GitHub Security Lab: [Python]: CWE-079: HTTP Header injection

This bug was reported directly to GitHub Security Lab...

UPchieve: Clickjacking ar https://hackers.upchieve.org/login

I found clickjacking at login page on https://hackers.upchieve.org that can be exploited if the UI overlay can be performed correctly by the attacker. Clickjack test page Website is vulnerable to clickjacking! Click me when you finish : Impact Its login page so if the UI overlay can be performed...

8x8: 8x8pilot.com: Reflected XSS in Apache Tomcat /jsp-examples example directory

A single host in the pilot environment exposed the Apache Tomcat /jsp-examples example directory. The issue has been rectified, as we removed the directory from the host...

Shopify: [https://shipit-sox-staging.shopifycloud.com] Presence of multiple vulnerabilities present in Ruby On Rails

https://shipit-sox-staging.shopifycloud.com seems to be running 6.0.0 rails 6.0.3.2 which is prone to multiple vulnerabilities via csrf including open redirect, xss & rce as reported at https://hackerone.com/reports/904059 Impact presence of multiple vulnerabilities can cause wide variety of dama...

Internet Bug Bounty: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier...

Mail.ru: stand.pw.mail.ru xss

http://stand.pw.mail.ru:9100/news.php?archive=news&type=last"alert1&page=1 payload is:"alert1 Impact Can steal Cookie, Can run javascript code, and get information sensitive...

Glovo: chainning bugs to get full disclosure of Users addresses

Summary: I was able to disclose any address that was used by the customers. The only barrier that came across that I need to put my visa on. On seeing that I managed to bypass it . just after bypassing that, my order was accepted and the price was set to free So i don't know actually if there is ...

Kubernetes: Google storage bucket takeover which is used to load JS file in dashboard.html in "github.com/kubernetes/release" which can lead to XSS

Report Submission Form Summary: Kubernetes have a github repository github.com/kubernetes/release In the repository there is code for dashboard. The dashboard have a html file dashboard.html which is using a JS file from a google storage bucket. The bucket was not registered on google cloud. So I...

Azbuka Vkusa: Мисконфигурация Cisco Smart Install

Closed...

Kubernetes: Broken Github Link Used in deployment docs of "github.com/kubernetes/kompose"

Report Submission Form Summary: Kubernetes have a github project github.com/kubernetes/kompose In the project there is a doc which have installation steps In the steps, doc is referring to another github account repository to clone it and install. But the github account was not registered on...

Kubernetes: Broken Link Takeover from kubernetes.io docs

Report Submission Form Summary: Kubernetes docs has Spanish translation available. One of the page of Portuguese doc has an external reference to a github repository. The github account was not registered on github.com. So I was able to takeover the page and host the PoC Kubernetes Version: NA...

Adobe: Able to bypass the fix on DOM XSS at [www.adobe.com]

Thank you @saajanbhujel for your contributions and we look forward to collaborating with you again in the future!...

GitLab: Stored XSS on issue comments and other pages which contain notes

Summary This report contains two XSS sanitization bypasses: The SyntaxHighlightFilter creates html from unsanitized data. This can be used to bypass the XSS filter on the server-side. ruby def highlightnodenode ... sourcepos = node.parent.attr'data-sourcepos' ... sourceposattr = sourcepos ?...

Judge.me : Stored XSS in Public Profile Reviews

A stored XSS vulnerability was found in the public profile review section of a platform. Attackers could add a product description with a data URI XSS payload in HTML format, which would execute when a user clicked on the HTML tag. This could lead to the execution of arbitrary code in the victim'...

Evernote: [34.96.80.155] Server Logs Disclosure lead to Information Leakage

Summary: In this case server log is available for any in /server-status Steps To Reproduce: 1. Go to https://34.96.80.155/server-status/ and follow attack scenario's Attack Scenario's: Serg.io 1. User go to server and enter sensitive info that can be logged example : http://host/login?privatekey=...

GitHub Security Lab: [GO]: [CWE-090: LDAP Injection All For One]

This bug was reported directly to GitHub Security Lab...

Judge.me : Self-XSS due to image URL can be eploited via XSSJacking techniques in review email

A self-XSS vulnerability was discovered in Judge.me due to the image URL of recommendations in the reviewer profile that could be exploited via XSSJacking techniques in the review email. An attacker could insert a payload in the image URL of recommendations and then use XSSJacking techniques to...

Cosmos: Unclaimed official s3 bucket of tendermint(tendermint-packages) which is used by many other blockchain companies in their code

An unclaimed official S3 bucket of Tendermint, which was also used by many other blockchain companies and developers, was discovered. An attacker could have hosted malicious files on the bucket, causing harm to the companies or developers using it for package installation. The vulnerability has...

Concrete CMS: open redirect to a remote website which can phish users

By Adding some extra headers in the request I noticed that the user is redirected to a remote website. This can lead to stealing a user credentials phishing on a remote server. These headers can be added either using a MITM attack or by chaining with another vulnerability such as request smugglin...

MTN Group: Sensitive Information Disclosure Through Config File

Summary: An attacker could gain access to sensitive information about usernames, encrypted passwords, internal IP addresses and configuration data of internal services. Steps To Reproduce: - Go to https://zik.mtncameroon.net/common/queryconfig.action Remediation Configure the application to not...

MTN Group: Default Admin Username and Password on remedysso.mtncameroon.net

Summary: A Remedy Single Sign-On Remedy SSO Server is running at https://remedysso.mtncameroon.net/rsso/admin//. It is possible to access the application is using the default Administrator credentials. Steps To Reproduce: Go to https://remedysso.mtncameroon.net/rsso/admin// and login with...

Intel Corporation: [BrakTooth] Bluetooth vulnerability allows attacker to disconnect or deny reconnection to BT devices connected to a target. Attack #2

This bug was reported directly to Intel Corporation...

Intel Corporation: [BrakTooth] Bluetooth vulnerability allows attacker to disconnect or deny reconnection to BT devices connected to a target. Attack #1

This bug was reported directly to Intel Corporation...

U.S. Dept Of Defense: Unauthenticated Access to Admin Panel Functions at https://███████/███

Description: The admin panel at https://██████████/████████ and all its functions can be accessed without authentication. This is basically the same vulnerability as in 1394910, just on another system. Impact An attacker is able to use the administrative functions in order to upload, delete or...

Judge.me : The response shows the nginx version

Summary: On visiting the https://cache.judge.me/ .It show the nginx version Steps To Reproduce: ==send :== GET / HTTP/1.1 Host: cache.judge.me Cookie: ga=GA1.2.907415772.1636450777; gid=GA1.2.1767694824.1636450777; fbp=fb.1.1636450778172.127612364; hjid=00598a42-40f4-48cb-84ec-20b9bd4273cd;...

Evernote: Email Verification Bypass by bruteforcing when setting up 2FA

Summary: Hello team, I hope you are fine and doing well when a user set ups his 2 Factor Authentication in his account and verify his email ,i was able to bruteforce the email verification process . The confirmationCode is used for authentication of user's email and it can be brute forced. The co...

Shopify: Unathorised access to admin endpoint on plus-website-staging5.shopifycloud.com

Summary: https://plus-website-staging5.shopifycloud.com/admin/ allows to access/modify and delete partners data. While the environment seems to be staging, partner's/clients contact details look pretty real. Sorry: During the testing, I've created Test111 partner account, trying to escalate the...

Internet Bug Bounty: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default...

U.S. Dept Of Defense: Unauthenticated Access to Admin Panel Functions at https://██████████/████████

Description: I discovered that the admin panel at https://████/█████ and all its functions can be accessed without authentication. Impact An attacker is able to use the administrative functions in order to upload, delete or modify files. System Hosts ████████ Affected Products and Versions ██████...

TikTok: reflected xss on the path m.tiktok.com

A cross site scripting vulnerability was found in Ambassador Manage endpoint. We thank @semsem123 for reporting this to our team...

Rocket.Chat: Unintended information disclosure in the Hubot Log files

Dear Rocket.Chat Team While inspecting our logs I noticed, that the OAuth Tokens are leaked in plaintext in the logs. I wanted to draw your attention to this, as this is a security vulnerability. See the attached Screenshot for a redacted log excerpt. In my opinion, the best approach here would b...

Omise: XSS via X-Forwarded-Host header

Summary: The https://www.omise.co/ website is vulnerable to a cross-site scripting flaw if the server receives a crafted X-Forwarded-Host header. Description: The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an...

8x8: xss(r) vcc-na11.8x8.com

The "oem" parameter in the vcc-na11.8x8.com endpoint was vulnerable to Reflected Cross Site Scripting XSS attacks. This allowed attackers to execute malicious code and potentially steal non-secure cookies...

TikTok: IDOR the ability to view support tickets of any user on seller platform

Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially viewed support tickets on seller platform. We thank @lewaperbb for reporting this to our team...

HackerOne: HackerOne Staging uses Production data for testing

Summary: Today I received an email related to smart rewards from HackerOne. This included staging environment details, such as: sender: [email protected] Privacy / Terms links pointing to domain: https://www.enorekcah.com/... This basically tells us that HackerOne is using hacker dat...

XVIDEOS: No-Rate limit of current password on delete account endpoint(https://www.xvideos.com/account/close)

Hi Team!!! This Attack happen when victim login in other device and forget to logout ,Then attacker can delete it's account by brute force the current password because current password has no-rate limit. After guessing current password attacker can easily delete the victim account. Steps To...

Insightly: Stored XSS via LINK Name.

The LINK NAME was not properly escaped at the Templates page, leading to Stored XSS. The name was reflected in the tag, and due to lack of sanitization, the user could break out of the tag and execute the XSS...

X (Formerly Twitter): Remote 0click exfiltration of Safari user's IP address

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: A malicious actor when embeddi...

Shopify: Orders full read for a staff with only `Customers` permissions.

Summary: A staff with only Customers permission can get full information about shop's orders. I consider it as an issue, because in Shopify's documentation it is explicitly said that you must have Orders readorders permissions to be able to read shop's orders: F1504156...

GitHub Security Lab: Yet another SSRF query for Go

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Yet another SSRF query for Go

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Yet another SSRF query for Go

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Yet another SSRF query for Javascript

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Yet another SSRF query for Javascript

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Yet another SSRF query for Javascript

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Yet another SSRF query for Go

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Yet another SSRF query for Javascript

This bug was reported directly to GitHub Security Lab...

Zivver: Timing difference exposes existence of accounts

This report concerns a timing-based enumeration of user accounts through the authentication endpoint. While the Zivver product offers intended ways to identify if another person is a Zivver user by their email address, this report was novel in that it allows this behavior pre-authentication...

Cloudflare Public Bug Bounty: Bypassing Cache Deception Armor using .avif extension file

Cloudflare Deception Armor could be bypassed by using .avif extension making Cache deception attack possible on vulnerable origin servers. Cloudflare Cache Deception Armor uses a Page rule to protect Cloudflare Cache against caching possibly sensitive information. This attack could be performed b...

8x8: Remote Code Execution on ██.8x8.com via .NET VSTATE Deserialization

@0daystolive reported to us a flaw in a 3rd party community platform, which could be exploited to achieve RCE. We swiftly relayed this to the vendor and their engineering team turned off the affected code, which resolved the issue. For more details about this vulnerability read:...