15406 matches found
U.S. Dept Of Defense: Host Header Injection on https://███/████████/Account/ForgotPassword
Dear DoD Team, I found one high bug on your another domain. This is from Hack US Program. Affected domain is https://█████/ An attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on...
Shopify: Account Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email Verification
The account takeover vulnerability in the Shopify Collabs platform was caused by the lack of email verification during the signup process. A victim's account could be hijacked if their email address was used to create a new Shopify ID, as the platform did not require email verification. This...
GitLab: Remote Command Execution via Github import
Summary This is very similar to https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitlab-15-3-1-released/Remote%20Command%20Execution%20via%20Github%20import and allows arbitrary redis commands to be injected when imported a GitHub repository. When importing a GitHub repo the...
Automattic: IDOR able to buy a plan with lesser fee
Summary IDOR allows you to pay with the same amount but different currency. For example, paying 35000$ instead of 35000€ Steps To Reproduce 1. Go to https://account.mailpoet.com/ and select a plan 2. For example I have selected this plan; https://account.mailpoet.com/orders/new?p=214 3. Now, as y...
Nextcloud: Desktop client does not verify received singed certificate in end to end encryption
Vulnerability description not provided...
Stripe: Unauthorized Canceling/Unsubscribe TaxJar account & Payment information DIsclosure
@mrasg discovered that users of an account with member permissions were improperly allowed to view certain subscription details and cancel the subscription for that account. I discovered a Vulnerability that allows the user who has member privileges to unsubscribe Cancel the account instead of th...
GitHub Security Lab: [JAVA]: Partial Path Traversal
This bug was reported directly to GitHub Security Lab...
Stripe: Fully TaxJar account control and ability to disclose and modify business account settings Due to Broken Access Control in /current_user_data
Improper access control at app.taxjar.com/currentuserdata allows a user with member role to invite themselves to the account as an admin...
PortSwigger Web Security: Business Logic, currency arbitrage - Possibility to pay less than the price in USD
Currency fluctuate all the time. Theses days EUR / USD key pair is around 1for1. It was even 1:0.99 when I was writing this report. Portswigger doesn't change dynamically the price and exchange rate dynamically. Vulnerability at the following link: https://portswigger.net/buy/pro When you want to...
MTN Group: Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business server
A remote code execution vulnerability was discovered in Pentaho Business Analytics Server. By uploading a specially crafted Pentaho report file using default credentials, an attacker could achieve arbitrary code execution...
Cloudflare Public Bug Bounty: Password Policy Restriction Bypass
Due to insufficient input validation on the backend side, It was possible to bypass the Password Policy Restrictions for Cloudflare accounts by intercepting the request and modifying the content of the password field. This way, a user could set up weak passwords for their account. The password...
LinkedIn: An Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report]
A vulnerability was discovered on LinkedIn that allowed attackers to flag and report draft job posts of other users. This resulted in the disclosure of sensitive job details, even for posts that were not yet published...
MercadoLibre: Stored XSS in reclamos
Stored XSS vulnerability was discovered in the reclamos section of MercadoLibre. The issue was reported by @valent1ne, who provided clear steps to reproduce the vulnerability and a proof-of-concept code. MercadoLibre acknowledged the issue and implemented a fix...
Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields
Summary: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. Description: The following chunked request is processed. It should be rejected as Transfer-Encoding header obfuscatio...
Nextcloud: Profile of disabled user stays accessible
Userprofiles of disabled users keep staying accessible. on DOMAIN/u/USERID This is quite undesirable as this user has no way to clear or modify this data in case they do not want it exposed anymore. I'd assume profiles of disabled users would not be visible to ensure they can always be in control...
Stripe: [Broken Access Control ] Unauthorized Linking accounts & Linked Accounts info DIsclosure
@mrasg discovered that users of an account with member permissions were improperly allowed to see activated linked accounts and connect new carts to the account. I discovered a Vulnerability that allows the user who has member privileges to connect new carts to the Taxjar account , like...
Shopify: Cross-site scripting on api.collabs.shopify.com
Summary: Shopify collabs collabs.shopify.com is a new platform for content creators / influencers to discover and advertise the millions of brands of Shopify. The content creators can apply for different brands on this platform and get paid affiliate marketing. I discovered a cross-site scripting...
GitLab: RCE via github import
Hello, While continuing mining on github import, I found a vulnerability on gitlab.com allowing to execute remotely arbitrary commands. Gitlab uses Octokit to get data from github.com. Octokit uses Sawyer::Resource to represent results. Sawyer is a crazy class that converts a hash to an object...
Internet Bug Bounty: CVE-2022-38362: Apache Airflow Docker Provider <3.0 RCE vulnerability in example dag
Apache Airflow Docker's Provider shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host. Vulnerability summary: In DAG script of airflow 2.3.3, there is a command injection vulnerability RCE in the script exampledockercopydata.py of...
IBM: Cleartext storage of sensitive information at https://staging.status.ai-apps-comms.ibm.com/env can lead to account takeover of several IBM employees
Cleartext storage of sensitive information was reported to IBM, analyzed and has been remediated. Thank you to zere...
Krisp: Card requirement bypass for business trial
Researcher found a way to bypass mandatory card attachment for business trial. The issue has been fixed now. We would like to thank @n0m3rcy for clear and detailed report...
Hyperledger: Cross Site Scripting Vulnerability in fabric-sdk-py source code
See this fix on GitHub https://github.com/hyperledger/fabric-sdk-py/pull/175 Impact Some old affected versions of this package are vulnerable to Cross-site Scripting XSS. Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html,...
SideFX: Stored XSS in messages
The security issue described involves a stored cross-site scripting XSS vulnerability in the message functionality of the system. The vulnerability allowed an attacker to inject malicious code into messages, which could be executed when the victim viewed the message. This resulted in the attacker...
GitLab: Unauthorized access
Hello Gents, I would like to report an issue where attackers are able to: 1. List about.gitlab.com GS bucket. 2. Access all resales through https://about.gitlab.com/all-releases.xml & https://about.gitlab.com/security-releases.xml, which contains undisclosed HackerOne reports. For Example: This...
Brave Software: Persistent user tracking is possible using window.caches, by avoiding Brave Shields
A vulnerability was discovered in Brave for iOS version 1.41.1 that allowed for persistent user tracking using window.caches, even when Brave Shields were enabled to block cookies. This could potentially allow for user tracking without their consent or knowledge...
Brave Software: Security token and handler name leak from window.braveBlockRequests
Vulnerability description not provided...
Insightly: CSRF vulnerability allows disabling Gmail contacts link for user referrals
The CSRF vulnerability allowed users to disable Gmail contacts link for user referrals. The vulnerable endpoint did not sufficiently verify that the requests were intentionally performed by the user, allowing an attacker to generate a PoC that could be used to disable the victim's linked account...
Monero: Reentrancy attack in eth-monero atomic swap
A reentrancy vulnerability was found in the eth-xmr atomic swap smart contract, allowing an attacker to drain almost all of the ethers from the smart contract. The vulnerability was fixed in a later version of the smart contract...
Nextcloud: XSS in Desktop Client in the notifications
Summary: The Nextcloud Desktop Client application does not properly neutralize the names of files before using them. Steps To Reproduce: Server Machine 1. Install the Nextcloud Server application 2. Log into your account Client Machine 3. Install the Nextcloud Desktop Client application onto a...
KAYAK: 1 click Account takeover via deeplink in [com.kayak.android]
Vulnerability description not provided...
Internet Bug Bounty: Pause-based desync in Apache HTTPD
Apache was vulnerable to a pause-based desync. This vulnerability is described in detail in my whitepaper here: https://portswigger.net/research/browser-powered-desync-attackspause Impact This enables server-side HTTP Request Smuggling when Apache is deployed as a back-end server, and it also...
U.S. Dept Of Defense: stored cross site scripting in https://███████
It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. poc attached another parameter at 1636345 q13787 payload: %22%27%3e%3csvg%2fonload%3dconfirm666%3e Impact Cookie Stealing - A...
U.S. Dept Of Defense: stored cross site scripting in https://████
It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. poc attached another parameter at 1636345 q13794 payload: %22%27%3e%3csvg%2fonload%3dconfirm666%3e Impact Cookie Stealing - A...
U.S. Dept Of Defense: stored cross site scripting in https://██████████
It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. poc attached another parameter at 1636345 q13779 payload: %22%27%3e%3csvg%2fonload%3dconfirm666%3e Impact Cookie Stealing - A...
GitLab: Stored-XSS with CSP-bypass via labels' color
Stored-XSS with CSP-bypass was discovered in Gitlab that allowed attackers to execute arbitrary actions on behalf of victims at the client side. This was possible due to the import of unsanitized label colors from Github, which led to the execution of malicious JavaScript code...
U.S. Dept Of Defense: stored cross site scripting in https://████████.edu
A stored cross-site scripting XSS vulnerability was discovered in the ████████.edu website. This vulnerability allowed an attacker to inject and execute malicious scripts on a victim's browser, potentially leading to cookie theft, arbitrary requests, malware downloads, or website defacement...
Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (improper fix for CVE-2022-32215)
Summary: Due to an incomplete fix for CVE-2022-32215, the llhttp parser in the http module in Node v16.16.0 and 18.7.0 still does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS. Description: add more details about this vulnerability We have...
Cloudflare Public Bug Bounty: Bypass two-factor authentication
Due to lack of validation, a malicious actor could brute force OTP 2fa and guess a correct number after multiple failures. The issue was fixed by the Engineering team by implementing restrictions on 2FA attempts...
HackerOne: Program managers can see draft reports using Export Reports feature
A bug in the HackerOne platform allowed program managers to see draft reports using the Export Reports feature, which led to the disclosure of PII without the reporter's permission. The bug was discovered when a user exported a report and found that it contained draft and disclosed report titles,...
Automattic: Stored XSS in intensedebate.com via the Comments RSS
Stored XSS in intensedebate.com via the Comments RSS In our "comments.rss" file, the blog post's title reflects to the XML RSS file without any encoding. So I installed the IntenseDebate on my website https://wp.s2.cm, and created a blog post with alertdocument.domain payload on the title. Then, ...
Hyperledger: fix(security):Path Traversal Bug
Unsanitized input from CLI argument flows into io.ioutil.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files. See this fix : https://github.com/hyperledger/fabric/pull/3573 Impact There is a path traversal...
Internet Bug Bounty: CVE-2022-35948: CRLF Injection in Nodejs ‘undici’ via Content-Type
undici library should be protects HTTP headers from CRLF injection vulnerabilities. However, CRLF injection exists in the ‘content-type’ header of undici.request api. Impact = [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more...
Internet Bug Bounty: [CVE-2022-35949]: undici.request vulnerable to SSRF using absolute / protocol-relative URL on pathname
GHSA: https://github.com/nodejs/undici/security/advisories/GHSA-8qr4-xgw6-wmr3 Report: https://hackerone.com/reports/1642017 Impact SSRF...
Top Echelon Software: Wordpress Users Disclosure (/wp-json/wp/v2/users/)
Hello Team @topechelonsoftware Information: Using REST API, we can see all the WordPress users/author with some of their information. Step To Reproduce: You can get user info by entering below url in your browser: https://www.topechelon.com/wp-json/wp/v2/users/ ███████ Impact Authors : LTR ,...
Slack: Bypass invite accept for victim
Vulnerability description not provided...
HackerOne: Ability to escape database transaction through SQL injection, leading to arbitrary code execution
HackerOne has an internal backend interface that gives debugging capabilities to its engineers. One of the features is the ability to run EXPLAIN ANALYZE queries against a connected database. This feature is accessible by a handful of engineers. The feature is vulnerable to a SQL injection that...
Showmax: Reflected XSS at https://stories.showmax.com/wp-content/themes/theme-internal_ss/blocks/ajax/a.php via `ss_country_filter` param
Summary: A Reflected XSS issue at https://stories.showmax.com/. Description: This issue was found at https://stories.showmax.com/wp-content/themes/theme-internalss/blocks/ajax/b.php page. But, as I understand the last part of pathname a.php can be different. For example b.php also working. Maybe ...
U.S. Dept Of Defense: springboot actuator is leaking internals at ██████████
Proof of Concept If you go to https://█████████/actuator you'll get a complete overview of all the endpoints that are accessable Suggestion: Use a Firefox Browser if possible, its json representation is well formed and the links are clickable ██████████ Impact Information Disclosure...
Omise: Secret API Key is logged in cleartext
Summary: While code-reviewing the repository , I have found that you log in clear-text some sensitive data. Steps To Reproduce: 1. Check here omise/request.pyL88 and here omise/request.pyL111 1. The code source explicitly logs in debugging mode the secret API key. logger.debug'Authorization: %s',...