EXNESS: CRLF Injection - Http Response Splitting

HTTP response splitting allowed to add a malicious header to the response...

Khan Academy: Enumerate class codes via yahoo dork - Can access any course under teacher - Sensitive information leaked

Hello Team, I am quality researcher and I found some links using yahoo dorking techniques I used yahoo dork site:pl.khanacademy.org/join I used Firefox browser. Steps to reproduce: 1.Go to yahoo search page and use above query to enumerate. 2.Create student account by filling all the required...

Flickr: Open redirect bypass

The Flickr browser upgrade page was inadequately validating that URL to continue to was a flickr.com-based URL...

GitHub Security Lab: [Python]: CWE-611: XXE

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java]: Add JDBC connection SSRF sinks

This bug was reported directly to GitHub Security Lab...

OneWeb: Cross-site scripting (DOM-based)

Issue detail The application may be vulnerable to DOM-based cross-site scripting. Data is read from window.location.hash and passed to $. The exploitability of this issue might depend on the specific version of jQuery that is being used. Issue background DOM-based vulnerabilities arise when a...

U.S. Dept Of Defense: username and password leaked via pptx for █████████ website

Description: While performing my recon, I can accross this https://███/███████ which contain username and password for accessing your asset here █████ ████ References: ███████ Impact I tried accessing the ip but it is not working here, I f it can be accessed somewhere this will result in full...

Monero: monerod JSON RPC server remote DoS

Monero daemon monerod does not limit Content-length variable when processing incoming HTTP requests. We can force monerod to allocate arbitrary amount of memory. How to reproduce: 1 compile monero https://github.com/monero-project/monero 2 run it: $ ulimit -Sv 1000000000 $ ./bin/monerod --rpc-log...

Adobe: DoS of https://research.adobe.com/ via CVE-2018-6389 exploitation

The researcher successfully exploited CVE-2018-6389 on https://research.adobe.com/. We appreciate the collaboration and the responsible disclosure...

Internet Bug Bounty: Read and write beyond bounds in mod_sed

This CVE consists of several bugs in modsed, where overflows, truncation, uses after free and a logic error can allow a remote, unauthenticated attacker to read and/or write heap locations beyond bounds. See https://github.com/apache/httpd/commit/943f57b336f264d77e5b780c82ab73daf3d14deb and...

Nextcloud: SMTP Command Injection in Appointment Emails via Newlines

Summary: Users can create appointment calendars for other users to book slots on their calendar. When booking a slot, the following request is made: POST /apps/calendar/appointment/1/book HTTP/2 Host: 192.168.92.132 "start":1647306900,"end":"1647307200","displayName":"Test...

EXNESS: Taking position in a discontinued forex pair without executing any trades

Taking an indirect position on a discontinued forex pair could lead to a probable riskless trading and business logic abuse...

TikTok: IDOR on TikTok Seller

An Insecure Direct Object Reference IDOR vulnerability was found on a TikTok Seller endpoint via the "promotionid" parameter, which could have resulted in a promotion being remover from a user's account. We thank @aidilarf2000 for reporting this to our team...

Sony: Response Manipulation leads to Admin Panel Login Bypass at https://██████/

The researcher reported that the authentication of a Sony endpoint could be bypassed by manipulating the response to a login request. By changing the value of a response parameter, the researcher bypassed the authentication and was able to gain access to an admin portal...

Cloudflare Public Bug Bounty: API docs expose an active token for the sample domain theburritobot.com

A screenshot featured on API token creation documentation page exposed a valid API token with permissions sufficient to modify DNS records of one of Cloudflare’s demo zones. The token has since been revoked...

ImpressCMS: SQL Injection in version 1.4.3 and below

A SQL Injection vulnerability was discovered in ImpressCMS version 1.4.3 and earlier. This vulnerability allowed remote attackers to inject malicious code into the application, enabling them to read and modify sensitive information from the database. In some cases, attackers could even upload a...

U.S. General Services Administration: Read Other Users Reports Through Cloning

Summary: I team, I have found a vulnerability where I am able to read other users reports through the clone report function. If an attacker goes to try read another users report, we get a 500 internal error response. But if an attacker uses the clone report function, we are able to clone a victim...

TikTok: Privilege Escalation on TikTok for Business

An IDOR Insecure Direct Object Reference vulnerability was found on the "orgid" and "accountid" parameters on a Business.TikTok.com endpoint, which could have resulted in an authenticated user with "Analyst" level permissions to close another user's ads accounts. We thank @naaash for reporting th...

Kraden: Business Logic Flaw in the subscription of the app

Summary: Hello Security Team Business logic vulnerabilities are flaws in the design and implementation of an application that allow an attacker to elicit unintended behavior. This potentially enables attackers to manipulate legitimate functionality to achieve a malicious goal. Steps To Reproduce:...

Reddit: XSS via Mod Log Removed Posts

Summary: I have discovered an XSS vulnerability regarding the mod notes feature. Specifically, the XSS payload executes when the victim removes a post in a subreddit and opens up the mod notes of the attacker. Steps To Reproduce: 1. The attacker creates a new post with the title containing the XS...

TikTok: Impersonation of tiktok account via Broken Link in TikTok Newsroom

A broken link was found on TikTok Newsroom, which could have allowed an attacker to claim the associated username and hijack the link. We thank @bushidobrown200 for reporting this to our team and confirming its resolution...

TikTok: Stored XSS on TikTok Ads

A Cross-Site Scripting XSS vulnerability was found on a TikTok Ads endpoint via a SVG file containing an xss payload. We thank @sinayeganeh for reporting this to our team...

pixiv: XSS Reflected at https://sketch.pixiv.net/ Via `next_url`

Hi, I Found XSS Reflected at https://sketch.pixiv.net/ Via Success URL Follow Me : Steps : 1. Open the URL below: https://sketch.pixiv.net/resignrequest/success?nexturl=javascript%3Aalert%2F%2Fdocument.domain 2. Pop ups appear : Impact If an attacker can control a script that is executed in the...

Mattermost: Reflected XSS in OAuth complete endpoints

Reflected XSS vulnerabilities were discovered in several OAuth complete endpoints in Mattermost. These endpoints failed to sanitize the "redirectto" field in the "state" query parameter, allowing an attacker to execute malicious JavaScript code in the context of the user's browser. This could lea...

Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding

Summary: The llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS. Description: When Node receives the following request: http GET / HTTP/1.1 Transfer-Encoding: chunked , identity 1 a 0 it...

HackerOne: An attacker can archive and unarchive any structured scope object on HackerOne

Summary: Hello, I have discovered an IDOR vulnerability that allows the scope of any program to be archived. Scopes are used to give information about the valid scopes of a program. For example HackerOne has the following scopes: https://hackerone.com https://api.hackerone.com ... Steps To...

TikTok: One Click Account Hijacking via Unvalidated Deeplink

A WebView Hijacking vulnerability was found on the TikTok Android application via an un-validated deeplink on an un-sanitized parameter. This could have resulted in account hijacking through a JavaScript interface. We thank @fr4via for reporting this to our team...

8x8 Bounty: connect.8x8.com: Users with no permission can track/access restricted details/data via GET /api/v2/support/requests/<ticket number >HTTP/2

Vulnerability description not provided...

TikTok: View thumbnail of any private video (friends or followers only) of Private/Public account

Vulnerability description not provided...

GitHub: CSRF protection bypass in GitHub Enterprise management console

A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentially lead to privilege escalation. To exploit this vulnerability, an attacker would need to target a user that was actively logged into the...

MTN Group: cross site scripting reflected

The vulnerability was a cross-site scripting XSS flaw that allowed arbitrary JavaScript to be executed on the target website. The payload '-alert1-' was reflected in the website's output, demonstrating the presence of the vulnerability...

Uber: Uber Test Report 20220301

Test summary from Team Uber. This is the summary from secret John. This is the edit from hacker John after disclosure was approved. Second test after disclosure...

GitHub Security Lab: [Java]: Timing attacks while comparing the headers value

This bug was reported directly to GitHub Security Lab...

Alohi: Waitlist bypass for accessing SIGN.PLUS Beta

During SIGN.PLUS beta phase, it was found out that hackers could trick the API response and pretend to have been accepted into the beta program. All server operations would be blocked, but the UI client would be accessible, exposing the work-in-progress design to non-beta users. There was no...

Stripe: CSRF token validation system is disabled on Stripe Dashboard

@rodolfomarianocy discovered that due to a code change deployed on 2/14/2022, Cross Site Request Forgery CSRF protection was disabled in the Stripe Dashboard. This could have allowed an attacker to trick a victim user to visit a malicious website and cause limited changes to the victim’s Stripe...

U.S. Dept Of Defense: Broken access control, can lead to legitimate user data loss

Hi team, During testing the security of ██████████ I found another possible attack vector: There are two reports preceding this one - https://hackerone.com/reports/1489470 and https://hackerone.com/reports/1489744 I will try to explain: When an user need access to that information system he fills...

Internet Bug Bounty: CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGs

In Apache Airflow, prior to version 2.2.4, In DAG script of airflow , there is two command injection vulnerability RCE in the some scripts, which an attacker can execute arbitrary commands on the system. The impact is even greater when airflow is configured for unauthenticated access. These two...

IBM: Public Jenkins instance with /script enabled

An RCE/LFI due to Public Jenkins instance with /script enabled was reported to IBM February 26th, analyzed and has been remediated since March 3rd, 2022. Thank you to Sanjok Karki thesanjok for the finding. RCE/LFI due to Public Jenkins instance with /script enabled...

HackerOne: Private invitation links/tokens leak to third-party analytics site

Summary: Private invite links are normally FILTERED before sending to third-party analytics sites. But it is seen that in few cases where the invitation link that requires users to accept NDA policy, the private invitation links are still sent to third party analytics site. Steps to reproduce 1...

UPS VDP: Admin Authentication Bypass Lead to Admin Account Takeover

Hello Team I found that i can bypass the login page of the Admin account by intercepting the respone of the login request of connectnb.ups.com subdomain and change status from false to true Steps To Reproduce: 1. Open https://connectnb.ups.com/Layout/login 2. Enter Admin as a Username and 1111 as...

GitHub Security Lab: Python: CWE-338 insecureRandomness

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java : Add query to detect Server Side Template Injection (SSTI)

This bug was reported directly to GitHub Security Lab...

TikTok: HTML Injection via Email Share

A HTML injection was found on a TikTok endpoint via the "nameofowner" parameter. We thank @lu3ky-13 for reporting this to our team...

U.S. Dept Of Defense: Military name,email,phone,address,certdata Disclosure

A DoD public facing asset Military was misconfigured and disclosed name, email ,phone address , and certdata of users...

UPchieve: All user password hash can be seen from admin panel

Summary: During my primary research I found that api/users?page=1&userId=&firstName=test&lastName=&email=&partnerOrg=&highSchool= this endpoint gives hashed password of all users. Steps To Reproduce: + Login to Admin and go to Admin-- Search Users. + We see a request like this was send and in...

U.S. Dept Of Defense: SQL Injection in █████

References Impact By using SQL injection, an attacker can exfiltrate the whole database, and gain RCE System Hosts ████ Affected Products and Versions ████ CVE Numbers Steps to Reproduce POC 1 - curl command injecting query, returning database version: curl https://█████████ -X POST...

U.S. Dept Of Defense: Authorization bypass -> IDOR -> PII Leakage

Hi team! During testing ████ I found javascript file containing administrative panel functionality. It is accessible at: https://████/█████████ In this file I found an end point responsible for returning data about applications of the website users to the website administrators. The returned data...

Ruby on Rails: ReDoS in Rack::Multipart

A regular expression denial of service ReDoS vulnerability was discovered in the Rack gem's Multipart module. This vulnerability allowed an attacker to cause a denial of service by sending a specially crafted header, resulting in excessive CPU usage on the server. The vulnerability has been patch...

Shopify: Bypass of fix #1370749

Hello team, on report 1370749 the reporter found that the preview link is not expiring. So when someone will gain access to the preview link, he can access it for whole life as the preview link remains the same even after changing the storefont password. I have reported the issue 1401525 where i ...

Ruby: ReDoS in Psych

The Psych library in Ruby was found to have a ReDoS Regular Expression Denial of Service vulnerability in the parsing of time strings. The vulnerability was identified in the regular expression used to extract date and time information from the input string. The regular expression was susceptible...