Kubernetes: monitoring.prow-canary.k8s.io is vulnerable to CVE-2022-21703 (Grafana 0-day)

The monitoring.prow-canary.k8s.io site was found to be running a vulnerable version of Grafana affected by CVE-2022-21703. This vulnerability could have been exploited by an attacker to escalate their privileges on the Grafana instance through a cross-origin request forgery attack. The issue was...

Omise: Brute force of a current password on a disable 2fa leads to guess password and disable 2fa.

Summary: This Attack happen when victim login in other device and forget to logout ,Then attacker can enable 2-factor authentication by brute fore the password of victim endpoints. Steps To Reproduce: 1Login in https://dashboard.omise.co/signin 2 Click on your username 3Navigate to Two-factor...

Internet Bug Bounty: Ruby CVE-2021-41819: Cookie Prefix Spoofing in CGI::Cookie.parse

Release note: https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/ The old versions of CGI::Cookie.parse applied URL decoding to cookie names. An attacker could exploit this vulnerability to spoof security prefixes in cookie names, which may be...

Semrush: IDOR allowing to read another user's token on the Social Media Ads service

The hotfix was released asap. The investigation showed that there were no cases of vulnerability exploitation. Social Media Ads is a tool for dedicated paid social specialists working with ads. The tool needs to interact with the user's social network account. To do this, Semrush collects a token...

Equifax-vdp: RXSS on https://equifax.gr8people.com on Password Reset page in the username parameter

Hello, While testing your program i came across a website that is owned by informatica and is vulnerable to RXSS on Password Reset page in the username parameter POC:...

Lark Technologies: [AWC-Pune] - User can download files deleted by Admin using shortcuts

A vulnerability was found in where a Lark user could bypass Admin restrictions on deleted files, which typically would block users of the file from downloading or using it. However, the user could add a shortcut of the file to a folder, and upon downloading that folder could access the file...

curl: Occasional use-after-free in multi_done() libcurl-7.81.0

We are seeing the use of a struct connectdata on a thread after it was returned to the connection cache and thus available for use on other threads including potential deallocation in multidone in libcurl-7.81.0. This could occasionally result in an actual use-after-free, witnessed on Windows 10...

UPchieve: No character limit in password field

Hey, when I try to set the password while creating an account into "UPchieve" I noticed that you haven't kept any password limit. You need to decrease password length: There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource...

Rocket.Chat: Maliciously crafted message can cause Rocket.Chat server to stop responding

Vulnerability description not provided...

Reddit: Broken links make users from France unable to understand the allowed content policy

Vulnerability description not provided...

Slack: Email html Injection

This bug is Email html Injection present in name of workspace while creating Impact The input is unsanitized and vulnerable which led to html injection which may lead to phishing. when 2fa is applied it send mail with injected html...

FetLife: Race condition in endpoint POST fetlife.com/users/invitation, allow attacker to generate unlimited invites

This report describes the same bug as 1455487. I rewrite this bug here to make the report clearer. I will self-close 1455487 right now. Description The Invite Your Friend to Join FetLife feature is vulnerable to race condition. By sending many requests at the same time to endpoint POST...

Acronis: [CVE-2021-44228] Arbitrary Code Execution on ng01-cloud.acronis.com

Vulnerability description not provided...

Shopify: Same the Url

Summary: i found the /graphql path and /performancereport with the post method. when i will create page with name /graphql i am not allowed on the grounds it is reserved but i can create page with name performancereport. although both use the same method but only /graphql cannot be created. Shops...

Aiven Ltd: 0-day Cross Origin Request Forgery vulnerability in Grafana 8.x .

Disclaimer To triage, please note that this is still a 0-day that was alerted to Grafana already, in order to make sure the client is safe I report this issue now, please make sure to not spread it further or leak it, as the best interest is to let you be aware and safer from any potential attack...

Rocket.Chat: NoSQL-Injection discloses S3 File Upload URLs

Summary A NoSQL-Injection vulnerability in the getS3FileUrl Meteor server method can disclose arbitrary file upload URLs to users that should not be able to access. Description The fileId argument of the getS3FileUrl Meteor server method is not validated and can contain a regular expression. The...

U.S. Dept Of Defense: Subdomain takeover of █████████

I have found a subdomain of ███████ to be vulnerable to takeovers via a CNAME to unclaimed domain. I have claimed this domain and redirected them to a blank page to prevent a bad actor from doing so in the meantime, and hosted a POC file at obscure URLs. These are the following domains I discover...

JetBlue: Open Redirect

Vulnerability description not provided...

U.S. Dept Of Defense: Reflected XSS at https://█████ via "██████████" parameter

There is Reflected Cross site scripting issue at the following url: https://█████ Proof Of Concept https://████████?█████=%22onfocus%3d%22alertdocument.domain%22autofocus%3d%22&█████████████████████=Search ████ Best Regards @pelegn Impact Cookies Exfiltration SOAP Bypass CORS Bypass Executing...

U.S. Dept Of Defense: Reflected XSS at https://██████████/████████ via "███████" parameter

There is Reflected Cross site scripting issue at the following url: https://████████/█████ Proof Of Concept https://████/███?███=%22onfocus%3d%22alertdocument.domain%22autofocus%3d%22&submit=Search ███ Best Regards @pelegn Impact Cookies Exfiltration SOAP Bypass CORS Bypass Executing javascript o...

Shopify: Limited Privilege User Can Create Unauthorized Referrals on partners.shopify.com

A privilege escalation vulnerability was discovered in Shopify's Partner Portal that allowed users without "View referrals" permission to create POS leads by directly accessing the lead creation URL. The backend API lacked proper authorization checks, enabling users to bypass the implemented...

U.S. Dept Of Defense: Reflected XSS at https://██████/██████ via "██████" parameter

There is Reflected Cross site scripting issue at the following url: https://██████████/██████ Proof Of Concept https://████████/█████████████████=%22%3E%3Csvg/onload=alert1%3E█████████ █████ Best Regards @pelegn Impact Cookies Exfiltration SOAP Bypass CORS Bypass Executing javascript on the victi...

U.S. Dept Of Defense: Reflected XSS at https://██████/██████████ via "████████" parameter

There is Reflected Cross site scripting issue at the following url: https://█████/████ Proof Of Concept https://████████/███████?text=&███=%22%3E%3Csvg/onload=alert1%3E████ ███████ Best Regards @pelegn Impact Cookies Exfiltration SOAP Bypass CORS Bypass Executing javascript on the victim behalf...

U.S. Dept Of Defense: Reflected XSS at https://█████████ via "███" parameter

Description: There is Reflected Cross site scripting issue at the following url: https://█████████ Proof Of Concept https://███████?████████=%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain%3E █████ Best Regards @pelegn Impact Cookies Exfiltration SOAP Bypass CORS Bypass Executing javascript o...

Basecamp: RCE via exposed JMX server on jabber.37signals.com/jabber.basecamp.com

@ian reported that jabber.37signals.com and jabber.basecamp.com exposed on port 555 an unauthenticated Java JMX server which was vulnerable to RCE. We've looked into this and found that we forgot to clean up some DNS records when we decomissioned Jabber so the exposed IP address were not part of...

EXNESS: Improper Implementation of SDK Allows Universal XSS in Webview Leading to Account Takeover

Affected App: Social Trading com.exness.investments App Version: - 2.45.8-release latest on PlayStore Summary: The SurveyMonkey SDK, used to collect surveys from users for analytic and informative purposes, was implemented in an insecure manner in . Particularly, the SMFeedbackActivity was...

GitHub Security Lab: ihsinme: CPP Add a query to find incorrectly used exceptions.

This bug was reported directly to GitHub Security Lab...

Internet Bug Bounty: Invalid handling of X509_verify_cert() internal errors in libssl (CVE-2021-4044)

Internally libssl in OpenSSL calls X509verifycert on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error for example out of memory. Such a negative return value is mishandled by OpenSSL and will cause an IO...

U.S. Dept Of Defense: Arbitrary File Deletion (CVE-2020-3187) on ████████

Hello team, I hope you're doing well, healthy & wealthy. I found an Arbitrary File Deletion CVE-2020-3187 vulnerability on https://██████████/+CSCOE+/sessionpassword.html that allows the Arbitrary File Deletion. References - https://twitter.com/aboul3la/status/1286809567989575685 -...

U.S. Dept Of Defense: CVE-2020-3452 on https://█████/

Hello team, I hope you're doing well, healthy & wealthy. I found a CVE-2020-3452 path traversal and here is the explanation. A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an...

Internet Bug Bounty: Buffer Overflow in optimized_escape_html method

This report is a copy of bug report https://hackerone.com/reports/1328463. I was asked to submit this bug here, because Ruby bug bounty program is moved to this new Internet Bug Bounty program. Operating System ================ Windows 10 This should reproduce in any other operating system where...

8x8: ████ api key exposed in github.com/███/███

@adnanmalikinfo identified a committed API key of a 3rd party SaaS platform for social marketing. We swiftly escalated to the repository owner, who restricted access...

GitHub Security Lab: [Java] CWE-552: Query to detect unsafe request dispatcher usage

This bug was reported directly to GitHub Security Lab...

Weblate: hosted.weblate.org display of unfiltered results

able to request all changes of everything not just sandbox when inserting this %'s in author username on this page. https://hosted.weblate.org/changes/?project=sandbox&lang=en&user=%25%27s&startdate=&enddate= Impact no filter on request feels like elevated permissions. lets you do the search even...

VK.com: Reflected Xss On https://vk.com/search

XSS in Search...

ownCloud: Theft of protected files on Android

There is an issue that allows to retrieve any files from protected directory of application - /data/data/com.owncloud.android/. The issue is caused by exported activity com.owncloud.android.ui.activity.ReceiveExternalFilesActivity with intent filter android.intent.action.SENDMULTIPLE that accepts...

Mars: Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314

The Gutenberg Template Library & Redux Framework plugin version 4.2.11 and below was found to have an unauthenticated sensitive information disclosure vulnerability CVE-2021-38314. The issue was identified where the plugin registered several AJAX actions that were accessible to unauthenticated...

TikTok: Reflected xss on ads.tiktok.com using `from` parameter.

A XSS cross-site scripting vulnerability was found on a TikTok ads endpoint using the "from" parameter. We thank @imrannisar for reporting this to our team and confirming its resolution...

JetBlue: Dom-Based XSS on parameter ?vsid=

Researcher found a DOM XSS vulnerability in one of the JetBlue applications using the vsid parameter. The researcher used the below payload to trigger XSS: ';alert1;//...

MTN Group: POST BASED REFLECTED XSS IN dailydeals.mtn.co.za

Summary: Dear Team , I have found a post based reflected XSS in https://dailydeals.mtn.co.za/ . Steps To Reproduce: 1.Create a html file with following content . "document.forms0.submit 2.Open the HTML file in any web-browser. 3.Cross site Scripting will be triggered . Impact Attacker can exploit...

Nextcloud: com.nextcloud.client bypass the protection lock in andoid app v 3.18.1 latest version.

Summary: nextcloud allowed multiple account within the android client app on a single lock Steps To Reproduce: 1.open nextcloud app 2.add security password to protect the app 3.close the app again open the app and now show the password to open the app 1. so now the password protection bypass lets...

Nextcloud: Nextcloud Deck : Possibility for anyone to add a stack with existing tasks on anyone's board

Hi everyone, Hope you are well ! I found an IDOR vulnerability, allowing any user without privilege to add lists with tasks in any user board. This was tested on a Nextcloud Hub II server v23 with the Deck application in version 1.6.0. Steps To Reproduce: Beforehand: - Have an A user with a board...

Krisp: Visibility Robots.txt file

Issue detail:- The web server contains a robots.txt file. Issue background:- The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site that robots are allowed, or not allowed, to crawl and index. The presence of the...

Recorded Future: Dom Xss vulnerability

Summary: Dom Xss vulnerability Steps To Reproduce: add details for how we can reproduce the issue 1. Go to this link: https://api.recordedfuture.com/index.html 2. Open chrome devtool and go to console tab 3. Type: document.write'...alert1...'; 4. And boom! Alert 1! Impact XSS can have huge...

MTN Group: Remove Every User, Admin, And Owner Out Of Their Teams on developers.mtn.com via IDOR + Information Disclosure

Hello world, This vulnerability is too involved with regular users, in order for us to prevent any damage, we need 3 different user accounts we own. This gives us specific "userid" and "teamid" to work with. There's an Information Disclosure as a side effect of this vulnerability. User and team...

Rocket.Chat: TOTP 2 Factor Authentication Bypass

Summary Two Factor Authentication can be bypassed when telling the server to use CAS during login. Description The 2FA Login Handler skips validation when it finds CAS enabled. When the clients sends the option among the login request, the login proceeds without validation of a second factor. In...

GitHub Security Lab: [Javascript]: [Clipboard-based XSS]

This bug was reported directly to GitHub Security Lab...

JetBlue: Sensitive information disclosure on grafana

Sensitive information was disclosed through publicly accessible Grafana metrics, SAP public info endpoints, and an AWS bucket listing...

MTN Group: Firebase Database Takeover in https://pulseradio.mtn.co.ug/

Summary: During my test , in one of the subdomain of mtn.co.ug I found firebase configuration disclosed in the source code along with apiKey and database URL . Exploiting this vulnerability attacker is able to upload malicious data in the firebase account of pulseradio.mtn.co.ug and see database...

Rocket.Chat: Authentication Bypass in login-token Authentication Method

The Rocket.Chat application contained a vulnerability in the login-token authentication method that allowed for authentication bypass. Improper input data validation in the login-token authentication handler permitted the use of crafted data to obtain a valid authToken, granting administrative...