read requests since it'...

Automattic: IDOR in API applications (able to see any API token, leads to account takeover)

Summary: Hi, @ehtis, thank you for the test account. Here is a critical report. : On Pressable, we can create API applications at https://my.pressable.com/api/applications, and we can access many things using the API token via following the API docs I created an API application and tried to updat...

X (Formerly Twitter): Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpoint

An attacker was able to view private Twitter Circle posts by liking them through the /FavoriteTweet endpoint and then downloading their Twitter data archive, which contained the full content of the liked posts...

Ruby on Rails: ActionView sanitize helper bypass leading to XSS using SVG tag.

An HTML sanitization bypass vulnerability was discovered in the ActionView sanitize helper. This allowed an attacker to bypass sanitization and execute cross-site scripting XSS attacks by using the use tag of the SVG element. By embedding a base64 encoded SVG with malicious code, an attacker coul...

Revive Adserver: Multiple cross-site scripting (XSS) vulnerabilities in Revive Adserver

Vulnerability description not provided...

TikTok: Stored XSS in the ticketing system

A Stored Cross-Site Scripting XSS vulnerability was found on a TikTok Seller endpoint, which could have resulted in a JavaScript payload injected into the endpoint causing it to be executed within the context of the victim's browser. We thank @codeslayer137 for reporting this to our team...

LinkedIn: A Unverified User Can Post Newsletter (Which Is Not Allowed Through Application UI)

A vulnerability was discovered in LinkedIn that allowed unverified users to create newsletters, even though this feature was not accessible to them through the application's user interface. By sending a specific request with the unverified user's cookie, the newsletter creation API could be...

GitLab: Bypass: Stored-XSS with CSP-bypass via scoped labels' color

A Stored-XSS with CSP-bypass vulnerability was discovered in GitLab that allowed attackers to execute arbitrary actions on behalf of victims at the client side. The vulnerability was caused by a missing mitigation for scoped labels, which allowed attackers to create a Stored-XSS with CSP-bypass o...

Shopify: Attacker is able to query Github repositories of arbitrary Shopify Hydrogen Users

Private GitHub repositories of arbitrary Shopify Hydrogen users were accessible to attackers due to a vulnerability in the Hydrogen app. Attackers could query the GitHub account of any Hydrogen user and obtain sensitive information such as private repositories...

8x8 Bounty: Jitsi Desktop Client RCE By Interacting with Malicious URL Schemes on Windows

A command injection vulnerability was found in Jitsi Desktop Client before commit 8aa7be58522f4264078d54752aae5483bfd854b2 on Windows. This vulnerability could allow an attacker to execute arbitrary code by interacting with malicious URL schemes when launching browsers. The vulnerability has been...

MTN Group: Firebase credentials leak

Summary: This report is regarding the fix of 1351329. The fix is not patched fully, comments are visible to anyone and an attacker can utilize this for further attacks. Steps To Reproduce: go to : view-source:https://mpulse.mtn.ng/ search for 'Initialize Firebase' as you can see the firebase...

U.S. Dept Of Defense: Blind SSRF via image upload URL downloader on https://██████/

Description: Dear DoD, I found Blind SSRF on one domain from Hack US program. Original domain is https://█████/ but when you make account and login it redirects you to https://███/my/. Here's the video PoC: ██████ Thank you! Impact In a typical SSRF attack, the attacker might cause the server to...

Nextcloud: Missing rate limiting on password reset functionality allows to send lot of emails

A missing rate limiting on password reset functionality in Nextcloud allowed an attacker to send a large number of emails, potentially resulting in financial loss and service disruption. The vulnerability was exploited using the IP rotate extension of Burp Suite. The issue was resolved by adding ...

Shopify: Subdomain Takeover at course.oberlo.com

Hi, I was able to takeover your subdomain course.oberlo.com via using kajabi services. Poc : visit https://course.oberlo.com/ you will see my poc https://web.archive.org/web/20220904143512/https://course.oberlo.com/ Suggested Fix : Clear your subdomain DNS. Impact Subdomains Takeovers can be use ...

U.S. Dept Of Defense: Authentication bypass leads to Information Disclosure at U.S Air Force "https://███"

Hi Hackerone Triage team, I'm new in this program, what i understood that every Web Owned/Operated by DoD is in scope , so i did some google searches , exactly in wikipedia and i've find this PNG that confirms that U.S Air Force is in scope :...

Nextcloud: the complete server installation path is visible in cloud/user endpoint

Sensitive internal information, including the complete server installation path, was visible in the cloud/user endpoint of Nextcloud server versions prior to 20.0.8, 21.0.2, and 22.0.0RC2. An attacker could obtain this information by making a GET request on the endpoint while logged in. A securit...

GitHub: Managing Pages

An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This...

Hyperledger: Relative Path Traversal vulnerability in fabric-private-chaincode

Unsanitized input from os.Args3 : 75 CLI argument flows into os.OpenFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to open arbitrary files. The following steps of code lines with respective code confirm the issue: -...

Internet Bug Bounty: Airflow Daemon Mode Insecure Umask Privilege Escalation

Apache Airflow prior to 2.3.4 had multiple components with an insecure daemon umask of 0, resulting in critical files and directories to be world writable. As such, any local user can infer Airflow to process specially crafted input and ultimately perform a privilege escalation to user executing...

GitHub Security Lab: [Java]: CWE-625 - Query to detect regex dot bypass

This bug was reported directly to GitHub Security Lab...

U.S. Dept Of Defense: IDOR leaking PII data via VendorId parameter

Description: Dear DoD, I found one bug on your domain from Hack US program: █████ It's IDOR bug. Make sure to know that I didn't test many funcs here for IDOR. I didn't test for ATO Account Takeover. But you should fix this. Here's the PoC: ██████████ Thank you DoD! Impact An attacker could steal...

Node.js: Weak randomness in WebCrypto keygen

https://github.com/nodejs/node/pull/35093 introduced a call to EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/cryptokeygen.cc. There are two problems with this: 1. It does not check the return value, it assumes EntropySource always succeeds, but it can and sometimes will fail. 2. The...

Nintendo: [MK8DX] Improper metadata parsing

Vulnerability description not provided...

Nextcloud: Database resource exhaustion for logged-in users via sharee recommendations with circles

Summary: Registered users can generate massive database load Steps To Reproduce: 1. create 9 circles and 6 folders circles folder 50 2. share all created folders with all created circles 3. open an other folder and open the share tab, so the URI...

U.S. Dept Of Defense: IDOR when editing email leads to Mass Full ATOs (Account Takeovers) without user interaction on https://██████/

Dear DoD team, I found one critical bug on your domain: https://██████/ It's IDOR. Also this domain is from Hack US program. What is that IDOR? Insecure direct object references IDOR are a type of access control vulnerability that arises when an application uses user-supplied input to access...

Nextcloud: [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only

Summary: The OpenID Connect User Backend allows users to login to Nextcloud using SSO. A workaround that was apparently implemented for the Safari browser enables stored Cross-Site-Scripting XSS. The vulnerability only affects user agents that include "Safari" within their user agent string and i...

Nextcloud: [user_oidc] Unencrypted Communications

The OpenID Connect User Backend allows users to login to Nextcloud using SSO and is - according to the policy - part of the main scope of this program. The implementation supports plain HTTP without TLS and transfers sensitive information such as OIDC clientsecrets in an unencrypted manner...

Internet Bug Bounty: CVE-2022-35252: control code in cookie denial of service

https://hackerone.com/reports/1613943 Impact control code in cookie denial of service...

Mattermost: DoS via Playbook

An attacker could create a playbook with a large value for the runsummarytemplate attribute, which doesn't have any size check or validation. This could cause the server to consume an abnormal amount of computing resources and ultimately crash, leading to a denial of service attack. The attack is...

Stripe: Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/

@mrasg discovered an improper access control issue in TaxJar. This could have allowed for account takeover using the email change functionality. The vulnerability was caused by not correctly validating whether or not the reset password token was connected to the user being reset and was resolved ...

GitLab: RepositoryPipeline allows importing of local git repos

Summary When importing a project via the BulkImports, the response field httpUrlToRepo from the client is used to fetch the repo: https://gitlab.com/gitlab-org/gitlab/-/blob/v15.3.1-ee/lib/bulkimports/projects/pipelines/repositorypipeline.rbL17 ruby def loadcontext, data url = data'httpUrlToRepo'...

ResMed: [shop.resmed.com]CSRF leads to Unsubscribe victim from Communication and Reward Membership

Hello, Team While testing on your main domain I discovered CSRF Attack which lead to unsubscribe victims from Communication/Reward Membership. This more like in-depth security issue with reasonable attack scenario. Description: It is possible to unsubscribe a logged-in user from any subscribed...

Ruby on Rails: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)

I have confirmed that ReDoS occurs on Rails::Html::PermitScrubber.scrubattribute. https://github.com/rails/rails-html-sanitizer/blob/v1.4.3/lib/rails/html/scrubbers.rbL134 ruby def scrubattributenode, attrnode attrname = if attrnode.namespace "attrnode.namespace.prefix:attrnode.nodename" else...

TikTok: XSS at TikTok Ads Endpoint

Vulnerability description not provided...

GitLab: Dependecy Confusion via Lookup Request Forwarding to PyPi.org

Summary pip is probably the most popular Python package manager and can be used to install packages from the publicly available Python Package Index PyPi at pypi.org or form internal package repositories. In the beginning of 2021, a vulnerability type called Dependency Confusion attracted some...

U.S. Dept Of Defense: XSS DUE TO CVE-2022-38463 in https://████████

Description: During my research, I found one of the host running ServiceNow vulnerable to CVE-2022-38463 . ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. Impact Attacker is able to steal victims cookies, redirect victim to attacker controlled...

U.S. Dept Of Defense: Reflected XSS at https://██████/

A reflected XSS vulnerability was discovered in the logout functionality of ServiceNow, allowing an unauthenticated remote attacker to execute arbitrary JavaScript code...

Rockstar Games: Modifying Sprunk vs eCola crew data

In this report, the researcher demonstrated an Insecure Direct Object Reference vulnerability that was exploitable in certain Rockstar Official Crews on the Social Club website. Rockstar Official Crews, unlike user-made Crews, use a flat hierarchy where all members are set to the same effective...

Mattermost: DoS via Automatic Response Message

Summary: A user can enable and modify its automatic response message, that is automatically sent when the user has the "Out of Office" status. This response message doesn't have any size check or validation, which allows an attacker to set an almost unlimited number of characters as the response...