15704 matches found
U.S. Dept Of Defense: XSS DUE TO CVE-2020-3580
Hello Team, During my research, I found multiple hosts to be vulnerable to Cisco ASA XSS CVE-2020-3580, This vulnerability targets the saml service within the VPN. It is triggered via a POST request to domain/+CSCOE+/saml/sp/acs?tgname=a References...
Internet Bug Bounty: CVE-2022-27781: CERTINFO never-ending busy-loop
Published Advisory: https://curl.se/docs/CVE-2022-27781.html Original Report: https://hackerone.com/reports/1555441 Impact Due to an erroneous function, a malicious server could make libcurl built with NSS get stuck in a never-ending busy-loop when trying to retrieve that information...
Shopify: store internal email disclosed through shopify-data-exporter
Summary: Hey Shopify, When a store install shopify-data-exporter app to export various data of the store a link is sent to the store internal email. This internal email is disclosed via the below request to anyone json GET /?shop=yourstore.myshopify.com HTTP/2 Host:...
Cloudflare Public Bug Bounty: I found another way to bypass Cloudflare Warp lock!
It was possible to bypass Lock WARP switch feature on WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused WARP client to disconnect and allowed the user to bypass...
Hyperledger: Remote denial of service in HyperLedger Fabric
This issue was caused by a missing check of nil. An orderer to orderer consensus message that contains an empty inner message crashes the node because it attempts to figure out its type and the mere action of determining the type of a nil pointer, causes a panic. Thank you to Haosheng Wang of OPP...
Nextcloud: Information exposure in in guzzlehttp/guzzle (https://github.com/nextcloud/3rdparty/tree/master/guzzlehttp/guzzle)
Summary: Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade, this depency is out of date and it can leat to still authorization header. Steps To Reproduce:...
GitHub Security Lab: PYTHON: CWE-079 - Add query for email injection
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CPP: Pam Authorization Bypass
Vulnerability description not provided...
Panther Labs: reflected XSS on panther.com
Summary: When visiting runpanther.io I got redirected to panther.com and the application failed to sanitise user's input resulting into HTML injection and possible XSS. Steps To Reproduce: F1774502 1. Go to...
Acronis: HTML Injection in E-mail Not Resolved ()
Summary On this report " https://hackerone.com/reports/1536899 " You closed the report and changed the status to Resolved. But it's Not Resolved The Bug It's Still there Steps To Reproduce 1.Please register at https://www.acronis.com/en-us/products/cyber-protect/trial/registration with the victim...
Internet Bug Bounty: Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag
It seems to be a problem caused by a difference between the nokogiri java implementation and the ruby implementation. jruby9.3.3.0 nokogiri java, use Rails::Html::SafeListSanitizer.new.sanitize, allow select/style tag code tags = %wselect style puts...
Internet Bug Bounty: Undici ProxyAgent vulnerable to MITM
Full GitHub advisory summarizing the issue is here: https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33 The original Node.js HackerOne report is here: https://hackerone.com/bugs?reportid=1583680 This was fixed & disclosed in Undici v5.5.1. This primarily affects Undici, a...
TikTok: TikTok's pixel/sdk.js leaks current URL from websites using postMessage
A vulnerability was found where an oauth token could have been leaked due to an origin check bypass in the TikTok Pixel SDK. We thank @fransrosen for reporting this to our team...
HackerOne: Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget
A stored XSS vulnerability was found on www.hackerone.com due to a deleted S3-bucket from an old pagewidget. An attacker could claim the bucket and run JavaScript on the website, potentially allowing them to steal user data or perform actions on behalf of the user. The vulnerability was reported ...
GitHub Security Lab: Golang : Add Query To Detect PAM Authorization Bugs
This bug was reported directly to GitHub Security Lab...
Insightly: Stored XSS in Email Notifcation
A stored XSS vulnerability was discovered in the email notification feature of the crm.na1.insightly.com platform. The vulnerability allowed an attacker to inject malicious code into the email subject, which was then executed when users viewed the notification. The vulnerability was caused by...
Nextcloud: Brute force protections don't work
Summary: Most of the brute force protections don't actually throttle the response and so they are not logging negative attempts Search for functions with the @BruteForceProtection annotation and check that they call throttle on the response at least conditionally. Impact Brute force protection is...
Nextcloud: Lack of Brute force protection while joining video call in talk section which is password protected
Advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq...
Reddit: Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.
ads.reddit.com is an ads creating and managing application for reddit. The application has the feature to invite other members to the organization and give different roles at ad management. Testing around the role management functionalities, I have noticed that a user with the same email can get...
Nextcloud: Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate
Summary: Call to registerReceiver misses the broadcastPermission argument - no permissions will be checked for the broadcaster, which allows a malicious application to communicate with the broadcast receiver. Supporting Material/References: Screenshot Snyk report references to fixes in other repo...
Internet Bug Bounty: DoS via lua_read_body() [zhbug_httpd_94]
Greetings. I have found a bug that can crash httpd 2.4.53, causing a denial of service. The bug is that luareadbody modules/lua/luarequest.c uses the value of the Content-Length header to allocate memory. While apreadrequest limits Content-Length's value to a non-negative |aprofft| via a call to...
Nextcloud: Calendar name length not validated before writing to database
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-xxc8-hq3v...
Nextcloud: Missing character limitation allows to put generate a database error
Hi Security Team, Summary: ========= There is no limit to the number of characters in the display name, which allows a DoS attack. The DoS attack affects server-side. Description ========= On the input form of Username in nextcloud.com/settings/user there's no Input validation using this you can...
Judge.me : XSS in Widget Review Form Preview in settings
Summary: Hi team, I found a XSS vulenrability in the widget review form preview. The payload is added in the success message and triggers when you preview the form Steps To Reproduce: 1. Login to your Shopify account and open Judge.Me App 1. Go to 'Settings' - 'Review Widget' - 'Widget Form' 1. G...
Internet Bug Bounty: Read beyond bounds via ap_rwrite() [zhbug_httpd_47.2]
Greetings. I have found that aprwrite /server/protocol.c can cause a read beyond bounds with the extra data sent to an attacker. The bug is that aprwrite passes its |int nbyte| argument to bufferoutput, where bufferoutput's corresponding |len| argument isa |aprsizet|. Thus, a negative |nbyte| val...
Internet Bug Bounty: Read beyond bounds in mod_isapi.c [zhbug_httpd_41]
Greetings. I have found a read-beyond-bounds bug in httpd that arises from an apparent logic error. The bug is in /modules/arch/win32/modisapi.c, on lines 979 and/or 983, which use the length of the path to the ISAPI DLL |strlenr-filename| to index into the string specified by the ISAPI DLL itsel...
Internet Bug Bounty: Controllable read beyond bounds in lua_websocket_readbytes() [zhbug_httpd_126]
Greetings. I have found a read-beyond-bounds bug in luawebsocketreadbytes that permits an attacker to exfiltrate a controllable amount of heap data if the victim site runs a suitable LUA program. The bug is due to misuse of apgetbrigade and aprbucketread. The following code from v2.4.53 assumes...
Internet Bug Bounty: Read beyond bounds in ap_strcmp_match() [zhbug_httpd_47.7]
Greetings. I have found a read-beyond-bounds attack against httpd that allows an attacker to search httpd's memory for strings matching an attacker-specified pattern 1. The attack arises from an overflow in apstrcmpmatch server/util.c. 2 The vulnerability can be reached via an LUA program that us...
GitHub Security Lab: Golang : Hardcoded secret used for signing JWT
This bug was reported directly to GitHub Security Lab...
Nextcloud: Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
Summary: The mail extension in nextcloud includes a module called "cerdic/csstidy" which basically ships with a publicly accessible test/example interface to play with the CSS formatter and optimiser /apps/mail/vendor/cerdic/css-tidy/cssoptimiser.php. This module allows contacting any remote serv...
Internet Bug Bounty: Apache HTTP Server: mod_proxy_ajp: Possible request smuggling
Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions...
GitHub: [Git Gud] GitHub.com Svnbridge memcached deserialization vulnerability chain leading to Remote Code Execution
A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridge. To exploit this vulnerability, an attacker would need to gain access via a server-side request forgery SSRF that would let an attacke...
Cloudflare Public Bug Bounty: Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts
The OIDC JWT token issued on a new Sign in with Apple ID to the Cloudflare Dashboard had an excessive lifetime. When intercepted by a malicious actor, it enabled impersonation of the affected user on multiple devices during the entire token validity period without the need to re-authenticate. The...
Cloudflare Public Bug Bounty: Sign in with Apple works on existing accounts, bypasses 2FA
It was possible to bypass configured Cloudflare 2FA when logging in to a Cloudflare account using Apple ID authentication flow. A malicious actor could access a Cloudflare account by setting up an Apple ID account using e-mail address matching the one used to set up the targeted account. The issu...
Automattic: Sensei LMS IDOR to send message
Hi there, hope you are doing great. So, there is an option to send message to teacher privately by student on Sensei LMS. Each message sent by student will have different ID, Student1 cannot access or send message to the message from Student2 which is meant to be private with teacher Similarly...
LinkedIn: IDOR - Delete technical skill assessment result & Gained Badges result of any user
The web app is vulnerable to IDOR at DELETE /voyager/api/voyagerAssessmentsDashSkillAssessmentAttemptReports/urn%3Ali%3AfsdskillAssessmentAttemptReport%3Aurn%3Ali%3Afsdprofile%███%2Curn%3Ali%3Askill%3A280%2C1 HTTP request. Allows an attacker to delete the skill assessment result of any user's...
Adobe: API Key reported in #1465145 not rotated and thus is still valid and can be used by anyone
Adobe appreciates the work and partnership with this security researcher. We value the commitment and dedication to our external security community...
Showmax: lack of rate limit on athentification login page & forgot password page
We received a report about missing rate-limiting functionality that is explicitly mentioned as out-of-scope of our security program. Since migrating our backends to AWS, we have no proper rate-limiting functionality in place. Due to complexity of our infra stack, we cannot use the standard WAF...
LinkedIn: The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more su
example- String username = request.getParameter"username"; String password = request.getParameter"password"; int authResult = authenticateUserusername, password; the security tokens can be bypassed easily , they are dont make user account safe . //script - check attached file Impact Technical...
GitLab: Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io`
Summary An owner of a group can restrict access to the group, subgroups and projects to only work from a specific IP range. See documentation link To ensure only people from your organization can access particular resources, you can restrict access to groups by IP address. This will restrict most...
Shopify: Self XSS in https://linkpop.com/dashboard/admin
Summary: Hello Shopify team, Found a self XSS https://linkpop.com/dashboard/admin, the steps to reproduce are below Steps To Reproduce: 1- Visit https://linkpop.com/dashboard/admin 2- Click on links = add links 3- add in the url input javascript:alertdocument.cookie F1757141 4- Click on the link...
Reddit: Several Subdomains Takeover
there are some subdomains in reddit.com those are vulnerable to takeover subdomain attack. I found these subdomains while I have been testing the subdomains of reddit.com. Steps To Reproduce: add details for how we can reproduce the issue 1. create a user account in reddit.com. 2. there are some...
Dropbox: Abuse cookie-modification, toast HTML and expired domain in CSP-form-action replacing login-page at www.dropbox.com/login to submit creds externally
The report demonstrates a method of stealing user credentials by exploiting a permissive domain name check in combination with an outdated dropbox URL in the content-security-poilcy. A fix for the issue has been released and it was applied for existing users through an automatic update. An attack...
Automattic: Unauthenticated Private Messages DIsclosure via wordpress Rest API
Vulnearble Plugin: Senei LMS Hi there, Hope you are doing well, So, i noticed that their is an option to contact teacher on Sensei LMS which is meant to private. By default, other user can't see the question I asked to the teacher. But using the /wp-json/wp/v2/sensei-messages/ where numeric ID ca...
Shopify: Production Key and Data Found on Subdomain No Longer Operated by Shopify / Dangling DNS
The production key and data were found on a subdomain no longer operated by Shopify. The subdomain was pointing to an IP address that did not belong to Shopify. The DNS record for the subdomain was removed, but no Shopify services were impacted...
curl: KRB-FTP: Security level downgrade
Summary: libcurl doesn't fail the FTP connection if Kerberos authentication fails for some reason, but rather reverts back to using regular clear text password authentication. The logic is inlib/ftp.c ftpstatemachine:...
curl: CVE-2022-32208: FTP-KRB bad message verification
Summary: libcurl handles gssunwrap GSSSBADSIG error incorrectly. This enables malicious attacker to inject arbitrary FTP server responses to GSSAPI protected FTP control connection and/or make the client consume unrelated heap memory as a FTP command response. The defective krb5decode function is...
curl: Heap overflow via HTTP/2 PUSH_PROMISE
Summary: libcurl HTTP/2 support processes incoming PUSHPROMISE headers by storing them in an array. The code initially allocates storage for 10 headers and then keeps doubling the array size as needed: stream-pushheadersalloc = 2; headp = Curlsafereallocstream-pushheaders, stream-pushheadersalloc...
GitLab: CSP-bypass XSS in project settings page
Summary This javascript function is vulnerable: javascript deployKeyRowHtmlkey, isActive const isActiveClass = isActive || ''; return $key.title $sprintf 'Owned by %imagetag', imagetag: , , false, $escape key.fullname, $key.username ; It is used to render a deployment key in a dropdown item...