15405 matches found
U.S. Dept Of Defense: Open Akamai ARL XSS at ████████
Summary There is Open Akamai ARL XSS at ████████ Proof-of-Concept http://████/7/0/33/1d/www.citysearch.com/search?what=Binit&where=Binit%22%3E%3Cimg%20src%3Dbinit%20onerror%3Dalert%28document.domain%29%3E References: - https://github.com/war-and-code/akamai-arl-hack -...
Brave Software: unclaimed s3 bucket takeover in the 3 js file located on the github page of brave software
Summary: There is a unclaimed s3 bucket i.e brave-extensions.s3.amazonaws.com located in the 3 .js file on official brave software github page https://github.com/search?q=org%3Abrave+brave-extensions+language%3AJavaScript&type=Codethe attacker can takeover the bucket and create file that is used ...
Tor: Information Exposure Through Directory Listing
Vulnerability description The web server is configured to display the list of files contained in this directory. This is not recommended because the directory may contain files that are not normally exposed through links on the web site. Link as POC: https://www.torproject.org/static/...
U.S. Dept Of Defense: Open Akamai ARL XSS on http://master-config-████████
The Open Akamai ARL on http://master-config-████████ was found to be vulnerable to a Reflected Cross Site Scripting XSS vulnerability. The vulnerability was discovered in the "what" and "where" parameters of the search functionality. The vulnerability allowed the execution of arbitrary JavaScript...
U.S. Dept Of Defense: Open Akamai ARL XSS on http://media.████████
The Reflected Cross-site Scripting XSS vulnerability was discovered on the http://media.████ website. The vulnerability allowed the execution of arbitrary JavaScript code by injecting it into the vulnerable URL parameter. The vulnerability was found to be present in the Akamai ARL Adaptive Delive...
MTN Group: Otp bypass in verifying nin
Summary: while conducting my research in your website I found that while verifying NIN number it send the otp to the enterd mobile number that can be bypassed. Steps To Reproduce: 1 Go to https://nin.mtnonline.com/nin/ 2 click submit nin.Now it will redirect to another page...
LY Corporation: Improper authorization allows disclosing users' notification data in Notification channel server
LINE Channel authentication provides separate authentication tokens for each LINE Channel. Due to the bug in the authentication process in the Notifications Channel service, it could be possible for an attacker to get the Notifications Channel data of another user by using their valid...
U.S. General Services Administration: Path Traversal on meetcqpub1.gsa.gov allows attackers to see arbitrary file listings.
Summary: Path Traversal on meetcqpub1.gsa.gov allows attackers to see arbitrary file listings from a directory of their choice. I wasn't sure if this page was in scope of this program or the TTS program, hopefully this isn't a problem Steps To Reproduce: 1. Navigate to the following URL -...
Pornhub: Deserialization of untrusted data at https://www.redtube.com/media/hls?s=data
The researcher was able to exploit a PHP Object Injection vulnerability which allowed him to execute remote commands on the server...
Affirm: Subdomain takeover due to non registered TLD [ ██████████.█████.██████.com ]
Summary: I was looking at recent disclosed report 1297689 and I was thinking to take a look for the same issue on this asset as I love to test for subdomain takeover vulnerabilities. While testing I noticed a DNS entry for ███████.████.██████████.com is CNAME ████.███████████ which's TLD is not...
XVIDEOS: Text injection or content spoofing on forbiden page
hello Team, while enumerating directories of xvideos.com i found that 403 forbiden directories are refleting on the page , so i created some custom words to change the mind of customers that the website is under construction so please visit attaker site. reproduction speps: domain : www.xvideos.c...
Reddit: Open Redirect through POST Request in www.redditinc.com
Summary: Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain. This behavior can be leverag...
Sony: Reflected XSS on ███ via jobid parameter
The researcher reported that a URL parameter of a Sony website was vulnerable to reflected XSS. The researcher used the JavaScript onpointerleave event to trigger the XSS payload...
UPchieve: Widespread CSRF on authenticated POST endpoints
Summary: Cross-Site Request Forgery CSRF is possible on most, if not all, authenticated POST endpoints. While CORS is configured such that the Access-Control-Allow-Origin header is set to Access-Control-Allow-Origin: hackers.upchieve.org, CORS does not prevent CSRF - it only prevents the attacker...
U.S. Dept Of Defense: Reflected XSS [██████]
Reflected cross-site scripting XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. An attacker can execute JavaScript arbitrary code on the victim's session. Steps To Reproduce Go to this URL:...
U.S. Dept Of Defense: Reflected XSS [██████]
Reflected cross-site scripting XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. An attacker can execute JavaScript arbitrary code on the victim's session. Steps To Reproduce Go to this URL:...
U.S. Dept Of Defense: Reflected XSS [███]
Reflected cross-site scripting XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. An attacker can execute JavaScript arbitrary code on the victim's session. Steps To Reproduce Go to this URL:...
Basecamp: Privilege Escalation leads to trash other users comment without having admin rights.
Privilege Escalation leads to trash other users comment without having admin rights...
Revive Adserver: Use of a Broken or Risky Cryptographic Algorithm
revive-adserver utilizes a PRNG for session-token generation, this means that an attacker could theoretically be able to generate session tokens at random and take over accounts at random. This function does not generate cryptographically secure values, and should not be used for cryptographic...
MTN Group: There is no rate limit for SME REGISTRATION PORTAL
Summary: The speed limit for the https://mtngbissau.com/registo/ endpoint has not been implemented. Steps To Reproduce: 1. Go to the https://mtngbissau.com/registo/ 2. fill out the Registration form 3. Send request to Intruder. 4. Set your payloads and start attack. 5. There is no rate-limit...
U.S. Dept Of Defense: XSS because of Akamai ARL misconfiguration on ████
Hello team, I hope you're doing well & healthy. I found a reflected XSS because of the misconfiguration of Akamai ARL. ███████ References - https://github.com/war-and-code/akamai-arl-hack - https://twitter.com/SpiderSec/status/1421176297548435459 - https://warandcode.com/post/akamai-arl-hack/ -...
U.S. Dept Of Defense: Reflected XSS at ████ via ██████████= parameter
Hi I found that this endpoint is vulnerable with Reflected XSS, The ███= parameter is vulnerable with RXSS PoC: ██████████?████████=%253Cimg/src/onerror=alertdocument.domain%253E Payload: Regards Impact RXSS System Hosts www.███ Affected Products and Versions CVE Numbers Steps to Reproduce...
LY Corporation: Bot setting information leakage in OpenChat room
Due to the bug in the authority verification process, it could be possible for the non-admin users to see settings details for Line OpenChat Admin Bot, such as saved scheduled messages and auto-responses...
UPchieve: i can join without user and pass in this website https://argocd.upchieve.org/settings/accounts
Summary: i can see the Content Steps To Reproduce: the wbsite is not good 1. if i join this website i can see Content https://argocd.upchieve.org/settings/accounts Supporting Material/References: you most need good programmers https://argocd.upchieve.org/settings/accounts Recommendations for...
Ruby on Rails: Sauce Labs API key unencrypted in an old commit
Vulnerability description not provided...
Nextcloud: Arbitrary read of all SVG files on a Nextcloud server
Vulnerability description not provided...
GitHub Security Lab: Java: Timing attacks while comparing results of cryptographic operations
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [C#]: HttpOnly and Secure Cookies for .NET Core and .NET
This bug was reported directly to GitHub Security Lab...
Ruby: Bug Report : [ No Valid SPF Records ]
Hi Team, Hope you are doing well. I found vulnerability in your web app URL : https://www.ruby-lang.org/en/s Description : There is an email spoofing vulnerability. Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than...
UPchieve: CLICKJACKING LEADS TO DEACTIVATE ACCOUNT
Hello UPCHEIVE SECURITY TEAM, I'm Anto Vulnerability : Clickjacking in https://hackers.upchieve.org/profile Steps to Reproduce: 1. Create a HTML file with following code Click the place where its shows Click 1 Click 2 Click 2 2, Save and Open it on your browser the page will be appear. Impact An...
Ruby on Rails: Possible DOS in app with crashing `exceptions_app`
Vulnerability description not provided...
U.S. Dept Of Defense: Sensitive information on '████████'
Hi team, i found a sensitive file hosted on '█████████' that i think must be not public accessible due to the wording "███████" Vulnerable Endpoint: https://█████████/████████ ██████████ Impact Sensitive information pubblicy accessible System Hosts ████████ Affected Products and Versions CVE...
U.S. Dept Of Defense: Sensitive information on ██████████
Hi team, i found a sensitive file hosted on '████' that i think must be not public accessible due to the wording "████████" Vulnerable Endpoint: https://██████ █████████ Regards Impact Sensitive information pubblicy accessible System Hosts ██████████ Affected Products and Versions CVE Numbers Ste...
Elastic: blind Server-Side Request Forgery (SSRF) allows scanning internal ports
A blind Server-Side Request Forgery SSRF vulnerability was found on a website, allowing an attacker to scan internal ports. The vulnerability could not be used to read HTTP responses, but could be used for reconnaissance purposes, such as port scanning by measuring response time...
VK.com: Баг с оплатой подписки
Недостаточная валидация...
Reddit: Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote API
Summary: Attacker that does not have access to a private subreddit, can still affect Upvote Percentage of any posts in this private subreddit. He does that by calling /api/vote API and passing post id directly. What is Upvote Percentage?: F1407175 Impact: - Attacker can affect Upvote Percentage o...
Shopify: Senseitive data Related to Shopify Host -> https://shopify.zendesk.com/
Description : Github is truly awesome service but its unwise to put sensitive data in public repo as i was found a repo committed 1 houre ago contain Senseitive data Credentials && ZRTAPIKEY && JWTSECRET related to this Host - https://shopify.zendesk.com/ leaked publicly in github, and clearly th...
Affirm: Subdomain takeover of www█████████.affirm.com
Summary Hi there, assuming you want this report as your policy mentions Affirm resources with third-parties, but the scope was a little unclear. Regardless, www█████.affirm.com points to an AWS S3 bucket affirm-prod-www-cms█████████ that no longer exists. I was able to take control of this bucket...
MTN Group: Default Login Credentials on https://broadbandmaps.mtn.com.gh/
Summary: Hello Team, I just found out that broadbandmaps.mtn.com.gh requires logging in when you visit it, but it turned out that you can actually login as an Admin and do anything on the specific site. when you visit the mentioned site you will get this F1405776 it will require to be logged in t...
UPchieve: Business logic error
Hi UPCHIEVE SECURITY TEAM I'm Anto Vulnerability : Business logic error There is no password verification while changing a password. Steps to Reproduce : 1. Go to https://hackers.upchieve.org/resetpassword. 2. Click the change password. 3. If your old password was ex: hacker and in new password...
Glovo: Getting a free delivery by singing up from "[email protected]"
Hello Getting a free delivery for food by just signing up from "[email protected]" and you also see the " FREE delivery Glovo Team ∞" in profile section. To cross check, i made a another account by using regular email-id "[email protected] " and placed a order with same location but i didn't g...
U.S. Dept Of Defense: EC2 subdomain takeover at http://████████/
There is a dangling DNS A record that points to an EC2 instance that no longer exists, I was able to claim the EC2 instance and host content on http://███████/. Steps To Reproduce: 1. Visit http://█████████/██████████.html and view the PoC: ██████ Suggested Remediation Steps Remove the A record...
Valve: Modify in-flight data to payment provider Smart2Pay
I have found vulnerability which allows attacker to generate steam wallet balance. Firstly you will have to change yours steam account email to something like I will explain why in next steps, amount100 is the important part: brixamount100abc@█████ Then go to...
Shopify: EC2 Takeover at turn.shopify.com
Summary Hi team, It seems that the domain turn.shopify.com pointed to an EC2 instance that was terminated and the DNS record wasn't updated. We managed to register a new EC2 instance with the IP that turn.shopify.com points to: Command dig turn.shopify.com ; DiG 9.11.3-1ubuntu1.13-Ubuntu...
UPchieve: Failed to validate Session after Password Change
While conducting my research I discovered that the application Failed to validate session after password change. In this scenario changing the password doesn't destroys the other sessions which are logged in with old passwords in another browser. Steps To Reproduce: 1 Login with the same account ...
Logitech: clickjacking on deleting user's clips [https://crossclip.com/clips]
Summary: An attacker can trick victim to delete his own clips on https://crossclip.com/clips. Steps To Reproduce: F1403810 1. Login 1. Create an HTML file with the following code. I-Frame THIS PAGE IS VULNERABLE TO CLICKJACKING Supporting Material/References: F1403810 Impact tricking user to dele...
Palo Alto Software: DNS Miconfiguration Leads to Subdomain Takeover - max1.liveplan.com
Summary The issue happens due to using EC2 public DNS instead of using Elastic IPs as CNAME record. This report is simliar to report 1069795 Misconfiguration - DNS Records json "host": "max1.liveplan.com", "resolver": "1.0.0.1:53" , "a": "54.68.121.128" , "cname":...
Twitter Algorithmic Bias: Underrepresentation Bias through Twitter's Cropping Algorithm #2: Favoring Animals over Black People
Bounty Hunter Name: CyberQueenMeg About You: Megan, also known as CyberQueenMeg, is a passionate rising cybersecurity professional who is interested in programming, cybersecurity, and web development. Megan is a high school senior in a rigorous computer science program at her high school where sh...
Basecamp: Login session not expire
@blackbibin reported that after signing in, you could go back in the browser and the login info would still be populated. We've ensured the login page is reloaded in this case...
Twitter Algorithmic Bias: Underrepresentation Bias through Twitter's Cropping Algorithm
Bounty Hunter Name: CyberQueenMeg About You: Megan, also known as CyberQueenMeg, is a passionate rising cybersecurity professional who is interested in programming, cybersecurity, and web development. Megan is a high school senior in a rigorous computer science program at her high school where sh...