15693 matches found
PortSwigger Web Security: Information disclosure on error message
Hai team, First of all , Thank you creating a wonderful place for learning web app pentesting : . In accessing a lab at the academy , my internet connection suddenly went down, I dont know the problem is on the lab or in academy, But the error message reveals some node codes.I attached a screensh...
Kubernetes: Ingress-nginx path allows retrieval of ingress-nginx serviceaccount token
Report Submission Form Summary: A user with the permissions to create an ingress resource can obtain the ingress-nginx service account token which can list secrets is all namespaces cluster wide. Kubernetes Version: 1.20 should work on 1.21 as well Component Version: nginx ingress controller v1.0...
Mail.ru: Deliviry Club Courier app (v. 3.9.25.0); Disclosure phone number of client.
Здравствуйте. Я нашёл баг в приложениидля курьеров, позволяющий получить реальный номер телефона клиента. Обычно, когда курьеру необходимо позвонить клиенту для уточнения какого-либо вопроса, курьер нажимает "Позвонить клиенту", и после этого совершается звонок не на номер клиента, а через Delive...
Acronis: %0A (New line) and limitness URL leads to DoS at all system [Main adress (https://www.acronis.com/)]
Hello team, hopefully you are happy now I found a DoS vulnerabilty at https://www.acronis.com/ Note: site is still down and this is not intentional behavior and i didn't use any automated tool At first i saw this code at site: someting and tried XSS but site was filtered " and '. So i tried with...
Rocket.Chat: Content-Security Policy bypass with File Uploads
The default Content-Security Policy CSP in Rocket.Chat versions 4.0.3 and 3.18.2 was bypassed by uploading a JavaScript file through the file upload feature. This file could then be included in the web application, allowing the execution of arbitrary scripts...
Urban Company: Critical full compromise of jarvis-new.urbanclap.com via weak session signing
Summary Hi there, I discovered that jarvis-new.urbanclap.com uses a weak Flask session key. Because Flask sessions are signed with a static secret, if this secret is known to an attacker then they can modify the session state. In this case, we can modify the Redash userid for the session and log ...
PlayStation: bd-j exploit chain
Hey PlayStation! Below are 5 vulnerabilities chained together that allows an attacker to gain JIT capabilities and execute arbitrary payloads. The provided payload triggers a buffer overflow that causes a kernel panic. Please consider each of the vulnerabilities individually. AFAIK, this is the...
Panther Labs: Broken subdomain takeover of runpanther which was pointing towards herokuapp
An outdated link on our public blog pointed to a decommissioned Slack sign-up app hosted on Heroku for our also-decommissioned open source Slack community. The reporter was able to re-register the decommissioned subdomain with his own Heroku account...
QIWI: account takeover through password reset in url https://reklama.tochka.com/
Steps to reproduce 1- Create an account 2- visit this url https://reklama.tochka.com/mainpage1/recover/ 2- Enter your email and intercept the response to the request that recovers your password you will notice that it looks like this HTTP/1.1 200 OK Server: nginx Date: Sun, 24 Oct 2021 21:32:20 G...
Monero: RPC call crashes node
Summary: Passing a large list of amounts to the getoutputdistribution call crashes a remote node, after maybe 90 seconds of keeping it busy. Releases Affected: Probably all Steps To Reproduce: values=echo $seq 0 500 900000|sed -e 's/ /,/g' ; curl http://127.0.0.1:38081/jsonrpc -d...
Omise: The endpoint '/test/webhooks' is vulnerable to DNS Rebinding
Summary: DNS rebinding attack is a method of switching the resolution of domain names as wished by the attacker. The aim is to lure the web app to a different IP address/host. In this attack, and particularly in our case, a malicious server will first perform a domain name resolution to the IP...
Rocket.Chat: Impersonation in Sequential Messages
The vulnerability allowed an attacker to impersonate another user in sequential messages. The vulnerability existed in Rocket.Chat versions 3.18.2 and 4.0.3. It was caused by the ability to hide the leading message in a sequence using the customClass or className message attributes, making the...
Rocket.Chat: Retrospective change of message timestamp and order
Vulnerability description not provided...
Rocket.Chat: Messages can be hidden regardless of server configuration
Vulnerability description not provided...
Rocket.Chat: XSS in various MessageTypes
The Rocket.Chat vulnerability allowed arbitrary script execution in the receiving frontend client through the rendering of messages of various MessageTypes. The vulnerability affected versions 3.18.2 and 4.0.3. The issue was caused by the lack of sanitization of message parameters rendered from...
Mail.ru: reflected xss in e.mail.ru
Login and go to https://e.mail.ru/addressbook/letter/S?afterReload=1&MailboxStatusAutoCall=alert1 Impact Stealing users' information...
Informatica: Reflected Cross-Site Scripting/HTML Injection
The default ASP page at https://███/redirect/default.asp is vulnerable to reflected Cross-Site Scripting in the "url" parameter. To reproduce the issue just visit the following URL and an alert should pop up: - https://██████████/redirect/?url=%3Cscript%3Ealertdocument.domain%3C/script%3E It seem...
IBM: Remote Code Execution at https://169.38.86.185/ (edst.ibm.com)
A discovered Gitlab server was running an old version affected by RCE. This vulnerability could have allowed an unauthenticated attackers to compromise the server by public exploit in ExifTool. The issue was reported to IBM and remediated...
MTN Group: SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ci
A flaw was found in Keycloak before 13.0.0, where it was possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allowed an attacker to use this parameter to execute a Server-side request forgery SSRF attack...
GitHub Security Lab: [Java] CWE-552: Unsafe url forward
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [cpp] CWE-787: query to detect unsigned integer to signed integer conversions used in pointer arithmetics
This bug was reported directly to GitHub Security Lab...
Slack: [Android] Directory traversal leading to disclosure of auth tokens
Files uploaded to and opened in Slack with specially-crafted names could cause the Android operating system to overwrite configuration files on customer devices, potentially exposing Slack data to attacker-controlled websites. In order to take advantage of this vulnerability, attackers needed to ...
Ruby: RDoc::MethodAttr is vulnerable to Regular Expression Denial of Service (ReDoS)
Vulnerability description not provided...
TikTok: Open Redirect TO Stealing aadvid
An open redirect was found on TikTok Ads due to an improper validation of the "redirect" parameter. We thank @lu3ky-13 for reporting this to our team...
TikTok: Reflected XSS on TikTok Website
A cross-site scripting XSS vulnerability was found on TikTok.com via multiple parameters. We thank @homosec for reporting this to our team and confirming its resolution...
Kubernetes: Ingress-nginx annotation injection allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
I submitted the following report to [email protected]: I've been exploring CVE-2021-25742 and believe I've discovered a variant although it appears there may be many. Most template variables are not escaped properly in nginx.tmpl, leading to injection of arbitrary nginx directives. For...
Evernote: 2 click Remote Code execution in Evernote Android
This vulnerability is similar to my previous reported vulnerability 1362313 , in here also weakness is path transversal vulnerability which helps me to acheive code execution but the root cause is different. some part of this app is written in java and some parts are written in react native. In...
Rocket.Chat: Message ID Enumeration with Regular Expression in getReadReceipts Meteor method
Summary The getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs. Description Authenticated users are able to query the getReadReceipts Meteor server method to enumerate existing...
TikTok: HTML Injection via TikTok Ads Email Share
A HTML injection was found on a TikTok Ads endpoint via the "SenderName" parameter. We thank @lu3ky-13 for reporting this to our team...
TikTok: Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text field
A XSS cross-site scripting vulnerability was found in TikTok ads through "text" field. We thank @lu3ky-13 for reporting this to our team...
Judge.me : Stored XSS in Email Templates via link
Summary: Stored cross-site scripting also known as second-order or persistent XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. FYI: I Install judge.me in Shopify E-Commerce Steps To Reproduce: 1. Go to...
GitLab: "External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request
Summary Any user who is either author or assignee of a merge request can approve that merge request's external status checks. This includes users with Guest access that creates MR's either through email or through a fork of the project. It also includes users with Guest or Reporter access getting...
Internet Bug Bounty: The Host Authorization middleware in Action Pack is vulnerable to crafted X-Forwarded-Host values
Title: The Host Authorization middleware in Action Pack is vulnerable to crafted X-Forwarded-Host values Scope: https://github.com/rails/rails Weakness: Open Redirect Severity: Medium Link: https://hackerone.com/reports/1189310 Date: 2021-05-09 06:29:19 +0000 By: @mshtawy CVE IDs: CVE-2021-22942,...
SHEIN: RCE via npm misconfig -- installing internal libraries from the public registry
The following node package has been installed on at least one shein owned build/development server directly from the public npm registry. https://www.npmjs.com/package/shineout-mobile This package should normally be downloaded from the internal shein registry, but a misconfiguration appears to ha...
Ruby: Arbitrary file injection via symlink attack in rdoc generator
Vulnerability description not provided...
HackerOne: HTML injection in email at https://www.hackerone.com/
HTML injection was possible in emails sent via the HackerOne platform by filling the first name and last name fields with HTML tags on the pentest community application form. This could allow an attacker to send malicious emails and inject HTML into them...
Lark Technologies: Able to steal private files by manipulating response using Compose Email function of Lark
A IDOR Insecure Direct Object Reference vulnerability was found within the "Compose Email" functions of Lark. This vulnerability could have allowed malicious users to fetch the files of other users if they knew the specific file ID which was an alphanumeric value. We thank @imrannisar for reporti...
Basecamp: Able to steal bearer token from deep link
Pre-requisities Prior to exploitation you would be required to know the "account id" of the user that you are attacking. Whilst this makes it difficult to attack an application in a generic way - the account is not secret information as it is included in any links to a user's basecamp organisatio...
GitLab: IDOR in "external status check" API leaks data about any status check on the instance
Summary The API endpoint for returning approval from an external status check contains an IDOR that lets a user list information about all external status checks on the GitLab instance. The feature is an Ultimate feature, but can be accessed by starting an Ultimate trial on GitLab.com. So the...
Shopify: After changing the storefront password, the preview link is still valid
Description: 1. The user needs to know the storefront password to generate the preview link. 2. After the administrator changes the storefront password, users can still access the storefront through the preview link. 3.reason: （1）User can generate preview link. （2）Simply changing the password wil...
U.S. Dept Of Defense: Cross-site Scripting (XSS) - Reflected at https://██████████/
Hello Team, i just found a reflected xss bug on your web https://█████ Step To reproduce: poc url: https://████/7/0/33/1d/www.citysearch.com/search?what=x&where=place%22%3E%3Csvg+onload=confirmdocument.domain%3E Impact Impact Data can be stolen, or Javascript can be executed.This is will allow th...
Acronis: CVE-2021-40438 on cp-eu2.acronis.com
Hi team Summary CVE-2021-40438 on cp-eu2.acronis.com Steps To Reproduce...
VK.com: Reflected xss в m.vk.com/chatjoin
XSS в мобильных сообщениях...
Nutanix: OPEN REDIRECT
Open Redirect Vulnerability Hello , found open redirect in https://stage.test.dev-iam.xi.nutanix.com/api/iam/authn/v1/oidc/logout?postlogoutredirecturi=. Go to https://stage.test.dev-iam.xi.nutanix.com/api/iam/authn/v1/oidc/logout?postlogoutredirecturi=http://evil.com&idtokenhint=test curl -I...
X (Formerly Twitter): Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive data
The researcher demonstrated a vulnerability in Twitter's Jira instance where user supplied information was handled in an improper manner, rendering the application vulnerable to blind XSS. By crafting a bug report and sending it to Twitter it was possible to locate this proof of concept code with...
Concrete CMS: SSRF mitigation bypass using DNS Rebind attack
We noticed that the upload functionality contains the ability to upload files from remote server, however there are some mitigations against accessing the AWS Instance Metadata service. We've managed to bypass these mitigations using DNS rebinding and we've managed to fetch the AWS IAM keys when...
MariaDB: Path Traversal CVE-2021-26086 CVE-2021-26085
These vulnerabilities were found with https://trickest.com https://trickest.io CVE-2021-26085: ===================== https://jira.mariadb.org:/s/123cfx//;/WEB-INF/web.xml CVE-2021-26086: ===================== https://jira.mariadb.org/s/cfx//;/WEB-INF/web.xml Video explanation: -------------------...
Stripe: Local applications from user's computer can listen for webhooks via insecure gRPC server from stripe-cli
The stripe daemon command from the stripe-cli exposes a local gRPC server that does not require authentication and allows any local application to execute remote procedures. One of the procedures is Listen, which is an equivalent to stripe listen command and receives all webhooks for the user's...