Twitter: Delete direct message history without access the proper conversation_id

Hello Team i found a bug in your system this bug already fixed as i know,but i try this another way, and its worked, this is why i report it the bug is i was able to delete message history without access the proper conversation id user 1 id: 1234 user 2 id: 5678 their conversation look like...

Sifchain: Subdomain Takeover on proxies.sifchain.finance pointing to vercel

Hello Team, Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that subdomain...

Mattermost: Invitation Email is resent as a Reminder after invalidating pending email invites

An issue was found in Mattermost's workspace invite system that allowed unwanted users to join a workspace, leading to potential information disclosure. The vulnerability was caused by the lack of an option to cancel an invite, which could be exploited by an attacker to join a workspace even if t...

8x8: subdomain takeover (abandoned Zendesk █.easycontactnow.com)

@bx1 reported to us an issue with a CNAME record which pointed to a subdomain outside of 8x8's control - to an abandoned Zendesk instance. We've deleted the DNS record and rectified the issue...

HackerOne: [Bypass] Ability to invite a new member in sandbox Organization

Summary: Able to bypass the restriction set in Organization sandbox automatically created when you created sandbox program to send an invite to another security researcher. Description: In the default UI of sandboxHackerone Organization, inviting another security researcher is restricted ex.:...

Acronis: Session Fixation on Acronis

Hi there, The application does not set a new Session ID in the cookie after what appears to be an authentication attempt by the user. If this was a successful login and the Session IDs are stored in cookies then this application is affected by Session Fixation vulnerability. Steps To Reproduce...

lemlist: Security misconfiguration

Description : When we request a magic link to login into the application, and use that same link in multiple browsers, it working there isn't any limit on use of link. Steps to reproduce : 1. go to app.lemilist.com 2. create a magic link 3. use it to login 4. now open another browser or incognito...

8x8 Bounty: admin.8x8.vc: Member users with no permission can integrate email to connect calendar via GET /meet-external/spot-roomkeeper/v1/calendar/auth/init?..

An improper access control vulnerability was discovered on the admin section of 8x8's video conferencing platform. Member users with no permission were able to exploit this vulnerability to integrate their email and connect their calendar to the platform. This allowed them to access areas they we...

Basecamp: Improper Authentication via previous backup code login

HI Basecamp, I would like to report Improper Authentication in basecamp. Attacker is able to login at victim account once victim update his password. attacker knows with victims email █████████ password uhn123HH victim updates his password uhn123HHjcc Step To Reproduce ==Attacker== - Step1 attack...

Ruby: ReDoS in IPAddr

The Ruby IPAddr library was found to be vulnerable to a ReDoS Regular Expression Denial of Service vulnerability. The vulnerability was identified in the mask! method, which used a regular expression that was susceptible to exponential backtracking when processing malformed input. This could have...

Ruby: ReDoS in Time.rfc2822

A regular expression denial of service ReDoS vulnerability was discovered in the Time.rfc2822 method in Ruby's time library. An attacker could exploit this vulnerability by providing a specially crafted input to the method, causing it to enter an infinite loop and consume excessive CPU resources...

Kubernetes: File Read Vulnerability allows Attackers to Compromise S3 buckets using Prow

A vulnerability was found in AWS Prow that allowed attackers to sign the base path of S3 buckets used by Prow, leading to the dumping of the entire private bucket details and reading any file in the bucket. This could result in the compromise of S3 buckets containing production data...

curl: Use of Unsafe function || Strcpy

Summary: It was observed that application is using strcpy function which may cause buffer overflow attacks. Affected Code https://github.com/curl/curl Affected Lines 1. Line 195 of curl-master\tests\libtest\stubgssapi.c 2. Line 204,212,216 curl-master\tests\server\socksd.c Steps To Reproduce: Let...

TikTok: Information Leakage via TikTok Ads Web Cache Deception

A theoretical web cache deception vulnerability was found on TikTok Ads, that could have resulted in information leakage if clicked on by an authenticated user. We thank @arifmkhls for reporting this to our team and confirming its resolution...

Automattic: De-anonymize anonymous tips through the Tumblr blog network

Hey y’all! 👋 Hope all is well! Summary: I noticed that, if you send an anonymous tip through the Tumblr dashboard, you can be de-anonymized through the notes view on the blog network & maybe elsewhere?. Platforms Affected: All platforms, but requires a blog that is served on the blog network. Ste...

GitHub Security Lab: [C#] CWE-759: Query to detect password hash without a salt

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CPP: Add query for CWE-266 Incorrect Privilege Assignment

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java]: CWE-073 - File path injection with the JFinal framework

This bug was reported directly to GitHub Security Lab...

Stripe: CSRF token validation system is disabled on Stripe Dashboard

@dsharad discovered that due to a code change deployed on 2/14/2022, Cross Site Request Forgery CSRF protection was disabled in the Stripe Dashboard. This could have allowed an attacker to trick a victim user to visit a malicious website and cause limited changes to the victim’s Stripe account su...

U.S. General Services Administration: Account takeover leading to PII chained with stored XSS

I have found a vulnerability on https://vehiclestdb.fas.gsa.gov/ for account takeovers The website is not using proper authentication to claim the user signing in is actually the account owner due to only requiring an email address to sign in and no password. This leads to an attacker being able ...

Alohi: Misconfigured rate limit for SMS phone verification endpoint

One of our rate-limit configurations had a high threshold, allowing attackers to spam request multiple SMS codes by replicating the network request to a phone number before getting blocked...

MTN Group: Insecure Storage of Sensitive Information on lonestarcell.com server

Hello , i hope your doing well i found some sensitive information disclosure at those endpoint it is disclosure server status and some other stuff https://simregistration.lonestarcell.com//monitoring/DB02/DB02.htmlSystem https://simregistration.lonestarcell.com//monitoring/DB01/index.html...

SecurityScorecard: HTML injection through Invite Teammate email

Summary: I found HTML injection on domain https://platform.securityscorecard.io/ when we send invite teammate email. In this case "message" parameter is vulnerable. Steps To Reproduce: 1. Go to page https://platform.securityscorecard.io/ and login. 2. Now go to page...

GitHub Security Lab: Java: An experimental query for ignored hostname verification

This bug was reported directly to GitHub Security Lab...

GitLab: Stored XSS in Notes (with CSP bypass for gitlab.com)

Summary I read the issue 345657 which handles the XSS in notes reported in Hackerone report 1398305. This issue fixes the reported XSS but leaves the HTML injection that was also mentioned. I don't know how you deal with these situations, but I thought I report this, and you can decide : The issu...

Reddit: CSRF (protection bypassed) to force a below 18 user into viewing an nsfw subreddit !

Summary of the Issue A state-changing POST request to https://old.reddit.com/over18? lacked proper modhash validator leaving the sensitive action vulnerable to CSRF attacks. An attacker can trick users into executing the action, enabling/disabling "I am over eighteen years old" and willing to vie...

8x8 Bounty: jaas.8x8.vc: Removed users can still have READ/WRITE access to the workspace via different API endpoints

An improper access control vulnerability was discovered in jaas.8x8.vc, where removed users could still have READ/WRITE access to the workspace via different API endpoints, if they were logged in and saved their session cookies. The issue was resolved by fixing the session management...

Omise: Open redirect Via X-Forwarded-Host

The vulnerability found involved an open redirect issue on the dashboard.omise.co website. The issue was reported on February 8, 2022, where it was discovered that the open redirect could be abused by the attacker through the use of the X-Forwarded-Host header...

TikTok: Instance Page DOS within Organization on TikTok Ads

A vulnerability was found on the Instance Page service of TikTok Ads, which would allow an Operator to perform a Denial of Service DoS on the Front End of only their own organization. We thank @arsenelupin for reporting this to our team...

Cloudflare Public Bug Bounty: HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() function

The Edge Rules engine used by Cloudflare Transform Rules features string modifying functions like lower and concat, which accepted hexadecimal-encoded characters such as ”\x0a\x0d“. This allowed for manipulation of request headers e.g. injecting an additional header and, as a consequence, made HT...

Showmax: Cross-origin resource sharing

A misconfiguration on recent deployment caused CORS headers not to be set on the https://stories.showmax.com service. While no customer data could be exposed via this channel, it's a good practice to set CORS headers if possible. Please note that CORS is actually out-of-scope of our program since...

Elastic: CSRF in AppSearch allows creation of "curations"

Summary Hello team! The curations creation for AppSearch engines can happen on a GET request which means there's no CSRF protection. Steps to reproduce 1. In one tab visit this page on my Elastic Cloud instance:...

Nextcloud: Information Exposure Through Directory Listing vulnerability

A directory listing provides an attacker with the complete index of all the resources located inside of the directory as well as download or access its contents. While the researcher did not dig deeper on to the available files, it might be possible that these websites host sensitive information...

TikTok: IDOR delete any Tickets on ads.tiktok.com

An IDOR Insecure Direct Object Reference vulnerability was found on TikTok ads, through the "draftorderid" parameter which could have allowed an attacker to delete the support tickets of other users. We thank @datph4m for reporting this to our team and confirming its resolution...

Zenly: Subdomain Takeover of brand.zen.ly

Hello Gents, Background: + Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to...

8x8 Bounty: connect.8x8.com: admin user can send invites on behalf of another admin user via POST /api/v1/users/<User ID>/invites

Vulnerability description not provided...

Omise: Open S3 Bucket Accessible by any User

hi team, here i found Open S3 Bucket Accessible by any User vulnerable URL: https://cdn2.omise.co/ bucket name : omise-cdn-2 I haven't tried this yet as it may delete the bucket. it is possible an Attacker can delete the bucket using this command:- $ aws s3 rb s3:// and claim the bucket again to...

8x8 Bounty: connect.8x8.com: deactivated users remain access to /api/v1/users/UUID/roles

Vulnerability description not provided...

U.S. General Services Administration: IDOR at https://demo.sftool.gov/TwsHome/ScorecardManage/ via scorecard name

Hi Team, I have found a broken access control vulnerability on https://demo.sftool.gov/ under your /tws directory. I made two accounts. One account i browsed to /tws and created a new scorecard. Here i can submit all information I need. The scorecard name is in the end of the URL...

Shopify: Xss triggered in Your-store.myshopify.com/admin/apps/shopify-email/editor/****

Hi team, I have found Store Xss in shopify-email Reproduction Instructions / 1.Configure shopify-email for Shopify stores at https://apps.shopify.com/shopify-email 2.Goto Your-store.myshopify.com/admin/apps/shopify-email/template-branding 3.Change F1607675 with " click Save. 4.Now Select any...

Alohi: Misconfigured rate limit at app.sign.plus/forgot_password

shamim12 found a weakness in our rate-limiting mechanism, allowing an attacker to bypass rate limits and spam the endpoint for requesting a password reset email. There was no effect on other API endpoints and no direct security implication, except email spamming attacks. The issue has been fixed...

GitHub Security Lab: [Python]: Add shutil module sinks for path injection query

This bug was reported directly to GitHub Security Lab...

Lark Technologies: Normal User is able to EXPORT Feature Usage Statistics

A vulnerability was found where certain Lark endpoints did not properly validate user permissions, allowing a low-privileged user to generate and download usage statistics information. We thank @aishkendle for reporting this to our team...

curl: Binary output bypass

Binary output check bypass Summary: When curl outputs content, it checks for binary output. If the output is large enough, it bypasses the check for binary output. This can mess with the terminal. Steps To Reproduce: 1. Setup a server of your choice. 2. Create a function f with these arguments:...

Dropbox: Exfiltrate GDrive access token using CSRF

The report demonstrates a method of redirecting Google Drive OAuth tokens from Dropbox. A fix for the issue has been released and it was applied for existing users through an automatic update. An attacker could exploit this vulnerability by getting a user to visit a specially-crafted link that se...

8x8: Open Redirect on https://██.8x8.com/login?nextPage=%2F

@ig420vrush reported to us an Open Redirect after login in a 3rd party referral platform. We swiftly relayed this to the vendor and their engineering team fixed the affected code, which resolved the issue...

Cloudflare Public Bug Bounty: Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfiguration

Cloudflare uses Sentry for application monitoring and error tracking. Due to the tool's misconfiguration source code scraping feature enabled, it was possible to sent blind requests to any endpoints using the Cloudflare infrastructure. The issue has been fixed by the Engineering team and the sour...

Omise: Brute force attack of current password on login page by bypassing account limit using IP rotator(https://dashboard.omise.co/signin)

brute force...

Kubernetes: Broken link hijacking in https://kubernetes-csi.github.io/docs/drivers.html?highlight=chubaofs#production-drivers

Report Submission Form Summary: When a web application has any pages, sources, links to external 3rd party services and are broken then the attacker can claim those endpoints to successfully conduct the attack and claim those endpoints on behalf of the target website and impersonate his identity...

Shopify: User with no Develop apps permission can Uninstall Custom App

Hi, You know user must have Develop apps permission to Uninstall Develop apps to test this just create staff with Manage and install apps and channels F1601504 send this mutation just change appId by your id...