U.S. Dept Of Defense: stored cross site scripting in https://███

It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. poc attached another parameter at 1636345 q21675 Impact Cookie Stealing - A malicious user can steal cookies and use them to gai...

U.S. Dept Of Defense: stored cross site scripting in https://█████████

It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. poc attached another parameter at 1636345 q21677 Impact Cookie Stealing - A malicious user can steal cookies and use them to gai...

Reddit: Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability

Summary: There's no check if the user is moderator of the particular subreddit or not while trying to access the mod logs via gql.reddit.com by using operation id. You can change the parameter subredditName to any target subreddit name which is public or restricted and get access to mod logs of...

U.S. Dept Of Defense: stored cross site scripting in https://███

It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. poc attached another parameter at 1636345 q21655 Impact Cookie Stealing - A malicious user can steal cookies and use them to gai...

U.S. Dept Of Defense: stored cross site scripting in https://██████████

It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. poc attached another parameter at 1636345 q21671= Impact Cookie Stealing - A malicious user can steal cookies and use them to ga...

U.S. Dept Of Defense: stored cross site scripting in https://███

It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. poc attached another parameter at 1636345 Impact Cookie Stealing - A malicious user can steal cookies and use them to gain acces...

U.S. Dept Of Defense: stored cross site scripting in https://███

It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. poc attached another parameter at 1636345 Year Group Military Only Impact Cookie Stealing - A malicious user can steal cookies a...

Adobe: Reflected Cross site scripting via Swagger UI

The security researcher responsibly disclosed a Reflected XSS to Adobe. We appreciate the collaboration and we're proceeding to include his name in our Acknowledgement page...

Ruby on Rails: Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style)

Intro The Rails HTML sanitzier allows to set certain combinations of tags in it's allow list that are not properly handled. Similar to the report 1530898, which identified the combinationselect and style as vulnerable, my fuzz testing from today suggests that also svg and style as well as math an...

Reddit: Reddit talk promotion offers don't expire, allowing users to accept them after being demoted

Description: When promoting a user to a speaker/host, an offerId is created which can be accepted by the user. However, after accepting them the offerIds don't expire. This means that after the user is demoted back to a listener, they can still use the offerIds to go back to their previous promot...

Acronis: Bypassing Recaptcha Protection in `https://connect.acronis.com`

The Recaptcha token was not properly validated in the registration process of the website https://connect.acronis.com. The same token could be reused to create multiple user accounts, bypassing the Recaptcha protection...

TikTok: Add products to any livestream.

An improper access control issue on a TikTok Shop endpoint could have resulted in arbitrary products being added to livestreams. We thank @datph4m for reporting this to our team...

Ruby on Rails: Incomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations)

While building a PoC for CVE-2022-32209, I noticed that I could not fix my vulnerable application by updating https://github.com/rails/rails-html-sanitizer from 1.4.2 to 1.4.3 even though the Hackerone report about this vulnerability suggested that this should fix it see here:...

GoCD: Open S3 Bucket Accessible by any Aws User

Description: It has been observed that the amazon s3 bucket which i believe belongs to GoCD as it contains data related to GoCD █████ documents and all is misconfigured as a result any unauthenticated users can access it without any restrictions Step-by-step Reproduction Instructions 1.Access...

Nintendo: [MK8DX] Improper verification of Competition creation allows to create "Official" competitions

. Introduction This vulnerability impacts: - Mario Kart 8 Deluxe on the Switch - Mario Kart 8 on the WiiU The vulnerability was fixed for Mario Kart 8 Deluxe the 7 December, 2022 with the release of v2.2 or v851968 for the internal version The vulnerability was fixed for Mario Kart 8 the 3 August...

Nextcloud: Exception logging in Sharepoint app reveals clear-text connection details

Summary: On Exceptions thrown in the context of the SharePoint app, connection credentials may be written to the Nextcloud log in clear text. Steps To Reproduce: Attempt to configure a sharepoint mount in an erroneous way. Supporting Material/References: was files publically:...

Shopify: Stored XSS in Dovetale by application of creator

Summary: Dovetale is an influencer platform from Shopify to manage and scale influencer marketing. The influencers can become an ambassador of the brand and are able to apply for it. If a malicious creator applies with XSS payloads inside the first name, last name, etc., the data is stored and...

Internet Bug Bounty: CVE-2022-21831: Possible code injection vulnerability in Rails / Active Storage

Original report: https://hackerone.com/reports/1154034 Rails advisory: https://discuss.rubyonrails.org/t/cve-2022-21831-possible-code-injection-vulnerability-in-rails-active-storage/80199 Blogpost:...

HackerOne: Private Email Address Leak of H1 Researchers.

...

MetaMask: Bypass parsing of transaction data, users on the phishing site will transfer/approve ERC20 tokens without being alerted

Vulnerability description not provided...

Internet Bug Bounty: Off-by-slash vulnerability in nodejs.org and iojs.org

Original Report: https://hackerone.com/reports/1631350 The reason for submitting this report is written in the comment of the original report. ---- Summary: Configuration files for Nginx in nodejs/build repository have multiple off-by-slash misconfigurations. Because nodejs.org and iojs.org are...

ownCloud: GitHub Security Lab (GHSL) Vulnerability Report: Insufficient path validation in ReceiveExternalFilesActivity.java (GHSL-2022-060)

The Owncloud Android app was found to have insufficient path validation in the ReceiveExternalFilesActivity activity, allowing attackers to read from and write to the application's internal storage. This could be exploited by uploading arbitrary files from the app's internal storage or by writing...

ownCloud: GitHub Security Lab (GHSL) Vulnerability Report: SQLInjection in FileContentProvider.kt (GHSL-2022-059)

Vulnerability description not provided...

Hyperledger: Corsa Site Scripting Vulnerability (XSS)

An XSS was found in Cactus, a project that is not part of the bounty program...

Uber: Golang expvar Information Disclosure

Package expvar provides a standardized interface to public variables, such as stack trace information and operation counters in servers...

Internet Bug Bounty: Disabling context isolation, nodeIntegrationInSubFrames using an unauthorised frame.

Details can be found in the following github advisory: https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7 Impact Using a renderer exploit, context isolation and nodeIntegrationInSubFrames can be disabled, which enables an attacker to leak IPC module and communicate with...

TikTok: Stored XSS Via Ads Account Name

Vulnerability description not provided...

Invision Power Services, Inc.: support.invisionpower.com takeover the subdomain with Zendesk

The subdomain at https://support.invisionpower.com has an unclaimed CNAME record ipscommunity.zendesk.com . I checked the username availability in the signup process at Zendesk, it was observed that the subdomain is vulnerable to a subdomain takeover which allows an attacker could exploit such a...

Showmax: delete the subaccount from the user id

Entry in order to delete this sub-profile, you must first create an account. then you need to find the user id and master id of the account that you will delete, you can do a brute force attempt to find it, if it holds, you can delete the child profile of this person or view a lot of information...

MTN Group: Reflected xss on videostore.mtnonline.com

Summary: Hi, I found reflected xss vuln on videostore.mtnonline.com Steps To Reproduce: 1. Open browser 2. Go to...

EXNESS: IDOR in Stats API Endpoint Allows Viewing Equity or Net Profit of Any MT Account

Hi Team, Today I logged into my Exness PA and noticed an updated performance page. I thought to give it a quick check and noticed that the API endpoints responsible for fetching the stats performance chart /stats/ is vulnerable to IDOR via accounts= parameter. The issue allows fetching the stats ...

Linktree: No validation to Image upload user can upload ( php APK zip files and can be used as storage purpose)

No validation to Image upload user can upload...

GitLab: Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net

NOTE! Thanks for submitting a report! Please note that initial triage is handled by HackerOne staff. They are identified with a HackerOne triage badge and will escalate to the GitLab team any. Please replace all the parenthesized sections below with the pertinent details. Remember, the more detai...

8x8: LFI via Jolokia at https://█.█.█.█:1293

@shuvam321 reported to us a single exposed host in the acceptance environment. The report demonstrated a Local File Inclusion via Jolokia, e.g.: https://█.█.█.█:1293/actuator/jolokia/exec/com.sun.management:type=DiagnosticCommand/compilerDirectivesAdd/!/etc!/hostname No sensitive information has...

GlassWire: Facebook App API credentials leaked in the APK

Facebook App API credentials were leaked in the GlassWire version 1,1,26,0b F1827380 APK file, including the App ID and App Secret. This could allow an attacker to modify Facebook App settings using the leaked token...

U.S. Dept Of Defense: Directory Traversal at █████

Hi DoD! I found directory traversal vulnerability at ████. I didn't find available title for this issue that's why I selected remote file inclusion. Host: ██████ Vulnerability: Directory Traversal in Windows Server Tool Used: BurpSuite Parameter: ==path== HTTP GET Request ==GET...

Nextcloud: Last video frame is still sent after video is disabled in a call

Summary: When a participant is in a call and that participant disables the video rather than a black frame the last frame of the video will be sent. Similarly, if the video is disabled before joining the call the last frame of the video before joining the call will be sent. The video is not...

LY Corporation: Stored XSS Via Filename On https://partners.line.me/

An XSS vulnerability was found on the file upload feature of "partners.line.me". Attackers could upload a file with an XSS payload in the filename, which was not properly escaped by the server. This allowed for DOM-based XSS to be embedded in HTML. The uploaded files were stored for a limited tim...

Glassdoor: [CRITICAL] Full account takeover without user interaction on sign with Apple flow

An account takeover was detected with our sign-up with Apple flow where an email parameter was manipulated in the request flow to our servers. This scenario can only be performed on a previously unlinked apple ID account with Glassdoor. Changing the email in the request flow allowed the researche...

Slack: Hashed data exposure via WebSockets to Workspace Members

A vulnerability in Slack's system allowed for the exposure of members' email addresses and sensitive data through WebSockets. This occurred when users created or revoked a Shared Invite Link for their workspace, resulting in the transmission of hashed passwords to other workspace members. The iss...

Hyperledger: Insecure TLS Configuration #3530

An insecure configuration was reported; however, this configuration is set on purpose in test code. Please see the resolved conversation on GitHub...

U.S. Dept Of Defense: Local File Inclusion in download.php

The local file inclusion vulnerability was discovered in the download.php file. Arbitrary files could be downloaded by an attacker using directory traversal via the filePathDownload parameter, provided the attacker knew a valid file path of an externally-facing document...

Planet Labs: Api data leak

A security vulnerability was identified where sensitive API keys were exposed through archived data accessible via the Wayback Machine. Some of these API keys were found to be valid...

Hyperledger: fix(cmd-socketio-server): mitigate cross site scripting attack #2068

Please refer this fix and approve Bounty. See this In Github Security Fix @ryjones https://github.com/hyperledger/cactus/pull/2068issuecomment-1186157206 Impact fixcmd-socketio-server: mitigate cross site scripting attack...

MTN Group: String length restriction byepass at https://callerfeel.mtnonline.com/profile/feedback.html

Summary: Hi, hope you are well : I found that the attacker can bye pass the lenght restriction of user name at the feedback form Steps To Reproduce: F1823237 Impact Attacker can make the receiver page to delay and can cause application level dos Mitigation: Restrict the lenght of the string in...

Stripe: CSRF in Importing CSV files [app.taxjar.com]

A CSRF vulnerability was found in the CSV import feature of app.taxjar.com, allowing an attacker to import transactions into a user's account without their permission. The vulnerability was due to a lack of CSRF protection in the import process...

GitHub: Command injection in GitHub Actions ContainerStepHost

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands wa...

GitLab: Found Origin IP's lead to access to gitlab

@m-narayanan disclosed a known Origin IP / CloudFlare bypass issue, remediation for which was and is being tracked at https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/9945 The requested disclosure, then later requested it to be made private again...

8x8: Open Redirect ███.8x8.com

@mrk0anti reported to us an Open Redirect vulnerability utilising a misconfiguration which allowed https://█.█.█.█/.example.com to be redirected ➡️ https://www.8x8.com.example.com The issue has been swiftly rectified...

Internet Bug Bounty: Node.js - DLL Hijacking on Windows

Full Node.js Security Releases - summarizing the issue is here:https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/ The original Node.js HackerOne report is here: https://hackerone.com/bugs?reportid=1447455 ----- Node.js versions earlier than 16.16.0 LTS and 14.20.0 are vulnerabl...