15405 matches found
Basecamp: Error Page Content Spoofing or Text Injection
Target: https://gopher.hey.com/ Description: Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle...
U.S. Dept Of Defense: XSS DUE TO CVE-2020-3580
Hello Team, During my research, I found the following host to be vulnerable to CVE 2020-3580 which is POST BASED XSS. Vulnerable URL: https://█████/+CSCOE+/saml/sp/acs?tgname=a Impact Attackers can steal cookies and even takeover accounts and perform different malicious activities. System Hosts █...
Khan Academy: Client Side string length check
A client-side string length check vulnerability allowed an attacker to save excessively long strings in the "Class Settings" page on khanacademy.org, potentially causing various issues such as content manipulation, page template breaking, and crashing for low-memory visitors...
MTN Group: XSS at videostore.mtnonline.com/GL/*.aspx via all parameters
PoC https://videostore.mtnonline.com/GL/MyAccount.aspx?PId=126&CID=5&OprId=11%27 Symbols are not filtered that alloweds to inject HTML code. F1353609 Impact XSS at videostore.mtnonline.com...
MTN Group: XSS at http://nextapps.mtnonline.com/search/suggest/q/{xss payload}
PoC http://nextapps.mtnonline.com/search/suggest/q/xss1337 Symbols are no filtered that alloweds to inject HTML code. Response has content-type: text/html F1353600 Impact XSS at nextapps.mtnonline.com...
U.S. Dept Of Defense: CUI labled and ████ and ██████ Restricted ██████ intelligence
Description: A file labeled with the following "Data is for intelligence purposes only and is not to be used for targeting. This data is classified as CUI. Controlled by: ██████████ ███████ " References...
U.S. Dept Of Defense: RXSS ON https://██████████
Description: Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differe...
Glassdoor: Reflected XSS on https://help.glassdoor.com/GD_HC_EmbeddedChatVF
Hi there, I have found the xss vulnerability at: https://help.glassdoor.com/GDHCEmbeddedChatVF Browsers tested: Firefox, Chrome, Edge latest version Steps To Reproduce: Go to: https://help.glassdoor.com/GDHCEmbeddedChatVF?FirstName=l0cpd%22;a=alert,b=document.domain,ab// Supporting...
U.S. Dept Of Defense: CUI labled and ████ Restricted pdf on █████
Description: A file labeled with the following "CONTROLLED BY: ██████████ CUI ████: ███ ████████ Was discovered and based on public information ███████ CUI marking it appears it shouldn't be publicly available either. If i am wrong about the markings please correct me. References...
Mattermost: DoS via large console messages
Summary: When server console logging is enabled, it's possible to cause a complete denial of service to the server by submitting large text 64KB that gets output in the console log. This causes the server to become unavailable for all users. Steps To Reproduce: I set up my environment following t...
U.S. Dept Of Defense: ███████ - XSS - CVE-2020-3580
████ appears to be affected by the Cisco ASA XSS CVE-2020-3580, This vulnerablity is targets the saml service within the VPN. It is triggered via a POST request to /+CSCOE+/saml/sp/acs?tgname=a References...
Reddit: No Password Length Restriction leads to Denial of Service
Hey when I try to set the password while creating account I noticed that you haven't kept any password limit. You need to decrease password length :There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource consumption on behalf of...
HackerOne: Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information
When a Report is submitted on HackerOne.com, a feature called the Report Duplicate Detector helps program members and triagers find potential duplicates of the submitted report. This feature will match against all reports that were submitted to the program. When the feature was introduced, all...
MyEtherWallet: PIN bypass
Summary: MEW apk has improper rate limit. When we try to brute force the PIN, we are rate limited for 5 minutes after 5 or 6 attempt. In my testing I found that it was checking the device's local time so by changing it we can brute force the PIN. Steps To Reproduce: 1.Install MEW app from play...
Basecamp: Information Disclosure .htaccess accesible for public
Hello team! While doing a preliminary recon on the sub domain of "launchpad.37signals.com" I've come across a few sensitive files that should not be facing the public web; I'll leave you a list organized by criticality and some proof. Information disclosure of path .htaccess on the subdomain of...
Mail.ru: informations disclosure(Email,Numbers,Agreements, admin Sessions and more ...) through a PostgreSQL database belongs to (legium-back.corp.mail.ru)
Reported a vulnerability in legium.io cloud service, which is not part of Mail.Ru. legium.io is located outside the Mail.Ru infrastructure and does not have access to our company's product data. According to the rules in this case the service refers to Ext.O Third party project. While legium.io...
GitHub Security Lab: C++: Support Pqxx connector to search for sql injections to Postgres
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Java: CodeQL query for unsafe RMI deserialization
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: ihsinme: CPP Add query for CWE-783 Operator Precedence Logic Error When Use Bool Type
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [JavaScript]: CWE-1004: Sensitive cookie without HttpOnly
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [GO] CWE-1004: Sensitive cookie without HttpOnly
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Java]: CWE-502 Add UnsafeDeserialization sinks
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Java] BeanShell Injection
This bug was reported directly to GitHub Security Lab...
Urban Company: Insufficient Session Expiration
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Name of Vulnerability:...
Nextcloud: ApiService#fetch serves content as text/html and inline Content-Disposition
https://github.com/nextcloud/text/blame/0bc7c3300607d57ee512dbf61497daec23961a12/lib/Service/ApiService.phpL109-L120 Impact XSS...
Acronis: FULL SSRF
hello dear support i have found full ssrf on https://summit.acronis.events step go to here https://summit.acronis.events 2 login into website 3 open this link...
Reddit: hardcoded api secret & api key in com.reddit.frontpage
hi security team, in file Resources/Resources.arsc/res/values/strings.xml i have found ███ ███ It shouldn't be disclosed to third parties it meant for deveoplers as per https://developer.twitter.com/en/docs/authentication/oauth-2-0/bearer-tokens poc:- curl --user "██████:███" --data...
Mail.ru: Stored XSS on top.mail.ru
Stored XSS via incorrect handling of http page headers on top.mail.ru at created counters...
HackerOne: Mishandling of hackerone clear background checks resulting in disclosure of other hacker's information
Summary: Mishandling of hackerone clear background checks resulting in disclosure of other hacker's information . Description: I received a hackerone clear invite for "█████" I am not █████. There appears to be some kind of off by one error or similar problem with the hackerone clear invites! fir...
MTN Group: information discloure via logs files at ==> https://ihelp.mtnbusiness.com/logfiles/Log_21-06-2021.txt
Hi MTN team , i got a 500 error show the full path of the windows server containing the log file of today i navigate to it == https://ihelp.mtnbusiness.com/logfiles/Log21-06-2021.txt i saw all logins i made with user administrator as u see the logs files is a date Log21-06-2021.txt you can read...
Urban Company: Broken Link on Urban Company's Vulnerability Submission Form
Summary: - Urban Company has an unclaimed broken link on their HackerOne security page which can be claimed by any malicious user. And then later the malicious user can exploit this issue to deceive new researchers to submit their legitimate findings to the wrong hands. Steps To Reproduce: 1.Visi...
Weblate: No rate Limit on Add new Translation Project
Attacker able to create unlimited Translation projects which lead to no more project name for the users who wanted to create new project on hosted.weblate.org Below is the POC video which ,you can go through Impact Other users cant use the project names there wanted and attacker can occupy space...
Node.js: HTTP Request Smuggling due to accepting space before colon
Summary: The llhttp parser in the httpmodule in Node 16.3.0 accepts requests with a space SP right after the header name before the colon. This can lead to HTTP Request Smuggling HRS. Description: When Node receives the following request: GET / HTTP/1.1 Host: localhost:5000 Content-Length : 5 hel...
Unikrn: Open URL Redirection
Open URL Redirect Steps To Reproduce: 1 Go to the following link & Register for new account https://unikrn.com/██████ 2 After registering It will redirect to example.com Reference: https://www.owasp.org/index.php/UnvalidatedRedirectsandForwardsCheatSheet Impact The attacker can force the user to...
WordPress: wp-embed XSS on Safari
An XSS vulnerability was discovered in the open embed auto discovery function of WordPress. The vulnerability allowed an attacker to execute malicious JavaScript code by embedding a blog post on a victim's WordPress site. The vulnerability affected Safari browsers and potentially other browsers...
Kubernetes: AWS Load Balancer Controller can be used by an attacker to modify rules of any Security Group that they are able to tag
Report Submission Form Summary: The IAM Policy of AWS Load Balancer Controller allows it to modify rules of any SG on the AWS Account. This is legitimately used to manage Security Groups created by the controller when an Ingress resource doesn’t explicit a SG. Annotations can be added to the...
Internet Bug Bounty: Fragmentation and Aggregation Flaws in Wi-Fi
I discovered three design flaws in the Wi-Fi standard and widespread related implementation flaws see GitHub overview and test tool. Here I'll specifically cover open source software. These findings have not received bug bounties from other sources. Implementation flaws allowing trivial packet...
Node.js: HTTP Request Smuggling due to ignoring chunk extensions
Summary: The llhttp parser in the http module in Node 16.3.0 ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS when a Node server is put behind an Apache Traffic Server ATS 9.0.0 proxy. Description: In the chunked transfer encoding format...
Kubernetes: AWS Load Balancer Controller Managed Security Groups can be replaced by an unprivileged attacker
Report Submission Form Summary: When creating an Ingress of class alb, by default, AWS Load Balancer Controller creates a managed SG and attaches it to the created ALB. This SG limits which ports of the ALB are accessible by whom. An attacker is able to craft another SG that can be used to trick...
Proctorio: Universal Cross-Site Scripting vulnerability
Sector7.nl notified Proctorio that there was a universal cross-site scripting vulnerability within the browser extension on June 17th, 2021. This vulnerability was patched on June 24th, 2021. Sector7.nl and other researchers were notified on June 25th. On August 3rd, 2021 Sector7.nl confirmed the...
Semrush: Improper input validation in projects leads to fully deny access to project resources
INTRODUCTION Accounts used to search for this vulnerability: - id: █████████ email:███ - id: █████████ email: █████████ Most of the requests made to test the vulnerability were made with the "X-hackerone: adam" header IP used: ████ / ███ Endpoint URL:...
Reddit: [dubsmash] Long String in 'shoutout' Parameter Leading Internal server Error on Popular hastags , Community and User Profile
Summary: If the user input a long string in the 'shoutout' parameter of the 'CreateVideo' API then all the APIs where this video is supposed to appear eg: hashtag API, community API, and user profile API will throw 'internal server error' in the response. This will cause a denial of service attac...
Urban Dictionary: CSRF to Reflected XSS at echo.urbandictionary.biz via spoofing content type
The host was vulnerable to XSS due to the fact that it reflected any sent POST request body when the request was sent to an existing or non-existent filename with the .html extension, which spoofed the response content type to HTML...
Rockstar Games: Social Club Account Takeover Via RGL And Steam/Epic Linked Account
In this report, the researcher discovered and demonstrated a method to hijack access to a Social Club account via a previously-linked Epic Games or Steam account. To perform the attack, the attacker first needed access to a Steam or Epic Games account with entitlement to a game with Social Club...
U.S. Dept Of Defense: [CVE-2020-3452] on ███████
The following subdomain is vulnerable to CVE-2020-3452, which is an unauthenticated file read in Cisco ASA & Cisco Firepower. URL: https://████/ Vulnerable URL: https://███/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portalinc.lua&default-language&lang=../ ██████████ Resources:...
curl: CVE-2021-22926: CURLOPT_SSLCERT mixup with Secure Transport
Summary: libcurl Secure Transport SSL backend fails to secure the CURLOPTSSLCERT against current directory file overriding the keychain nickname specified. This leads to the possibility of locally created file overriding the CURLOPTSSLCERT specified certificate and thus causing denial of service...
HackerOne: Private program disclosure through notifications
Hello Team, Summary: I recently came across hackerone report: https://hackerone.com/reports/1179241 . I though this was fixed but today I have have faced similar experience. I have received a Scope and policy update from the program "██████" which I am not part of. ████████ When I was clicking on...
MCUboot: private keys exposed on the GitHub repository
Summary: When I searched Github for sensitive information I found some privet key in GitHub repository. these are private RSA key and private server key, which could be used for unauthorized access. Steps To Reproduce: VISIT THESE LINKS: Repository : EX:...
Bumble: Exfiltrating a victim's exact location (to within 5m)
I used Bumble's distance feature to exfiltrate the exact location to within approx 5m of a victim. I did this by using the Bumble API to move my attacker account's location around the approximate area of the victim. I was able to obtain the exact distance between attacker and victim at 3 separate...
Reddit: Domain Takeover of Reddit.ru via DNS Hijacking
Summary I discovered that Reddit.ru was vulnerable to DNS hijacking via DNS provider, Reg.ru. This would allow a malicious attacker to control the content on this domain, as well as, create email addresses associated with it... I'm going to be totally honest and say that any of us ethical hackers...