Ping Identity: Broken Link on Ping Identity's Vulnerability Submission Form on Hackerone

Summary: Ping Identity has an unclaimed broken link on their HackerOne security page which can be claimed by any malicious user, who could then exploit this issue with clever social engineering to deceive new researchers to submit their legitimate findings to the wrong hands. Similar to this...

X (Formerly Twitter): Identify the mobile number of a twitter user

Summary: By exploiting this security vulnerability we can detect the mobile number of a twitter user. Description: This security vulnerability is of type "Information disclosure" it allows to exploit Flawed behavior of the twitter system to obtain distinct responses when different error states...

Zivver: ADB Backup is enabled within AndroidManifest

In this report, it was highlighted that the ADB backup feature enabled in the Android application could be used by an attacker with physical access to the victim's device to 'migrate' data from app storage on the phone and later possibly extract secrets from that backup. For this attack to succee...

Acronis: bypass sql injection #1109311

hello dear support i have found SQL injection and bypass this case 1109311 Tests performed: 0'XORifnow=sysdate,sleep15,0XOR'Z = 20.002 0'XORifnow=sysdate,sleep6,0XOR'Z = 7.282 0'XORifnow=sysdate,sleep0,0XOR'Z = 0.912 0'XORifnow=sysdate,sleep15,0XOR'Z = 16.553 0'XORifnow=sysdate,sleep3,0XOR'Z =...

Acronis: IP restriction bypass via X-Forwarded-For header

The vulnerability allowed unauthorized access to a restricted endpoint by manipulating the X-Forwarded-For header. This resulted in information disclosure that the organization intended to keep private...

QIWI: Account Takeover through registration to the same email address

На ресурсе shop.tochka.com была обнаружена уязвимость, приводящая к перехвату аккаунта с помощью регистрации нескольких аккаунтов на один почтовый ящик...

curl: CVE-2021-22925: TELNET stack contents disclosure again

Summary: CVE-2021-22898: TELNET stack contents disclosure 1176461 issue was recently reported for curl and it was addressed in curl 7.77.0: https://curl.se/docs/CVE-2021-22898.html https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde https://hackerone.com/reports/1176461...

U.S. Dept Of Defense: XSS Reflected - ██████████

Hi Team, I found a XSS Reflected. https://██████████/███onload=%22prompt1 Thanks DRauschkolb Impact XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content & even steal cookies. System Host...

U.S. Dept Of Defense: XSS Reflected - ███

Hi Team, I found a XSS Reflected. https://██████/Telerik.ReportViewer.axd?optype=Parameters&bgColor=000000%22onload=%22prompt1 Thans DRauschkolb Impact XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or...

curl: CVE-2021-22924: Bad connection reuse due to flawed path name checks

Summary: Curlsslconfigmatches attempts to compare whether two SSL connections have identical SSL security options or not. The idea is to avoid reusing a connection that uses less secure, or completely different security options such as capath, cainfo or certificate/issuer pinning. Unfortunately...

Nextcloud: Sensitive files/ data exists post deletion of user account

In the latest android app ,I created an account in the name of [email protected]. After few activities,deleted the account . Files containing user emails and tokens still exist.Relevant files not deleted upon deletion of account. Content of files post deletion of account:...

Meredith: Shop - Reflected XSS With Clickjacking Leads to Steal User's Cookie In Two Domain

Hii Security Team , I am S Rahul MCEHMetaxone Certified Ethical Hacker and a Security Researcher I just checked your website and found Reflected XSS to Good XSS Clickjacking In Two Domain Description:- As the search parameter is vulnerable to XSS and but the plus point is there is no...

HackerOne: HackerOne making payments in USDC (Coinbase stable coin)

Summary: Hello Everyone, My name is Ariel and I’m a manager in HackerOne’s community team. As a part of a Hack Week project, HackerOne is now supporting payments via USDC, Coinbase’s stable coin. This has been a feature requested by many hackers, that we are now glad to announce as supported. Mor...

MTN Group: Blind SSRF External Interaction on https://mtngbissau.com/

Hii Security Team, I am S Rahul MCEHMetaxone Certified Ethical Hacker and a Security Researcher I just checked your website and found Blind SSRF External Interaction on https://mtngbissau.com/ What is SSRF? Server-side request forgery also known as SSRF is a web security vulnerability that allows...

Mail.ru: Unauthorized Access To Admin panel

Access to static files of playerone.ru admin web interface was not sufficiently restricted. There was no possibility to access admin functions. Simple Bypass: Try access playerone.ru/admin/users/ 403 : host playerone.ru 127.0.0.1 Try again 127.0.0.1/admin/users 200 OK :...

GitHub Security Lab: ihsinme: CPP Add query for CWE-1126: Declaration of Variable with Unnecessarily Wide Scope

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java] CWE-295 - Incorrect Hostname Verification - MitM

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java]: CWE-730 Regex injection

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: ihsinme:CPP Add query for CWE-415 Double Free

This bug was reported directly to GitHub Security Lab...

Rockstar Games: Cache Poisoning DoS on updates.rockstargames.com

In this report, the researcher discovered that there was a cache poisoning weakness on updates.rockstargames.com due to an unkeyed header, trailer. By sending this header, an attacker could cause the cache to save a malformed response with status code 400. An example of such a request, as provide...

HackerOne: Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs

Hello, Hope you are doing well, SUMMARY -In hackerone user doesn't have permission to do any action like "disclosing/undiclosing" in disclosed report. -Here user can send the "cancel-disclosure-request" request to the server and server accepts the request gave 200ok response with ""flash":"The...

Sifchain: 4 xss vulnerability dom based cwe 79 ; wordpress bootstrap.min.js is vulnerable

Summary: I have found a bug in your site and the bug is xss vulnerability and it is in your wordpress bootstrap.min.js program. I also do manually test and I got the xss vulnearability There are totally I have found 4 vulnearability in your system and which are belong to 2018 To 2019 Steps To...

Sifchain: information disclosure

Hi team during github recon i find something and I dont know what access it has, but still i though it would be a good idea to share this finding with you in case it can be used in a way that i dont know. what i find link :...

Semrush: API key (api.semrush.com) leak in JS-file

The researcher found a javascript file with an API token that allowed to get internal statistics. When you access a page not found on the application, the source code of the page contains a portion of code that list a lot of javascript files. Some of these javascript files correspond to the Semru...

h1-ctf: HackerOne’s 100K CTF Writeup

Greetings team It has been a great challenge, thank you very much for the fun moments and also for the annoying ones : ██████████ P.S. I will put my writeup in my next comment. Impact ---...

Elastic: Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access

Summary: Dear Team, Since 1168528 was resolved. I have checking again for other roles. At Dev Role with Limited Engine Access, an user still can access API endpoint /api/as/v1/credentials/ to get all API keys private-key, search-key ... Steps To Reproduce: 1 - Log in Kibana with the admin elastic...

Nord Security: NordVPN Linux Client - Unsafe service file permissions leads to Local Privilege Escalation

The Linux package available in NordVPN's repository is affected by a permission issue in init script and systemd unit files that allows any user on the system to execute arbitrary command as root. Tested Version Tested version is the latest available on the repository, which is 3.10.0 and is...

U.S. General Services Administration: User information disclosed via API

Summary: It appears that the requests for "system accounts" are fully available via an API endpoint that does not require authentication. The main issue is that among the information disclosed are user emails many with gmail addresses but the individual applications also include information that...

Sifchain: Cross-site Scripting (XSS) possible at https://sifchain.finance// via CVE-2019-8331 exploitation

Summary: https://sifchain.finance is using Bootstrap framework version 4.0.0 which is =4.0.0 4. Visit https://sifchain.finance/wp-content/themes/icos/assets/js/vendor/bootstrap.min.js?ver=5.7.2 5. You'll get the Bootstrap Version, Which is v4.0.0 and its vulnerable to Cross-site Scripting XSS...

h1-ctf: Adam and the Deadly Injections

Hi team adding the flag here ███ ████ I will do the writeup in the below comments before the deadline itself Thanks Akshansh Impact...

Flickr: Open redirect GET-Based on https://www.flickr.com/browser/upgrade/?continue=

Improper validation of paths and domains allowed redirects to external domains...

GitHub Security Lab: Python: Add support of clickhouse-driver package

This bug was reported directly to GitHub Security Lab...

h1-ctf: CCC H1 June 2021 CTF Writeup

CTF Summary This was my first H1 CTF and I was excited to work with several others to collaborate on the CTF and find the flag. I'll write up the solution process and vulnerabilities involved in the solution: Knowledge basic of S3 operations XML External Entities and Local File Exfiltration SQL...

h1-ctf: 100K CTF's Writeup

Limited disclosure based on researcher's request. Hello everyone, We are one of the winners of 100k CCC CTF and we would like to congratulate all the other winners of the CTF as well. Here is the link to our write-up https://blog.dexter0us.com/posts/ccc-h1ctf/ hope you guys enjoy reading it and...

h1-ctf: H1-CTF 100k Solution - Congratz on the 100k Rep todayisnew

Sharing the final flag for now. Writeup will come soon ██████ ██████████ Impact Takeover of admin account :...

Mattermost: Mattermost Server OAuth Flow Cross-Site Scripting

Summary: The vulnerability is a reflected Cross-Site Scripting XSS via the OAuth flow. A victim clicking a malicious link pointing to the target Mattermost host will trigger the XSS. If the victim is a regular user, it is possible to obtain all of their Mattermost chat contents; if it’s an...

h1-ctf: ccc ctf

██████████ will send detailed report later Impact can get admin credentials...

h1-ctf: ccc.h1ctf.com CTF

Summary: Claiming the flag, writeup to follow. ██████████ ██████ Impact...

h1-ctf: [100K-ctf] Multiple vulnerabilities leading to compromise of Pinger instance.

Hello, Gonna just submit flags first then will send my write up later tomorrow. ████ ██████ Thanks for fun! Impact An attacker can compromise Pinger instance located on https://ccc.h1ctf.com/2b5d2b11513d2c9b by chaining multiple vulnerabilities on https://ccc.h1ctf.com/...

Nextcloud: Download of file with arbitrary extension via injection into attachment header

Description ----------- When downloading mail attachments, the app fails to properly escape quotes in the content disposition header. Because of this, an attacker can send a victim a file with a benign extension such as .txt or .png which when downloaded will be stored with a malicious extension...

Nextcloud: Bypass of privacy filter / tracking pixel blocker

Description ------------ When the mail app receives inline images, it will block them for privacy reasons to prevent tracking pixels The images have been blocked to protect your privacy. This block works correctly for most remote resources in addition to images, remote CSS files, iframes, and som...

Mail.ru: add class vulnerable Stored XSS

https://happynumbers.com stored XSS in class name via class creation dialog...

Mail.ru: Bypassing SOP with XSS on account.my.games leading to steal CSRF token and user information

Incorrect CORS settings on account.my.games, allowed access to user information registration IP, email, username, birthday, profile visibility from .my.com. Vulnerability demonstrated by XSS at warofdragons.my.games...

Mail.ru: uchi.ru check_lessons Blind SQL Injection

Blind SQL Injection in uchi.ru page due to insecure use sort variable of GET parameter...

Nextcloud: Ratelimits do not apply to OCS DataResponse

Using $response-throttle on a DataResponse doesn't work as it is being transformed by BaseResponse into a OCS response. This response does not propagate any throttled setting. Impact Ratelimits on OCS DataResponse not functional...

Reddit: IDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameter

Summary: This vulnerability consist of modifying the PayPal transaction ID to buy a big coin pack but paying the small price for it. Impact: The only impact here could be that you don't earn the money you deserve, and users can offer a lot of presents to other users, breaking the magic of the...

Affirm: Open Redirect

Open Redirect Vulnerability: URL : https://www.affirm.com/ User can be redirect to malicious site POC:https://www.affirm.com///google.com/?www.affirm.com/?category=interview&page=2 I hope you know the impact of open redirect and more info refer https://cwe.mitre.org/data/definitions/601.html Impa...

Reddit: Deleting all DMs on RedditGifts.com

Summary: It's possible to delete all 4.4M private messages on RedditGifts.com due to missing permission check on DELETE request Steps To Reproduce: 1. Set up 3 accounts on RedditGifts.com FriendA, FriendB, Attacker 1. Have FriendA send message to FriendB 1. As Attacker send the following request...

Sony: SQL Injection on [█████████]

The researcher reported that the login form of a Sony endpoint was susceptible to an error-based SQL injection vulnerability. The researcher intercepted a login request using BurpSuite and then used SQLMap to discover the SQL injection. Once the SQL injection vulnerability was discovered, SQLMap...

curl: CVE-2021-22923: Metalink download sends credentials

Summary: When compiled --with-libmetalink and used with --metalink and --user curl will use the credentials for any further transfers performed. This includes different hosts and protocols, even ones without transport layer security such as http and ftp. As a result the credentials only intended...