PortSwigger Web Security: Redirection in Repeater & Intruder Tab

This was a bug in Repeater/Intruder whereby a meta redirect would be followed when a user clicked the follow redirection button regardless of the content type or content disposition headers used on the target web site. This could disclose the referrer header. It was considered a low severity issu...

Nintendo: [WiiU/Switch] Remote code execution inside the ENL library

Vulnerability description not provided...

HackerOne: Race condition in joining CTF group

Summary: A race condition in https://ctf.hacker101.com/group/join allows a user to join the same CTF group multiple times. The user will show up in the group member list multiple times, and affect the group statistics. Description: Interestingly a race condition in this feature was reported in...

Nintendo: [WiiU/Switch] nullptr dereference in the ENL framework

Vulnerability description not provided...

Uber: Full read SSRF in flyte-poc-us-east4.uberinternal.com

Uber summary TBD. @shubs and I discovered an instance of Flyte Console on uberinternal.com. After auditing the open source code, we noticed an unauthenticated route for a “CORS proxy”. This was a classic server-side request forgery issue, allowing us to pass an arbitrary request to be performed b...

EXNESS: subdomain takeover at odoo-staging.exness.io

Domain: https://odoo-staging.exness.io PoC https://odoo-staging.exness.io Cname: $ host odoo-staging.exness.io odoo-staging.exness.io is an alias for exness-stg.odoo.com. exness-stg.odoo.com has address 141.95.172.222 exness-stg.odoo.com mail is handled by 10 eu123a.odoo.com. Impact Scam, phishin...

UPS VDP: Broken access control

Summary: hello ups team ,,, I've found broken access control vulnerability in your sites It allows me to access the admin panel of the support team, and I can view all requests within the site vulnerable domains:connectnb.ups.com Steps To Reproduce: add details for how we can reproduce the issue ...

Omise: IDOR Payments Status

Summary: Found in the payment status function, IDOR's weakness. Where when doing the experiment managed to see the payment status of another account The following is the POC of the experiments carried out. Steps To Reproduce: 1.GET /payments/paymtestxxxx/status HTTP/2 Host: api.omise.co Sec-Ch-Ua...

LinkedIn: [ADMIN FEATURE ACCESS] Knowing The Competitors analytics of any company

Vulnerability description not provided...

Reddit: Regular Expression Denial of Service vulnerability

Summary: The vulnerability I have found is classified as a Regular Expression Denial of Service. While inspecting the source code file RealtimeGQLSubscriptionAsync.js I came across the nodemodule subscriptions-transport-ws See Screenshot 1. The search result of the subscriptions-transport-ws...

GitHub Security Lab: [Python]: Add Server-side Request Forgery sinks

This bug was reported directly to GitHub Security Lab...

Radancy: Blind SSRF at packagist.maximum.nl

Hello Team, I found a subdomain vulnerable to header blind SSRF: packagist.maximum.nl Steps to Reproduce 1 - Go to https://packagist.maximum.nl/ and intercept it. 2 - Send a GET request adding the parameter X-Forwarded-For and adding a header X-Forwarded-For, the value the header is your Burp...

Acronis: Read-only administrator can change agent update settings

Hello Gents, + While testing eu2-cloud.acronis.com I found that read-only administrators are able to update agents just by editing the HTML! Steps to reproduce: 1. Please login at https://eu2-cloud.acronis.com/mc/ 2. From Users, invite a new user with Read-only administrator role. 3. From Read-on...

U.S. Dept Of Defense: ███ vulnerable to CVE-2022-22954

I found that one of the targets belongs to DOD vulnerable to CVE-2022-22954 where an attacker may be able to execute any malicious code like escalating Remote code execution is also possible Technical Summary: CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspac...

U.S. Dept Of Defense: ██████████ vulnerable to CVE-2022-22954

I found that one of the targets belongs to DOD vulnerable to CVE-2022-22954 where an attacker may be able to execute any malicious code like escalating Remote code execution is also possible Technical Summary: CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspac...

Automattic: XSS and HTML Injection on the pressable.com search box

Summary: Hi, I have found that search box on pressable.com is vulnerable for XSS attack and HTML Injection . Steps To Reproduce: 1. Visit https://pressable.com/knowledgebase/ 2. Put the payload on the search box. XSS Payload: " HTML Injection Payload: Visit Our New WebSite e x a m p l e . c o m...

MTN Group: Unprotected Direct Object Reference

Hello MTN Security Team, During my hunting, I discovered that there's an Insecure Direct Object Reference on https://nin.mtnonline.com Vulnerable Path: https://nin.mtnonline.com/nin/success?message=1 Steps To Reproduce: You may not even require to submit any NIN before accessing this unprotected...

Acronis: Self XSS in attachments name

Hello Gents, + While testing account.acronis.com I found that I could inject XSS payload in attachments name at "Support requests" . Steps to Reproduce: 1. Please Login at account.acronis.com. 2. From support request, support a new case. 3. Expand Case ID, Leave a comment for support professional...

Acronis: HTML Injection in E-mail

Hello Gents, + While testing "account.acronis.com", I found that "first name" could be injected with HTML tags while sending an email invitation. But this attack requires user interaction to confirm the email first, then he/she will receive a welcome email "Welcome to your Acronis Cyber Protect...

UPS VDP: Reflected XSS on https://wwwapps.ups.com/ctc/request?loc=

Summary: ========= Detalis XSS ----------- Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a...

SMTP2GO BBP: Origin IP found, WAF Cloudflare Bypass

Description: I have discovered that the http://172.105.190.180/login/ site exposed it's IP which could allow bypassing of anti-DDoS mechanisms i.e you are using Cloudflare for protection. For Originate IP address which I found from https://search.censys.io/ By using these IP address as a resolver...

U.S. Dept Of Defense: Reflected XSS via `████████` parameter

Hello everyone, I came across a page that allows users to subscribe to certain forum posts at https://███ I noticed that the ████ parameter is reflected in the Page without filtering dangerous characters such as except the = character which is filtered by default, but this can be circumvented by...

TikTok: Stored XSS Payload when sending videos

A Cross-Site Scripting XSS payload was found via the text used when sending videos to a friend, which could have resulted in session hijacking, user impersonation, or client-side attacks. We thank aidilarf2000 for reporting this to our team. Don't forget Vacation and Have Fun.. Write up :...

RubyGems: Possibility to guess email address from gravatar image URL

The vulnerability allowed an attacker to potentially guess a user's email address by exploiting the use of a simple MD5 hash in the Gravatar implementation on rubygems.org. This could be done by matching the hash in the Gravatar URL with the generated hash from the email address. The impact of th...

Flickr: Stored XSS in photos_user_map.gne

The Flickr map page was inadequately escaping the name of groups when browsing the map of a group's photos...

GitLab: Content injection in Jira issue title enabling sending arbitrary POST request as victim

Summary The issue described here leads to the same outcome as my previous report, https://hackerone.com/reports/1409788 . So look into that one for further details on the JavaScript gadgets. Also see my report https://hackerone.com/reports/1481207 for a detailed rundown of injections in GitLab...

Lark Technologies: Ability to View Non-Permitted Admin Log

An access control issue was found where a user without proper permissions would be able to view the admin log. We thank @imrannisar for reporting this to our team...

Omise: Cross-site scripting on dashboard2.omise.co

Summary: Cross-site scripting XSS is an attack vector that injects malicious code into a vulnerable web application. Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Steps To...

GitLab: ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year

Summary A Gitlab webhook may be pointed at a malicious webhook receiver. The webhook receiver can respond with a specially crafted long header. Gitlab processes the header with Ruby's net/http where there is a regular expression operation with quadratic complexity ReDoS. This causes the webhook...

TikTok: CSRF in Changing User Verification Email

A Cross-Site Request Forgery CSRF was found on a TikTok Ads endpoint, which could have resulted in a malicious user adding a new user verification email address. We thank @fm for reporting this to our team...

Kraden: Found Origin IP's Lead To Access To kraden.com

Summary: Discovered that the kraden.com site exposed its Non-Cloudflare IP which could allow bypassing of anti-DDoS mechanisms. Description:Your origin servers are not blocking access from non-Cloudflare servers. This way crawlers can find your origin servers' IPs by checking random IPs until the...

Ruby on Rails: Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag

It seems to be a problem caused by a difference between the nokogiri java implementation and the ruby implementation. It seems to be an ambiguous case as to whether to do it with nokogiri or have rails-html-sanitizer defend it. jruby9.3.3.0 nokogiri java, use...

U.S. Dept Of Defense: CORS Misconfiguration

Vulnerable Url: www.█████████ Summary: Cross-origin resource sharing CORS is a browser mechanism that enables controlled access to resources located outside of a given domain. However, it also provides a potential for cross-domain-based attacks, if a website's CORS policy is poorly configured and...

MTN Group: Open redirection at https://smartreports.mtncameroon.net

Summary: Hello, I found open redirection on https://smartreports.mtncameroon.net Steps To Reproduce: 1. Go to https://smartreports.mtncameroon.net//example.com/..;/css 2. Redirection to example.com Impact Open redirection vulnerability can redirect users to malicious sites that harm users...

Algolia: Web Cache Deception vulnerability on algolia.com leads to personal information leakage

A web cache deception vulnerability was discovered on algolia.com, which could allow an attacker to trick a caching proxy into storing private information transmitted over the internet from an authenticated user. The attacker could then access the cached data, which may include personal and...

Aiven Ltd: Kafka Connect RCE via connector SASL JAAS JndiLoginModule configuration

Summary: When configuring the connector via the Aiven API or the Kafka Connect REST API, the attacker can set the database.history.producer.sasl.jaas.config connector property for the io.debezium.connector.mysql.MySqlConnector connector. This is likely true for other debezium connectors too. By...

Stripe: Bypass global deny-lists by wrapping domains using "[]" in https://github.com/stripe/smokescreen

The Smokescreen proxy is an open source project written and maintained by Stripe to restrict the URLs that internal services can connect to. The primary use case for Smokescreen is to prevent server-side request forgery SSRF attacks in which external attackers leverage the behavior of our...

TikTok: IDOR on TikTok Ads Endpoint

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok Ads endpoint, which could have resulted in an unauthorized user adding products into another user's catalogue. We thank @sinayeganeh for reporting this to our team...

Vanilla: CORS Misconfiguration on vanillaforums.com

Summary: An cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy is fine-grained and can apply access controls per-request based on the URL and other features of th...

Imgur: 8ybhy85kld9zp9xf84x6.imgur.com Subdomain Takeover

Hello Gents, + While testing Imgur I found an unclaimed subdomain which is; “8ybhy85kld9zp9xf84x6.imgur.com”, and I was able to claim it! + But actually I didn't upload or host a simple file like mrbaka.html, because I need to upgrade the account to be able to use this custom domain! + Anyway, yo...

IBM: SQL injection in URL path processing on www.ibm.com

A blind SQL injection in URL path processing on www.ibm.com was reported to IBM, analyzed and has been remediated. Thank you to @asterite. Blind SQL injection was present in URL path processing on www.ibm.com. An interesting thing is that the vulnerability was present in, essentially, any path, o...

GitHub Security Lab: [Java]: CWE-200 - Query to detect insecure WebResourceResponse implementation

This bug was reported directly to GitHub Security Lab...

curl: CVE-2022-22576: OAUTH2 bearer bypass in connection re-use

Summary: A cached connection authenticated with the OAUTH2 mechanisms can be reused by a subsequent request even if the bearer is not correct. This affects SASL-enabled protcols: SMPTPS, IMAPS, POP3S and LDAPS openldap only. An application that can be accessed by more than one user such as a...

Palantir Public: Github Account Takeover which is used as gradle vcs in "github.com/palantir/gradle-launch-config-plugin"

Github Account Takeover which is used as gradle vcs in "github.com/palantir/gradle-launch-config-plugin"...

Cloudflare Public Bug Bounty: A malicious actor could rotate tokens of a victim, given that he knows the victim's token ID

API tokens of Cloudflare users were vulnerable to unauthorized rotation by malicious actors who knew the victim's token ID due to lack of proper authorization checks. This could lead to DoS for the token owner and the applications that use it. The vulnerability was fixed by enforcing proper acces...

Palantir Public: SQL Injection at https://files.palantir.com/ due to CVE-2021-38159

A vulnerability was discovered in an Internet-facing asset files.palantir.com. A proof of concept POC was developed and used to validate the finding. The vulnerability was patched and resolved. Blog about this vulnerability published. You can read full detail here:...

Node.js: HTTP Request Smuggling Due To Improper Delimiting of Header Fields

Summary: The llhttp parser in the http module in Node v17.8.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. Description: The LF character without CR is sufficient to delimit HTTP header fields in the lihttp parser. According to...

Node.js: HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding

Summary: The llhttp parser in the http module in Node v17.8.0 does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS. Description: After 1501679, I did a bit more digging into the issue, and found that there were more flaws in the parsing of...

Consensys: Public Postman Api Collection Leaks Internal access to https://assets-paris-dev.codefi.network/

The researcher identified a public workspace at https://www.postman.com/3zL77NHP5yLSKc/workspace/codefi-assets-s-public-workspace/environment/19650166-866da684-1c98-492c-a9e9-6ed287c28746 containing working credentials for asset assets-paris-demo.codefi.network. We would like to thank @polem4rch...

Zomato: Attacker shall recieve order updates on whatsapp for users who have activated whatsapp notification

H Summary: 1. Order ID are IDOR Insecure Direct Object Reference 2. When users activated whats app notification an attacker would start receiving the notification without user interaction about their order. Proof Of Concept:- When an user order on a restaurant he/she can start whatsapp notificati...