15704 matches found
LinkedIn: Campaign Account Balance and History Disclosed in API Response
During the security assessment of the application, it has been observed that server-side authorization checks are not implemented on the 'GET /campaign-manager-api/campaignManagerAccounts/:campaignId/accountCredits?q=account' HTTP request. As a result, an attacker can fetch the campaign wallet...
LinkedIn: Improper access control on Linkedin Page
An improper access control vulnerability was discovered on the LinkedIn page, allowing a user with the role of analyst to publish posts even after their role was changed from super admin...
GitHub Security Lab: Python : Add query to detect PAM authorization bypass
Vulnerability description not provided...
TikTok: IDOR in family pairing API
Vulnerability description not provided...
Yelp: installed.json sensitive file was publicly accessible on your web application which discloses information about authors and admins
kindly if you don't accept this issue please close it as informative , thanks in advance Description: The installed.json file is a sensitive file and it was publicly accessible on your webserver , which discloses some information about your web site and users such as authors like admin as shown...
Shopify: Information disclosure ( Google Sales Channel )
In the review on apps.shopify.com the Google sales channel has a review of 5407 but the actual number of shopify stores that use the Google channel I believe is more than that number so I think this vulnerability can have an impact on many shopify stores and here I found a vulnerability where...
Alohi: Weak rate limit for SIGN.PLUS email verification
zeesozee identified a way to reset the rate limit concerning the "Confirm your email" verification endpoint for new accounts. This increases the chance of successful bruteforce from an attacker who would try to register with a fake email. The issue was fixed immediately...
Phabricator: Deprecated owners.query API bypasses object view policy
The deprecated owners.query API does not check object view policy. A user is able to view some information about an owner package which they do not have permission to see by calling this API. Since the API is deprecated, it could just be removed. Impact An attacker is able to view some informatio...
Rocket.Chat: Clickjacking at open.rocket.chat
The open.rocket.chat instance was found to have a misconfiguration issue with the "X-FRAME-OPTIONS" header, which could have allowed for clickjacking attacks. The issue was acknowledged and accepted by the Rocket.Chat team. However, they no longer accept vulnerability reports for their clients or...
Node.js: Undici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxy
Summary: When using Undici with its ProxyAgent, it does not use CONNECT or correctly verify the upstream server's HTTPS certificate. Description: This affects both Undici itself and global fetch in Node 18 when used with Undici's ProxyAgent. I've submitted this here for Node as it affects global...
Reddit: Misconfigurated login page able to lock login action for any account without user interaction
Summary While observing a few things about the login feature, I found that the account was locked after a certain number of requests. Although this feature is actually added to prevent problems such as rate limit, it is open to account lock attacks by attackers. PoC 1. Save this code as exploit.p...
GitHub Security Lab: CPP: Add query for CWE-243 Creation of chroot Jail Without Changing Working Directory
This bug was reported directly to GitHub Security Lab...
GitLab: Bypass for Domain-level redirects (Unvalidated Redirects and Forwar)
Summary F1745460 While testing for the ability to define custom redirects in Gitlab Pages, I discovered I was able to define Domain-level redirects which are explicitly disabled in the documentation. At a first glance, the validation step seems to disable any link not starting with /, It has...
LinkedIn: Can access the job name, creator name and can report any draft/under review/rejected job
The application has a functionality using which a user can report a job if he found the job is misleading/spam or fraud. Using this feature, an attacker can do report any unlisted draft/under review/rejected job. After reporting the job the victim will receive an email from 'LinkedIn Trust & Safe...
HackerOne: HTML Injection in email via Name field
Hello Gents, I would like to report an issue where attackers are able to inject HTML into the Name field at app.qualified.dev. Steps to reproduce: 1. Please register at https://app.qualified.dev/signup 2. Inject the Namefield with any HTML payload. 3. Open the victim's test email, HTML will be...
Exodus: 2 Cache Poisoning Attack Methods Affect Core Functionality www.exodus.com
Summary: www.exodus.com hosts static js and css files on Server: cloudflare . Which is cached by cloudflare and passed to all other users accessing the source. I was able to impact the core functionality by using a custom HTTP. Here are 2 details of the Bug. Steps To Reproduce: 1. 501 Not...
Flickr: Open Redirect
A misconfiguration of the routing system was at fault. A wildcard URL pattern existed with the intention to send visitors to a 404 page but this wasn't reliably working. Now when the wildcard handler catches a URL it redirects reliably to a dead end 404 page...
Stripe: Mass Account Takeover at https://app.taxjar.com/ - No user Interaction
@beerboyankit discovered an IDOR in the user invite link in Taxjar. This could have allowed an attacker to take over a user's account. The vulnerability was caused by a leaked token in the delete invitation request feature and resolved by using the invitation ID instead of the token to look up th...
Rocket.Chat: Regex account takeover
Summary: get admin reset token with authenticated user Description: normal user login can access to admin reset token and set a new password for admin user Releases Affected: 3.18.5 3.0.5 Steps To Reproduce from initial installation to vulnerability: Add details for how we can reproduce the issue...
Glovo: Exposed valid AWS, Mysql, Sendgrid and other secrets
Summary: Hi team, I just discovered some hardcoded credentials allowing access to AWS, Mysql database, ... To make this report short, here is the POC: see ███ & █████ Steps To Reproduce: where there are the info : APPNAME=Glovo APPENV=local APPKEY=█████ APPDEBUG=false APPURL=http://localhost...
Stripe: Bypassing domain deny_list rule in Smokescreen via double brackets [[]] which leads to SSRF
@sim4n6 discovered a bypass of the domain denylist rule in github.com/stripe/smokescreen using double brackets. This could have led to a server-side request forgery SSRF vulnerability for users of smokescreen. The vulnerability was caused by only stripping one set of brackets before processing a...
Kubernetes: Bypass validation parts in AWS IAM Authenticator for Kubernetes
Multiple bypasses were discovered in AWS IAM Authenticator for Kubernetes. An attacker could craft a token without a signed cluster ID header and use it for replay attacks, manipulate the extracted AccessKeyID to gain higher permissions in the cluster, and send a request to other action values...
Nextcloud: Ownership check missing when updating or deleting attachments
Summary: Ownership check is missing for attachments. Steps To Reproduce: 1. Open mail app 2. Compose a new message 3. Attach some file 4. Send message 5. Copy the xhr request and modify the attachment ids 6. See that localmessageid is changed for a different user When you compose a message and pu...
GitLab: XSS: `v-safe-html` is not safe enough
v-safe-html directive uses Dompurify to remove data-remote', 'data-url', 'data-type', 'data-method' attributes from HTML tags. Rails-js relies on another attribute, data-disable-with to show a HTML content when an user clicks on a disabled link. For example, the following text will bypass the...
Brave Software: Browser is not following proper flow for redirection cause open redirect
Summary: Brave browser is not following proper flow for redirection. Browser is directly redirecting to the site that is present in redirect parameter without confirming from the main site server. I have found this vulnerability and this is affecting Facebook. Facebook use l.facebook.com/l.php?u=...
GitHub Security Lab: [Java]: Flow sources and steps for JMS and RabbitMQ
This bug was reported directly to GitHub Security Lab...
Acronis: unauth mosquitto ( client emails, ips, license keys exposure )
Hi team Summary connect.acronis.com ip 88.99.142.45:1883 has unauth mosquitto mqtt, anyone can connect and read\write messages Steps To Reproduce add details for how we can reproduce the issue 1. https://github.com/bapowell/python-mqtt-client-shell 1. python3 mqttclientshell.py 1. connection 1...
GitLab: New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fields
Summary In Gitlab 15.0.0 a new Customer Relations feature was added that allows us to use quick actions to find the contact we wish to select. However, I noticed that if I set the contact's first name or last name to alertdocument.domain we can get the XSS to trigger when we are attempting to use...
LinkedIn: Rate limit Bypass on contact-us through IP Rotator (burp extension)(https://www.linkedin.com/help/linkedin/solve/contact)
hello Team i have found issue on https://www.linkedin.com/help/linkedin/solve/contact , which spam the mail box of victim through alternative email and support team. Steps 1. Go to https://www.linkedin.com/help/linkedin/solve/contact 2. Fill the Form 3. Fill the victim mail id in alternative emai...
HackerOne: Banned user still has access to their deleted account via HackerOne's API using their API key
The user's banned account could still be accessed using their previously generated API token, allowing them to perform actions such as retrieving reports, balance, earnings, payouts, weaknesses, and program information. This vulnerability was discovered and exploited on a test account...
Trellix: Sensitive Information Disclosure
Sensitive information, including Personally Identifiable Information PII data, was being disclosed through JEB 4.2.0.202106271614 licensed to a specific user. The vulnerability allowed unauthorized access to the information and could potentially lead to data breaches...
TikTok: Unrestricted File Upload Blind Stored Xss in subdomain ads.tiktok.com
A blind stored Cross-Site Scripting XSS vulnerability was found on a TikTok Ads domain via uploaded file. We thank @mrzheev for reporting this to our team...
Cloudflare Public Bug Bounty: HTTP request smuggling with Origin Rules using newlines in the host_header action parameter
The hostheader action parameter available to rulesets in the Origin Rules API lacked sufficient input validation i.e., allowing CRLF characters. Because of this, it was possible to inject arbitrary headers and, as a consequence, smuggle HTTP requests. This vulnerability enabled bypassing security...
TikTok: Internal Employee informations Disclosure via TikTok Athena api
A vulnerability was found where internal employee email address could be disclosed on a TikTok Ads endpoint API by adding an "employeeemail" value to the "metrics" field/array in the request body. We thank @heinthant for reporting this to our team...
Yelp: xmlrpc file enabled
Summary: Hello team, I have found a security vulnerability in restaurants.yelp.com/xmlrpc.php which lets attacker to: 1: XSPA or PortScan 2: Bruteforce 3:DOS and much more Platforms Affected: https://restaurants.yelp.com Steps To Reproduce: 1: Go to https://restaurants.yelp.com/xmlrpc.php to chec...
Stripe: Limited path traversal in Node.js SDK leads to PII disclosure
A limited path traversal vulnerability in the Node.js SDK allowed an attacker to retrieve personally identifiable information PII of users. By using . and .. as identifiers in API methods, the attacker could call parent API methods and access sensitive data such as email addresses, names, and...
Node.js: DNS rebinding in --inspect (again) via invalid IP addresses
A vulnerability was discovered in the Node.js debugger that allowed an attacker to gain access to the debugger and potentially execute remote code. This was possible due to a flaw in the IsAllowedHost check, which did not properly validate invalid IP addresses, allowing for DNS rebinding attacks...
lemlist: Clickjacking at app.lemlist.com
Hi team, While performing security testing of your website i have found the vulnerability called Clickjacking. Many URLS are in scope and vulnerable to Clickjacking. What is Clickjacking ? Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of...
curl: CVE-2022-32207: Unpreserved file permissions
Summary: Curl fails to preserve file permissions when writing: - CURLOPTCOOKIEJAR database - CURLOPTALTSVC database - CURLOPTHSTS database Instead the permissions is always reset to 0666 & umask if the file is updated. As a result a file that was before protected against read access by other user...
LinkedIn: Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings]
Summary: Hey team, During the security assessment, I came across an endpoint - GET /voyager/api/voyagerOrganizationDashEmailDomainMappings, which is vulnerable to privilege escalation. A lower privileged user can abuse this to view the list of approved domains for email verification even though i...
GitHub Security Lab: [python]: Zip Slip Vulnerability
This bug was reported directly to GitHub Security Lab...
curl: curl "globbing" can lead to denial of service attacks
Summary: add summary of the vulnerability The curl "globbing" allows too much scope, which can cause the server to be denied service or used to attack third-party websites. The globbing allow 1-9999999999999999999 to parse in the url. So when curl request for...
TikTok: Create product discounts of any shop
An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok seller endpoint, which could have resulted in any user to create product discounts for shops they did not own. We thank @datph4m for reporting this to our team...
Cloudflare Public Bug Bounty: Arbitrary file read from Cloudflare Pages build environment
A vulnerability in Cloudflare Pages allowed attackers to escalate privileges during the build process, enabling arbitrary file reads. Cloudflare implemented more restrictive input validation on the redirects and headers feature to resolve the issue. The build environment is scoped to each Pages...
curl: CVE-2022-32206: HTTP compression denial of service
Summary: Curl does not prevent resource consumption when processing certain header types, but keeps on allocating more and more resources until the application terminates or the system crashes, see below. The attack vectors include at least: - Sending many Transfer-Encodingwith repeated encodings...
curl: CVE-2022-32205: Set-Cookie denial of service
Summary: Curl fails to limit the number of cookies that can be set by a single host/domain. It can easily lead to a situation where constructing the request towards a host will end up consuming more than DYNHTTPREQUEST memory, leading to instant CURLEOUTOFMEMORY. Any host in a given domain can...
Shopify: XSS seems to work again after change to linkpop at https://linkpop.com/testnaglinagli
Summary My XSS seems to work again at https://linkpop.com/testnaglinagli Best Regards @nagli Impact XSS...
curl: Credential leak when use two url
Summary: Curl can leak user credentials if use two url. Steps To Reproduce: 1. curl -I -v -u aaa:bbb hackerone.com curl.se 2. the output is: Connected to hackerone.com 104.16.100.52 port 80 0 Server auth using Basic with user 'aaa' HEAD / HTTP/1.1 Host: hackerone.com Authorization: Basic...
curl: Credential leak on redirect
Summary: add summary of the vulnerability Curl can be coaxed to leak user credentials to third-party host by issuing HTTP redirect , like the Proxy-Authorization 、x-auth-token header. It is a bypass of fix https://hackerone.com/reports/1547048 , CVE-2022-27776 . Steps To Reproduce: add details fo...