Acronis: [forum.acronis.com] JNDI Code Injection due an outdated log4j component

Vulnerability description not provided...

RubyGems: Dependency repository hijacking aka Repo Jacking from GitHub repo rubygems/bundler-site & rubygems/bundler.github.io + bundler.io docs

Dependency repository hijacking aka repo jacking is an obscure supply chain vulnerability, conceptually similar to subdomain takeover. When the linked repository owner changes their username, it becomes immediately available to be re-registered by anyone. This means that any project that linked...

Node.js: Node.js Certificate Verification Bypass via String Injection

This is a report on behalf of Google, who did not want to report through H1. --- Summary Node’s APIs for reporting certificate fields are ambiguous and allow bypassing certificate verification in some circumstances. Details In light of CVE-2021-3712, I’ve been looking at code which misuses...

Ruby on Rails: Subdomain Takeover at https://new.rubyonrails.org/

Disclaimer I know it's OOS but the issue is pretty serious because of the attractive domain name "new.rubyonrails.org" basically anyone could have put malware there. Summary Hi! I discovered that new.rubyonrails.org was pointing to an unclaimed Github Page, making it vulnerable to subdomain...

U.S. Dept Of Defense: Log4Shell: RCE 0-day exploit on █████████

Hi team, log4 shell is recent 0-day exploit it's Java package vulnerable. ██████████ domain is vulnerable Impact RCE System Hosts █████████ Affected Products and Versions CVE Numbers CVE-2021-44228 Steps to Reproduce 1. Go to this url =...

Showmax: Race Condition Vulnerability when creating profiles

Summary:This report describes a Race Condition Vulnerability which allows a user to create more profile as he wish which contradict your business logic, I was only allow to create six profiles on my account but using this bug I was able to create free 30 profiles. Description: There is a race...

Dropbox: Send Fax from Anyone's HelloFax Account Due to Misconfigured Email Validation

The report demonstrates a method of using up HelloFax credits by forging email requests. A fix for the issue has been released and it was applied for existing and new users through an automatic update. An attacker could exploit this vulnerability by entering a victim’s HelloFax line number into a...

Judge.me : Stored XSS in Question edit for product name (bypass #1416672)

Hi @judgeme! Step to reproduce: 1. Log in to your shopify account and create product with name img src=x onerror=promptdocument.domain img src=x onerror=promptdocument.domain 2. Go to our store and write question to our product with name img src=x onerror=promptdocument.domain img src=x...

Judge.me : Log4j RCE on https://judge.me/reviews

Summary: CVE-2021-44228, also named Log4Shell or LogJam, is a Remote Code Execution RCE class vulnerability. If attackers manage to exploit it on one of the servers, they gain the ability to execute arbitrary code and potentially take full control of the system. What makes CVE-2021-44228 especial...

MTN Group: path traversal vulnerability in Grafana 8.x allows " local file read "

Hi team, I've found a path traversal issue in the Grafana instances hosted on the MTN platforms. With the path traversal it's possible for an unauthenticated user to read arbitrary files on the server. This IP " 41.242.91.22 " Domain Name " mtn.com.gn " is for MTN Group F1545670 F1545682 Steps To...

Reddit: No rate limit on password reset leads to email enumeration at gateway-production.dubsmash.com

Summary: i found brute force on gateway-production.dubsmash.com . find valid usersnames and emails no rate limit Impact: attacker could collect all usernames and valid emails through brute force on forget password Steps To Reproduce: open gateway-production.dubsmash.com and forget email and enter...

Judge.me : stored XSS on AliExpress Review Importer/Products when delete product

Hi @judgeme! code Step to reproduce: 1. Go to Shopify admin and create product with name "" img src=x onerror=prompt 2. Go to AliExpress Review Importer/Products and delete our product with name " img src=x onerror=promptdocument.domain F1544890 3. Xss work= P.S. Poc wideo attach F1544893 Impact...

MTN Group: Remote code injection in Log4j on https://mymtn.mtncongo.net - CVE-2021-44228

The website https://mymtn.mtncongo.net was vulnerable to remote code injection due to the CVE-2021-44228 vulnerability in the Log4j library. This critical vulnerability allowed for remote command execution...

MTN Group: Remote code injection in Log4j on http://mtn1app.mtncameroon.net - CVE-2021-44228

The vulnerability CVE-2021-44228, a remote code injection flaw in Log4j, was discovered on the website http://mtn1app.mtncameroon.net. The vulnerability was confirmed to be present on the ports 8080 and 8443 of the website. The issue was demonstrated by retrieving the hostname of the affected...

Acronis: [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-day

Summary The website at nps.acronis.com is vulnerable to CVE-2021-44228 Steps To Reproduce I used this script to find this. It spins up an interact-sh server to receive the callback and send the payload in the query string and about 30 diffent headers. You can reproduce manually with curl and...

FetLife: Able to access private picture/video/writing when requesting for their JSON response

Description Endpoint https://fetlife.com/users/user-id/pictures/pic-id has 2 types of responses, HTML and JSON. The type of response depends on Accept header of request it get. If request contains Accept: application/json, then it will return JSON response. Other than that, it returns HTML...

Glassdoor: Web Cache Poisoning leads to Stored XSS

@bombon reported to us a web cache poisoning issue that led to caching of gdTokenAnti-CSRF token across different Glassdoor pages and in some instances could be chained to perform XSS by caching the XSS payload. This has now been resolved using CF web cache armor and cache-control headers...

FetLife: Able to detect if a user is FetLife supporter although this user hides their support badge in fetlife.com/conversations/{id} JSON response

UserA is a FetLife supporter, he also hides his support badge in his account privacy setting so that people don't know he is a supporter. However, UserB can start a conversation with userA, and by looking at issupporter field in JSON response of their conversation . UserB knows that UserA is a...

U.S. Dept Of Defense: ██████████ running a vulnerable log4j

Description: https://vulners.com/cve/CVE-2021-44228 Impact Probably arbitrary code execution System Hosts ████████ Affected Products and Versions CVE Numbers CVE-2021-44228 Steps to Reproduce 1. Browse to https://████████/███████https%3A%2F%2F█████████%2F 2. Enter a...

U.S. Dept Of Defense: Wrong settings in ADF Faces leads to information disclosure

Hello, Team. Found some interesting links which leads to information disclosure in █████ Link 1: █████████████ Link 2: ██████████████████ Link 3: █████████████ Every link goes through https://██████to https://████ For Link 3 is possible to change data in the fields: First Name, Last Name, Phone...

Yelp: Fraudulent claim of business.

Vulnerability description not provided...

Shopify: Direct Access To admin Dashboard

This issue affect two Subdomains, https://data-stories-website.shopifycloud.com/admin.php and https://datastories.shopify.com/admin.php Summary: Hi Team, When Link to https://datastories.shopify.com/admin or https://data-stories-website.shopifycloud.com/admin the subdomain redirect you to...

Judge.me : Error Page Content Spoofing or Text Injection

Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, an attacker can supply conten...

X (Formerly Twitter): Link-shortener bypass (regression on fix for #1032610)

Report 1032610, entitled Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking links was closed as Resolved about six months ago. However, a regression on the fix for the vulnerability in question seems to have occurred, and the bug is reproducible with the...

lemlist: [app.lemlist.com] Improper handling of payment lead to bypass payment

Summary: Hello Team, I truly hope it treats you awesomely on your side of the screen : due to improper handling of payment methods, an attacker can easily bypass the payment and benefit from a paid plan. Steps To Reproduce: 1. Log to your account 1. Go to the billing page 1. Fill in the address t...

Expedia Group Bug Bounty: Reflected XSS Via origCity Parameter (UPPER Case + WAF Protection Bypass)

Vulnerability description not provided...

Krisp: Force User to Accept Attacker's invite [ Restrict user to create account]

@sammam has found an issue that would enable an attacker to restrict any user from creating a new account without accepting an attacker sent invitation. We would like to thank @sammam for reporting it responsibly to our bug bounty program !...

Cloudflare Public Bug Bounty: Hijack all emails sent to any domain that uses Cloudflare Email Forwarding

The Email Routing feature enables Cloudflare users to create any number of custom email addresses and route all incoming messages to the user's preferred inboxes. Due to a bug in zone ownership verification, it was possible to configure Email Routing to redirect e-mail messages for an unverified...

MariaDB: Grafana LFI on https://grafana.mariadb.org

Hello team, There is an LFI on https://grafana.mariadb.org/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../etc/passwd F1537157 Impact LFI...

QIWI: disclosing clients' secret keys https://stage-uapi.tochka.com:2000/

The reporter has found an open URL on a staging server leaking client IDs and client secrets used in oauth2...

Aiven Ltd: Apache Flink RCE via GET jar/plan API Endpoint

Summary: Aiven has not restricted access to the GET jars/jarid/plan API. This endpoint can be used to load java class files with the specified arguments that are in the java classpath on the server. This can be abused to gain RCE on the Apache Flink Server. Steps To Reproduce: The video below sho...

TikTok: Clickjacking Vulnerability In Whole Page Ads Tiktok

A clickjacking vulnerability was found on a TikTok Ads endpoint, where an attacker, once obtaining the ID, could trick another user to perform actions such as creating or deleting campaigns. We thank @rioncool22 for reporting this to our team...

Krisp: [api.krisp.ai] Race condition on /v2/seats endpoint allows bypassing the original seat limit

Security researcher has found a race condition on one of our endpoints which was effectively bypassing maximum seats limit, We would like to thank @alp for reporting it responsibly to our bug bounty program ! I found a race condition issue at the /v2/seats endpoint. It allowed bypassing maximum...

SecurityScorecard: RXSS

Finding an OWASP Top 10 vulnerability is quite common unfortunately. We are glad that our HackerOne VDP has identified this issue and that it is resolved...

8x8: Exposed kubernetes dashboard

The researcher found an exposed Kubernetes Dashboard. It was short lived as our developers were doing some testing and terminated the instance shortly after. The related instance did not contain anything sensitive...

8x8: Default credentials lead to Spring Boot Admin dashboard access

An instance hosting Spring Boot Admin was left exposed with default credentials set. The related instance did not contain anything sensitive. The issue has been rectified...

Shopify: Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.php

Hey team I found the admin panel at https://plus-website.shopifycloud.com/admin.php?page=1 exposed without authentication Impact attacker can destroy and edit data...

GitLab: Installing Gitlab runner with Docker-In-Docker allows root access

Summary Installing a Gitlab runner using official documents: https://docs.gitlab.com/ee/ci/docker/usingdockerbuild.htmluse-docker-socket-binding allows any user with access to Gitlab CI to have root access on Gitlab Runner server. Steps to reproduce Install Gitlab-runner binary using official...

Courier: Missing SPF record on trycourier.app

Missing SPF record on trycourier.app domain which has been retired a while ago...

Judge.me : Stored XSS in Question edit from product name

Hi @judgeme! Step to reproduce: 1. Log in to your shopify account and create product with name "img src=x onerror=prompt 2. Go to our store and write question to our product with name "img src=x onerror=prompt 3. Then go to Shopify admin/Judge.me Product Reviews/Questions and edit question. XSS...

Paragon Initiative Enterprises: Recaptcha Secret key Leaked

Greeting from @kashifinfo90, I hope Paragonie Security Team is doing great, Following Secret Keys are leaked: "secret-key": "6Ldy5BYTAAAAAPBh868BMm2nGZelOUyXJHTUE4no", "site-key": "6Ldy5BYTAAAAACk3Tj8wDUBLcVxSL2JXFBw-Dtj3" "secret-key": "6Ld27iETAAAAAF6tsd5SaoCgc5cFX-tkfHqx7FtX", "site-key":...

TikTok: Clickjacking Vulnerability Can Leads To Delete Developer APP

A clickjacking vulnerability was found on a TikTok subdomain, where an attacker could trick another user into deleting the Developer App. We thank @rioncool22 for reporting this to our team...

U.S. Dept Of Defense: [CVE-2020-3452] Unauthenticated file read in Cisco ASA

I found out that https://███/ was vulnerable to CVE-2020-3452. The IP has a SSL certificate pointing to DoD. curl -kv https://██████████/ Output: Server certificate: subject: █████ Impact Anyone can read any file present on the server. System Hosts ████ Affected Products and Versions CVE Numbers...

Aiven Ltd: Zero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file read

Summary: Hi team, I've found a path traversal issue in the Grafana instances hosted on the Aiven platforms. With the path traversal it's possible for an unauthenticated user to read arbitrary files on the server. Steps To Reproduce: 1. Login at https://console.aiven.io 1. Create a new Grafana...

Django: Deserialization of potentially malicious data to RCE

Hello, Django Team! It's my first time working with you, hope it will be great! Note: I have not seen this issue neither in known vulnerabilities nor in documentation, so here I am. Summary Several type of caches in https://github.com/django/django/tree/main/django/core/cache/backends use python...

Elastic: Default password on 34.120.209.175

There is a default password on 34.120.209.175, I can log in successfully.It has 500 Server Error, But we can confirm default password is vaild. Summary: The IP has a SSL certificate pointing to ElasticSearch. curl -kv https://34.120.209.175 Steps To Reproduce: 1. access...

GitHub Security Lab: [Java] CWE-400: Query to detect uncontrolled thread resource consumption

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [porcupiney.hairs]: [Python] Add Flask Path injection sinks

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: ihsinme: CPP Add query for CWE-675 Duplicate Operations on Resource

This bug was reported directly to GitHub Security Lab...

Ruby on Rails: Escape Sequence Injection vulnerability in Rack

An escape sequence injection vulnerability was discovered in the Rack framework's commonlogger. This vulnerability allowed an attacker to inject escape sequences into logs, potentially leading to the execution of dangerous control characters on a victim's terminal emulator...