15273 matches found
Mattermost: Reflected XSS in OAuth complete endpoints
Reflected XSS vulnerabilities were discovered in several OAuth complete endpoints in Mattermost. These endpoints failed to sanitize the "redirectto" field in the "state" query parameter, allowing an attacker to execute malicious JavaScript code in the context of the user's browser. This could lea...
Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding
Summary: The llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS. Description: When Node receives the following request: http GET / HTTP/1.1 Transfer-Encoding: chunked , identity 1 a 0 it...
HackerOne: An attacker can archive and unarchive any structured scope object on HackerOne
Summary: Hello, I have discovered an IDOR vulnerability that allows the scope of any program to be archived. Scopes are used to give information about the valid scopes of a program. For example HackerOne has the following scopes: https://hackerone.com https://api.hackerone.com ... Steps To...
TikTok: One Click Account Hijacking via Unvalidated Deeplink
A WebView Hijacking vulnerability was found on the TikTok Android application via an un-validated deeplink on an un-sanitized parameter. This could have resulted in account hijacking through a JavaScript interface. We thank @fr4via for reporting this to our team...
8x8 Bounty: connect.8x8.com: Users with no permission can track/access restricted details/data via GET /api/v2/support/requests/<ticket number >HTTP/2
Vulnerability description not provided...
TikTok: View thumbnail of any private video (friends or followers only) of Private/Public account
Vulnerability description not provided...
GitHub: CSRF protection bypass in GitHub Enterprise management console
A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentially lead to privilege escalation. To exploit this vulnerability, an attacker would need to target a user that was actively logged into the...
MTN Group: cross site scripting reflected
The vulnerability was a cross-site scripting XSS flaw that allowed arbitrary JavaScript to be executed on the target website. The payload '-alert1-' was reflected in the website's output, demonstrating the presence of the vulnerability...
Uber: Uber Test Report 20220301
Test summary from Team Uber. This is the summary from secret John. This is the edit from hacker John after disclosure was approved. Second test after disclosure...
GitHub Security Lab: [Java]: Timing attacks while comparing the headers value
This bug was reported directly to GitHub Security Lab...
Alohi: Waitlist bypass for accessing SIGN.PLUS Beta
During SIGN.PLUS beta phase, it was found out that hackers could trick the API response and pretend to have been accepted into the beta program. All server operations would be blocked, but the UI client would be accessible, exposing the work-in-progress design to non-beta users. There was no...
Stripe: CSRF token validation system is disabled on Stripe Dashboard
@rodolfomarianocy discovered that due to a code change deployed on 2/14/2022, Cross Site Request Forgery CSRF protection was disabled in the Stripe Dashboard. This could have allowed an attacker to trick a victim user to visit a malicious website and cause limited changes to the victim’s Stripe...
U.S. Dept Of Defense: Broken access control, can lead to legitimate user data loss
Hi team, During testing the security of ██████████ I found another possible attack vector: There are two reports preceding this one - https://hackerone.com/reports/1489470 and https://hackerone.com/reports/1489744 I will try to explain: When an user need access to that information system he fills...
Internet Bug Bounty: CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGs
In Apache Airflow, prior to version 2.2.4, In DAG script of airflow , there is two command injection vulnerability RCE in the some scripts, which an attacker can execute arbitrary commands on the system. The impact is even greater when airflow is configured for unauthenticated access. These two...
IBM: Public Jenkins instance with /script enabled
An RCE/LFI due to Public Jenkins instance with /script enabled was reported to IBM February 26th, analyzed and has been remediated since March 3rd, 2022. Thank you to Sanjok Karki thesanjok for the finding. RCE/LFI due to Public Jenkins instance with /script enabled...
HackerOne: Private invitation links/tokens leak to third-party analytics site
Summary: Private invite links are normally FILTERED before sending to third-party analytics sites. But it is seen that in few cases where the invitation link that requires users to accept NDA policy, the private invitation links are still sent to third party analytics site. Steps to reproduce 1...
UPS VDP: Admin Authentication Bypass Lead to Admin Account Takeover
Hello Team I found that i can bypass the login page of the Admin account by intercepting the respone of the login request of connectnb.ups.com subdomain and change status from false to true Steps To Reproduce: 1. Open https://connectnb.ups.com/Layout/login 2. Enter Admin as a Username and 1111 as...
GitHub Security Lab: Python: CWE-338 insecureRandomness
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Java : Add query to detect Server Side Template Injection (SSTI)
This bug was reported directly to GitHub Security Lab...
TikTok: HTML Injection via Email Share
A HTML injection was found on a TikTok endpoint via the "nameofowner" parameter. We thank @lu3ky-13 for reporting this to our team...
U.S. Dept Of Defense: Military name,email,phone,address,certdata Disclosure
A DoD public facing asset Military was misconfigured and disclosed name, email ,phone address , and certdata of users...
UPchieve: All user password hash can be seen from admin panel
Summary: During my primary research I found that api/users?page=1&userId=&firstName=test&lastName=&email=&partnerOrg=&highSchool= this endpoint gives hashed password of all users. Steps To Reproduce: + Login to Admin and go to Admin-- Search Users. + We see a request like this was send and in...
U.S. Dept Of Defense: SQL Injection in █████
References Impact By using SQL injection, an attacker can exfiltrate the whole database, and gain RCE System Hosts ████ Affected Products and Versions ████ CVE Numbers Steps to Reproduce POC 1 - curl command injecting query, returning database version: curl https://█████████ -X POST...
U.S. Dept Of Defense: Authorization bypass -> IDOR -> PII Leakage
Hi team! During testing ████ I found javascript file containing administrative panel functionality. It is accessible at: https://████/█████████ In this file I found an end point responsible for returning data about applications of the website users to the website administrators. The returned data...
Ruby on Rails: ReDoS in Rack::Multipart
A regular expression denial of service ReDoS vulnerability was discovered in the Rack gem's Multipart module. This vulnerability allowed an attacker to cause a denial of service by sending a specially crafted header, resulting in excessive CPU usage on the server. The vulnerability has been patch...
Shopify: Bypass of fix #1370749
Hello team, on report 1370749 the reporter found that the preview link is not expiring. So when someone will gain access to the preview link, he can access it for whole life as the preview link remains the same even after changing the storefont password. I have reported the issue 1401525 where i ...
Ruby: ReDoS in Psych
The Psych library in Ruby was found to have a ReDoS Regular Expression Denial of Service vulnerability in the parsing of time strings. The vulnerability was identified in the regular expression used to extract date and time information from the input string. The regular expression was susceptible...
Twitter: Delete direct message history without access the proper conversation_id
Hello Team i found a bug in your system this bug already fixed as i know,but i try this another way, and its worked, this is why i report it the bug is i was able to delete message history without access the proper conversation id user 1 id: 1234 user 2 id: 5678 their conversation look like...
Sifchain: Subdomain Takeover on proxies.sifchain.finance pointing to vercel
Hello Team, Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that subdomain...
Mattermost: Invitation Email is resent as a Reminder after invalidating pending email invites
An issue was found in Mattermost's workspace invite system that allowed unwanted users to join a workspace, leading to potential information disclosure. The vulnerability was caused by the lack of an option to cancel an invite, which could be exploited by an attacker to join a workspace even if t...
8x8: subdomain takeover (abandoned Zendesk █.easycontactnow.com)
@bx1 reported to us an issue with a CNAME record which pointed to a subdomain outside of 8x8's control - to an abandoned Zendesk instance. We've deleted the DNS record and rectified the issue...
HackerOne: [Bypass] Ability to invite a new member in sandbox Organization
Summary: Able to bypass the restriction set in Organization sandbox automatically created when you created sandbox program to send an invite to another security researcher. Description: In the default UI of sandboxHackerone Organization, inviting another security researcher is restricted ex.:...
Acronis: Session Fixation on Acronis
Hi there, The application does not set a new Session ID in the cookie after what appears to be an authentication attempt by the user. If this was a successful login and the Session IDs are stored in cookies then this application is affected by Session Fixation vulnerability. Steps To Reproduce...
lemlist: Security misconfiguration
Description : When we request a magic link to login into the application, and use that same link in multiple browsers, it working there isn't any limit on use of link. Steps to reproduce : 1. go to app.lemilist.com 2. create a magic link 3. use it to login 4. now open another browser or incognito...
8x8 Bounty: admin.8x8.vc: Member users with no permission can integrate email to connect calendar via GET /meet-external/spot-roomkeeper/v1/calendar/auth/init?..
An improper access control vulnerability was discovered on the admin section of 8x8's video conferencing platform. Member users with no permission were able to exploit this vulnerability to integrate their email and connect their calendar to the platform. This allowed them to access areas they we...
Basecamp: Improper Authentication via previous backup code login
HI Basecamp, I would like to report Improper Authentication in basecamp. Attacker is able to login at victim account once victim update his password. attacker knows with victims email █████████ password uhn123HH victim updates his password uhn123HHjcc Step To Reproduce ==Attacker== - Step1 attack...
Ruby: ReDoS in IPAddr
The Ruby IPAddr library was found to be vulnerable to a ReDoS Regular Expression Denial of Service vulnerability. The vulnerability was identified in the mask! method, which used a regular expression that was susceptible to exponential backtracking when processing malformed input. This could have...
Ruby: ReDoS in Time.rfc2822
A regular expression denial of service ReDoS vulnerability was discovered in the Time.rfc2822 method in Ruby's time library. An attacker could exploit this vulnerability by providing a specially crafted input to the method, causing it to enter an infinite loop and consume excessive CPU resources...
Kubernetes: File Read Vulnerability allows Attackers to Compromise S3 buckets using Prow
A vulnerability was found in AWS Prow that allowed attackers to sign the base path of S3 buckets used by Prow, leading to the dumping of the entire private bucket details and reading any file in the bucket. This could result in the compromise of S3 buckets containing production data...
curl: Use of Unsafe function || Strcpy
Summary: It was observed that application is using strcpy function which may cause buffer overflow attacks. Affected Code https://github.com/curl/curl Affected Lines 1. Line 195 of curl-master\tests\libtest\stubgssapi.c 2. Line 204,212,216 curl-master\tests\server\socksd.c Steps To Reproduce: Let...
TikTok: Information Leakage via TikTok Ads Web Cache Deception
A theoretical web cache deception vulnerability was found on TikTok Ads, that could have resulted in information leakage if clicked on by an authenticated user. We thank @arifmkhls for reporting this to our team and confirming its resolution...
Automattic: De-anonymize anonymous tips through the Tumblr blog network
Hey y’all! 👋 Hope all is well! Summary: I noticed that, if you send an anonymous tip through the Tumblr dashboard, you can be de-anonymized through the notes view on the blog network & maybe elsewhere?. Platforms Affected: All platforms, but requires a blog that is served on the blog network. Ste...
GitHub Security Lab: [C#] CWE-759: Query to detect password hash without a salt
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CPP: Add query for CWE-266 Incorrect Privilege Assignment
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Java]: CWE-073 - File path injection with the JFinal framework
This bug was reported directly to GitHub Security Lab...
Stripe: CSRF token validation system is disabled on Stripe Dashboard
@dsharad discovered that due to a code change deployed on 2/14/2022, Cross Site Request Forgery CSRF protection was disabled in the Stripe Dashboard. This could have allowed an attacker to trick a victim user to visit a malicious website and cause limited changes to the victim’s Stripe account su...
U.S. General Services Administration: Account takeover leading to PII chained with stored XSS
I have found a vulnerability on https://vehiclestdb.fas.gsa.gov/ for account takeovers The website is not using proper authentication to claim the user signing in is actually the account owner due to only requiring an email address to sign in and no password. This leads to an attacker being able ...
Alohi: Misconfigured rate limit for SMS phone verification endpoint
One of our rate-limit configurations had a high threshold, allowing attackers to spam request multiple SMS codes by replicating the network request to a phone number before getting blocked...
MTN Group: Insecure Storage of Sensitive Information on lonestarcell.com server
Hello , i hope your doing well i found some sensitive information disclosure at those endpoint it is disclosure server status and some other stuff https://simregistration.lonestarcell.com//monitoring/DB02/DB02.htmlSystem https://simregistration.lonestarcell.com//monitoring/DB01/index.html...
SecurityScorecard: HTML injection through Invite Teammate email
Summary: I found HTML injection on domain https://platform.securityscorecard.io/ when we send invite teammate email. In this case "message" parameter is vulnerable. Steps To Reproduce: 1. Go to page https://platform.securityscorecard.io/ and login. 2. Now go to page...