Node.js: Insecure loading of ICU data through ICU_DATA environment variable

Insecure loading of ICU data through the ICUDATA environment variable allowed for potential exploitation, as ICU still honored the variable regardless of privilege level. The impact was likely limited, but it was suggested to build ICU with ICUNOUSERDATAOVERRIDE defined and sanitize the environme...

Cloudflare Public Bug Bounty: Misconfigured build on websites "abuse.cloudflare.com"

Due to a misconfiguration, a malicious actor could see all the backend code on the abuse.cloudflare.com page. The engineering team removed the misconfiguration and the information is no longer available...

U.S. Dept Of Defense: Local File Read vulnerability on ██████████ [HtUS]

Kindly check screenshot ███████: In case if scope question. Because i picked this site from DOD website list under 'dod sites'. Lets move on to the bug now : Summary: Local File Include vulnerability on ███. Oracle Ebs Bispgrapgh is prone to a directory traversal vulnerability that can be exploit...

U.S. Dept Of Defense: CSRF to ATO at https://█████/user/account [HtUS]

hello dod security team today while i was doing pentest on your scope i came across https://████████/user/account so i register and after that tried to edit my data and the data was in json request so i simple change content-type to content-type application/x-www-form-urlencoded and the data was...

U.S. Dept Of Defense: Broken access discloses users and PII at https://███████ [HtUS]

Good morning, I was able to register at https://████/ and get the list of users. 1- Go to https://██████████/OAHTML/ibeCAcpSSOReg.jsp and register. 2- Go to https://███/OAHTML/AppsLocalLogin.jsp with the created user and login. 3- On the homepage, click on vacations rules, create, and search user...

U.S. Dept Of Defense: [████████] RXSS via "CurrentFolder" parameter

A reflected cross-site scripting vulnerability was found on a website that allowed malicious scripts to be injected via the CurrentFolder parameter...

U.S. Dept Of Defense: [███████] Remote Code Execution at ██████ [CVE-2021-44529] [HtUS]

IP Address used to find vulnerability: ██████ Vulnerable Website URL or Application: https://████ pomcldsvr2.████ Proof of ownership: ███ Summary: The server at https://███ is running a vulnerable version of CSA. A code injection vulnerability in the Ivanti EPM Cloud Services Appliance CSA allows...

U.S. Dept Of Defense: .git folder exposed [HtUS]

Heyy there, I have found a exposed .git folder on https://█████ https://████████/.git/config core repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true remote "origin" url = https://████ fetch = +refs/heads/:refs/remotes/origin/ Using gitdumper...

U.S. Dept Of Defense: insecure gitlab repositories at ████████ [HtUS]

If you click the link https://███, you're redirected to https://██████/users/signin, where credentials have to be inserted. The repositories are private and shouldn't be accessable for unauthenticated users! POC If you click the following links https://████/api/v4/projects, information about...

U.S. Dept Of Defense: SSRF to read AWS metaData at https://█████/ [HtUS]

Hello Team, While researching your program I found that the domain https://████/ is vulnerable to Server Side Request Frogery Attacks via the url parameter. An attacker is able to fetch the aws metadata abusing the SSRF at https://████████/...

U.S. Dept Of Defense: LOGJ4 VUlnerability [HtUS]

Description: Hi team, log4 shell is recent 0-day exploit it's Java package vulnerable. █████ is vulnerable Impact RCE System Hosts ██████ Affected Products and Versions CVE Numbers CVE-2021-44228 Steps to Reproduce 1. Go to this url =...

U.S. Dept Of Defense: SSRF ACCESS AWS METADATA - █████

Hi Security Team, Based on https://hackerone.com/hack-us-h1c challenge, I have urgent vulnerability and the challenge doesn't accept reprots for now 1:56 AM . I have found a SSRF Vulnerability which allow access to the AWS metadata, using Parameter ?url= as shown blew An attacker can tunnel into...

Enjin: Host header injection leads to account takeover

Vulnerability description not provided...

Node.js: Node 18 reads openssl.cnf from /home/iojs/build/... upon startup.

A vulnerability was discovered in Node.js 18.4.0 where it attempted to read an openssl.cnf file from a specific location upon startup. This could potentially allow an attacker with a self-chosen username to affect the OpenSSF configuration of other users on a shared Linux host...

Top Echelon Software: xmlrpc.php FILE IS enable it will used for Bruteforce attack and Denial of Service(DoS)

xmlrpc.php was enabled even though we did not make use of any of its functionality - it is now disabled...

8x8: Public Apache Tomcat /examples example directory

@mrk0anti reported to us an exposed Apache Tomcat /examples example directory. The issue has been rectified, as we removed the directory from the host & restricted access...

HackerOne: June 2022 Incident Report

Intro Since the founding of HackerOne, we have kept a steadfast commitment to disclosing security incidents because we believe that sharing security information far and wide is essential to building a safer internet. HackerOne's culture is to disclose more often, and in more detail than the rest ...

Stripo Inc: [SSRF] my.stripo.email via the setup-wizard parameter

A vulnerability in the setup wizard allowed SSRF. The issue has been resolved...

Glassdoor: Web Cache Poisoning leads to XSS and DoS

@nokline and @bombon were able to utilize URL parser confusion in combination with reflected XSS under https://glassdoor.com/Job/ and https://glassdoor.com/mz-survey/interview/collectQuestionsinput.htm/ by caching XSS payloads via cookie and header params into a stored XSS for URLs /Award/ and...

Kubernetes: RCE on ingress-nginx-controller via Ingress spec.rules.http.paths.path field

A vulnerability was exploited that allowed arbitrary files to be written and executed on the ingress-nginx-controller pod through the manipulation of Ingress resource specifications. By configuring log formats and locations, malicious configurations could gain remote code execution capabilities o...

U.S. Dept Of Defense: Stored XSS at https://█████

Description: In registeration page https://████ , first name and last name field are vulnerable to Stored Cross Site Scripting. Proof of concept For the fastly test, use this credentials to login my test account email: █████████ password: ██████ After login , alert document.cookie will triggered...

Mattermost: DOS: out of memory from gif through upload api

Summary: When sending a specially crafted gif with max dimensions through the upload API, we get Mattermost server to consume more than 4Gbytes of RAM Steps To Reproduce: add details for how we can reproduce the issue 1. Run docker run --name mattermost-preview -d --publish 8065:8065...

GitHub: DoS via markdown API from unauthenticated user

cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the...

U.S. Dept Of Defense: xmlrpc.php file enabled at ██████.org

The XML-RPC API on WordPress allowed third-party applications and services to interact with WordPress sites, but it opened up two types of attacks: XML-RPC pingbacks and brute force attacks. The xmlrpc.php file was enabled on ██████.org, making it vulnerable to these attacks. Disabling or removin...

Radancy: Admin account/panel takeOver and Doing actions in admin panel via DOM-based XSS

Hello team , I found Dom-XSS in your https://████████/ Webmail Admin Panel that manage attacker to stealing admin sensitive info and doing any action in your webmail admin panel . why and how this vulnerability happen : - if your reviewed the source code of this endpoint of the admin panel "...

HackerOne: Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`

The vulnerability allowed unauthorized users to retrieve sensitive information about private bug bounty programs on HackerOne, including program names, scope details, and the titles of reports. The issue was promptly addressed by the HackerOne team, who recognized its critical severity and awarde...

A.S. Watson Group : PII Disclosure At `theperfumeshop.com/register/forOrder`

A vulnerability was discovered that allowed unauthorized access to personally identifiable information of customers who placed orders on a website. By manipulating web requests, an attacker could view full name, address, phone number, order history and payment details of other customers. This...

Cloudflare Public Bug Bounty: Enable 2Fa verification without verifying email

It was possible to enable Two-factor authentication feature for an unverified Cloudflare account . As a consequence, a legitimate owner of the e-mail address, which was used to create the unverified account, is unable to log in or reset password to the Cloudflare account. The issue was fixed by t...

Acronis: Any expired reset password link can still be used to reset the password

Hello Aronis team! When requesting a password reset link at https://alt.5nine.com/passwordrecovery.aspx and using it, after a short time the link becomes invalid. When I open the link I get the message: "Your validation request is invalid or expired" But it is still possible to use it to reset th...

Cloudflare Public Bug Bounty: Basic XSS [WAF Bypasses]

Vulnerability description not provided...

Internet Bug Bounty: CVE-2022-32208: FTP-KRB bad message verification

When curl does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. Impact Loss of integrity of FTP-KRB transfers...

Internet Bug Bounty: CVE-2022-32207: Unpreserved file permissions

When curl saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name. In that rename operation, it might accidentally widen the permissions for the target file, leaving the update...

Internet Bug Bounty: CVE-2022-32206: HTTP compression denial of service

curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited...

Internet Bug Bounty: CVE-2022-32205: Set-Cookie denial of service

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl stores all of them. A sufficiently large amount of big cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the...

curl: CVE-2022-35252: control code in cookie denial of service

Summary: I took a look at https://github.com/curl/curl/pull/9048/commits/d7bcbc7d8d4b6d972d3da12d54819169a19c287b a sneak peek on a vulnerability to be announced tomorrow. My guess for that vulnerability is that since cookies are persistent, someone who can trick curl into storing cookies can sto...

Stripo Inc: Non-revoked API Key Information disclosure via Stripo_report()

Talking about 983331 reports where a security researcher reported secret API key leakage vulnerability in a JavaScript file at Stripo. This report is disclosed on HackerOne, and the team at Stripo have forgotten to blur the API keys from the report before disclosing it to the public. The API keys...

TikTok: Improper user validation on mentions and hashtags

Vulnerability description not provided...

GitLab: RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)

Summary The DecompressedArchiveSizeValidator is used to check the size of a archive before extracting it: https://gitlab.com/gitlab-org/gitlab/-/blob/v15.1.0-ee/lib/gitlab/importexport/decompressedarchivesizevalidator.rbL82 ruby def command "gzip -dc @archivepath | wc -c" end def validate pgrp =...

Judge.me : Improper Access Control in Ali Express Importer

An improper access control vulnerability was found in the Ali Express Review Importer app, which allowed staff members with no access to the Judge.me app to view all reviews, including hidden and archived ones, from the Judge.me app. The vulnerability was exploited by intercepting and replacing t...

Reddit: Rate limit is implemented in Reddit , but its not working .

Vulnerability description not provided...

LinkedIn: IDOR allows an attacker to delete anyone's featured photo.

An Insecure Direct Object Reference IDOR vulnerability allowed an attacker to delete anyone's featured photo on LinkedIn by manipulating the parameters in the delete request. This vulnerability was exploited by obtaining the necessary parameters from the victim's profile link and replacing them i...

Krisp: Authentication bypass for ███ leads to take over any users account.

@n0m3rcy has identified and reported an account takeover issue which required no user interaction. We would like to thank @n0m3rcy for reporting it responsibly to our bug bounty program !...

Nextcloud: SSRF via potential filter bypass with too lax local domain checking

Summary: Hi. Reviewing the code for filtering for ssrf, in preventLocalAddress, we can see that it calls the function ThrowIfLocalAddress. It has three common checks, first, it checks if the string is localhost, or if it ends in .local or .localhost php // Disallow localhost and local network if...

8x8: CVE-2019-11248 on http://█.█.█.█:9100/debug/pprof/goroutine

@mrk0anti reported to us an exposed debugging endpoint /debug/pprof over the unauthenticated Kubelet healthz port 9100. No sensitive information has been disclosed & the affected host belonged to our staging environment. The issue has been rectified...

Omise: Unauthorized Access - downgraded admin roles to none can still edit projects through brupsuite

hi team, I found that your site is vulnerable to Unauthorized Access lead to privilege escalation, where when the owner invites a user with admin roles, the user can still edit anything with admin access, via brupsuite, it should get an error message because the admin role has been removed...

LinkedIn: Add me email address Authentication bypass

hi, this vulnerability can able to access user account without email verification in linkedins' add me email address function page. user add mail2 email address. without mail2 email address verification user can fully access mail1 linkedin account using mail2 email address. In linkedin mobile...

Nextcloud: @nextcloud/logger NPM package brings vulnerable ansi-regex version

Summary: Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the sub-patterns \;? and ?:;-a-zA-Z\d\/&.:=?%@. Details: Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate...

Panther Labs: Twitter Account hijack through broken link in https://runpanther.io

Summary: A linkhttps://twitter.com/runpanther in https://runpanther.io was broken and anyone could create that account which leads to account impersonate Steps To Reproduce: 1.Go to https://runpanther.io 2.Scroll down to bottom there you can see that twitter icon. 3.Click on that icon, you will...

Nextcloud: Generated passwords are not fully validated by HIBPValidator

Summary: If the Nextcloud server generates a secure random password e.g. for sharing files, the validation is checked before the shuffle function strshuffle is called. In very rare cases it could happen, that a password is validated by HIBPValidator before strshuffle, but would not validate after...

Reddit: Unrestricted File Upload on reddit.secure.force.com

Summary: Reddit.secure.force.com is Reddit SalesForce instance. Attacker is able to send attachments of disallowed filetypes to this server. The attacker is able to send malicious documents such as CVE-2022-30190 Follina to the victim. Impact: Attacker can send malicious files to whoever handles...