15693 matches found
Sony: Reflected XSS on ███ via jobid parameter
The researcher reported that a URL parameter of a Sony website was vulnerable to reflected XSS. The researcher used the JavaScript onpointerleave event to trigger the XSS payload...
UPchieve: Widespread CSRF on authenticated POST endpoints
Summary: Cross-Site Request Forgery CSRF is possible on most, if not all, authenticated POST endpoints. While CORS is configured such that the Access-Control-Allow-Origin header is set to Access-Control-Allow-Origin: hackers.upchieve.org, CORS does not prevent CSRF - it only prevents the attacker...
U.S. Dept Of Defense: Reflected XSS [██████]
Reflected cross-site scripting XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. An attacker can execute JavaScript arbitrary code on the victim's session. Steps To Reproduce Go to this URL:...
U.S. Dept Of Defense: Reflected XSS [██████]
Reflected cross-site scripting XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. An attacker can execute JavaScript arbitrary code on the victim's session. Steps To Reproduce Go to this URL:...
U.S. Dept Of Defense: Reflected XSS [███]
Reflected cross-site scripting XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. An attacker can execute JavaScript arbitrary code on the victim's session. Steps To Reproduce Go to this URL:...
Basecamp: Privilege Escalation leads to trash other users comment without having admin rights.
Privilege Escalation leads to trash other users comment without having admin rights...
Revive Adserver: Use of a Broken or Risky Cryptographic Algorithm
revive-adserver utilizes a PRNG for session-token generation, this means that an attacker could theoretically be able to generate session tokens at random and take over accounts at random. This function does not generate cryptographically secure values, and should not be used for cryptographic...
MTN Group: There is no rate limit for SME REGISTRATION PORTAL
Summary: The speed limit for the https://mtngbissau.com/registo/ endpoint has not been implemented. Steps To Reproduce: 1. Go to the https://mtngbissau.com/registo/ 2. fill out the Registration form 3. Send request to Intruder. 4. Set your payloads and start attack. 5. There is no rate-limit...
U.S. Dept Of Defense: XSS because of Akamai ARL misconfiguration on ████
Hello team, I hope you're doing well & healthy. I found a reflected XSS because of the misconfiguration of Akamai ARL. ███████ References - https://github.com/war-and-code/akamai-arl-hack - https://twitter.com/SpiderSec/status/1421176297548435459 - https://warandcode.com/post/akamai-arl-hack/ -...
U.S. Dept Of Defense: Reflected XSS at ████ via ██████████= parameter
Hi I found that this endpoint is vulnerable with Reflected XSS, The ███= parameter is vulnerable with RXSS PoC: ██████████?████████=%253Cimg/src/onerror=alertdocument.domain%253E Payload: Regards Impact RXSS System Hosts www.███ Affected Products and Versions CVE Numbers Steps to Reproduce...
LY Corporation: Bot setting information leakage in OpenChat room
Due to the bug in the authority verification process, it could be possible for the non-admin users to see settings details for Line OpenChat Admin Bot, such as saved scheduled messages and auto-responses...
UPchieve: i can join without user and pass in this website https://argocd.upchieve.org/settings/accounts
Summary: i can see the Content Steps To Reproduce: the wbsite is not good 1. if i join this website i can see Content https://argocd.upchieve.org/settings/accounts Supporting Material/References: you most need good programmers https://argocd.upchieve.org/settings/accounts Recommendations for...
Ruby on Rails: Sauce Labs API key unencrypted in an old commit
Vulnerability description not provided...
Nextcloud: Arbitrary read of all SVG files on a Nextcloud server
Vulnerability description not provided...
GitHub Security Lab: Java: Timing attacks while comparing results of cryptographic operations
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [C#]: HttpOnly and Secure Cookies for .NET Core and .NET
This bug was reported directly to GitHub Security Lab...
Ruby: Bug Report : [ No Valid SPF Records ]
Hi Team, Hope you are doing well. I found vulnerability in your web app URL : https://www.ruby-lang.org/en/s Description : There is an email spoofing vulnerability. Email spoofing is the forgery of an email header so that the message appears to have originated from someone or somewhere other than...
UPchieve: CLICKJACKING LEADS TO DEACTIVATE ACCOUNT
Hello UPCHEIVE SECURITY TEAM, I'm Anto Vulnerability : Clickjacking in https://hackers.upchieve.org/profile Steps to Reproduce: 1. Create a HTML file with following code Click the place where its shows Click 1 Click 2 Click 2 2, Save and Open it on your browser the page will be appear. Impact An...
Ruby on Rails: Possible DOS in app with crashing `exceptions_app`
Vulnerability description not provided...
U.S. Dept Of Defense: Sensitive information on '████████'
Hi team, i found a sensitive file hosted on '█████████' that i think must be not public accessible due to the wording "███████" Vulnerable Endpoint: https://█████████/████████ ██████████ Impact Sensitive information pubblicy accessible System Hosts ████████ Affected Products and Versions CVE...
U.S. Dept Of Defense: Sensitive information on ██████████
Hi team, i found a sensitive file hosted on '████' that i think must be not public accessible due to the wording "████████" Vulnerable Endpoint: https://██████ █████████ Regards Impact Sensitive information pubblicy accessible System Hosts ██████████ Affected Products and Versions CVE Numbers Ste...
Elastic: blind Server-Side Request Forgery (SSRF) allows scanning internal ports
A blind Server-Side Request Forgery SSRF vulnerability was found on a website, allowing an attacker to scan internal ports. The vulnerability could not be used to read HTTP responses, but could be used for reconnaissance purposes, such as port scanning by measuring response time...
VK.com: Баг с оплатой подписки
Недостаточная валидация...
Reddit: Outsider can affect Upvote Percentage of private subreddit post by calling /api/vote API
Summary: Attacker that does not have access to a private subreddit, can still affect Upvote Percentage of any posts in this private subreddit. He does that by calling /api/vote API and passing post id directly. What is Upvote Percentage?: F1407175 Impact: - Attacker can affect Upvote Percentage o...
Shopify: Senseitive data Related to Shopify Host -> https://shopify.zendesk.com/
Description : Github is truly awesome service but its unwise to put sensitive data in public repo as i was found a repo committed 1 houre ago contain Senseitive data Credentials && ZRTAPIKEY && JWTSECRET related to this Host - https://shopify.zendesk.com/ leaked publicly in github, and clearly th...
Affirm: Subdomain takeover of www█████████.affirm.com
Summary Hi there, assuming you want this report as your policy mentions Affirm resources with third-parties, but the scope was a little unclear. Regardless, www█████.affirm.com points to an AWS S3 bucket affirm-prod-www-cms█████████ that no longer exists. I was able to take control of this bucket...
MTN Group: Default Login Credentials on https://broadbandmaps.mtn.com.gh/
Summary: Hello Team, I just found out that broadbandmaps.mtn.com.gh requires logging in when you visit it, but it turned out that you can actually login as an Admin and do anything on the specific site. when you visit the mentioned site you will get this F1405776 it will require to be logged in t...
UPchieve: Business logic error
Hi UPCHIEVE SECURITY TEAM I'm Anto Vulnerability : Business logic error There is no password verification while changing a password. Steps to Reproduce : 1. Go to https://hackers.upchieve.org/resetpassword. 2. Click the change password. 3. If your old password was ex: hacker and in new password...
Glovo: Getting a free delivery by singing up from "[email protected]"
Hello Getting a free delivery for food by just signing up from "[email protected]" and you also see the " FREE delivery Glovo Team ∞" in profile section. To cross check, i made a another account by using regular email-id "[email protected] " and placed a order with same location but i didn't g...
U.S. Dept Of Defense: EC2 subdomain takeover at http://████████/
There is a dangling DNS A record that points to an EC2 instance that no longer exists, I was able to claim the EC2 instance and host content on http://███████/. Steps To Reproduce: 1. Visit http://█████████/██████████.html and view the PoC: ██████ Suggested Remediation Steps Remove the A record...
Valve: Modify in-flight data to payment provider Smart2Pay
I have found vulnerability which allows attacker to generate steam wallet balance. Firstly you will have to change yours steam account email to something like I will explain why in next steps, amount100 is the important part: brixamount100abc@█████ Then go to...
Shopify: EC2 Takeover at turn.shopify.com
Summary Hi team, It seems that the domain turn.shopify.com pointed to an EC2 instance that was terminated and the DNS record wasn't updated. We managed to register a new EC2 instance with the IP that turn.shopify.com points to: Command dig turn.shopify.com ; DiG 9.11.3-1ubuntu1.13-Ubuntu...
UPchieve: Failed to validate Session after Password Change
While conducting my research I discovered that the application Failed to validate session after password change. In this scenario changing the password doesn't destroys the other sessions which are logged in with old passwords in another browser. Steps To Reproduce: 1 Login with the same account ...
Logitech: clickjacking on deleting user's clips [https://crossclip.com/clips]
Summary: An attacker can trick victim to delete his own clips on https://crossclip.com/clips. Steps To Reproduce: F1403810 1. Login 1. Create an HTML file with the following code. I-Frame THIS PAGE IS VULNERABLE TO CLICKJACKING Supporting Material/References: F1403810 Impact tricking user to dele...
Palo Alto Software: DNS Miconfiguration Leads to Subdomain Takeover - max1.liveplan.com
Summary The issue happens due to using EC2 public DNS instead of using Elastic IPs as CNAME record. This report is simliar to report 1069795 Misconfiguration - DNS Records json "host": "max1.liveplan.com", "resolver": "1.0.0.1:53" , "a": "54.68.121.128" , "cname":...
Twitter Algorithmic Bias: Underrepresentation Bias through Twitter's Cropping Algorithm #2: Favoring Animals over Black People
Bounty Hunter Name: CyberQueenMeg About You: Megan, also known as CyberQueenMeg, is a passionate rising cybersecurity professional who is interested in programming, cybersecurity, and web development. Megan is a high school senior in a rigorous computer science program at her high school where sh...
Basecamp: Login session not expire
@blackbibin reported that after signing in, you could go back in the browser and the login info would still be populated. We've ensured the login page is reloaded in this case...
Twitter Algorithmic Bias: Underrepresentation Bias through Twitter's Cropping Algorithm
Bounty Hunter Name: CyberQueenMeg About You: Megan, also known as CyberQueenMeg, is a passionate rising cybersecurity professional who is interested in programming, cybersecurity, and web development. Megan is a high school senior in a rigorous computer science program at her high school where sh...
Sifchain: SSH server due to Improper Signature Verification
I found that you are using golang.org/x/[email protected] which has a vulnerability that was fixed in this version golang.org/x/[email protected] but that vulnerability is: golang.org/x/crypto/ssh is an SSH client and server Version...
Khan Academy: The endpoint /api/internal/graphql/requestAuthEmail on Khanacademy.or is vulnerable to Race Condition Attack.
Summary The endpoint /api/internal/graphql/requestAuthEmail on www.khanacademy.org is vulnerable to a Race condition attack. That may cause a random e-mail user to receive an important amount of emails to Finish signing up for Khan Academy with invalid links. The attack is because your web...
Twitter Algorithmic Bias: Economic Harm through Twitter's Cropping Algorithm
Bounty Hunter Name: CyberQueenMeg About You: Megan, also known as CyberQueenMeg, is a passionate rising cybersecurity professional who is interested in programming, cybersecurity, and web development. Megan is a high school senior in a rigorous computer science program at her high school where sh...
LY Corporation: Access to images and videos in drafts on LINE BLOG
On LINE BLOG, sequential ID is assigned to each image/video when uploaded, and the ID is converted to actual URL on preview/publish. Due to the bug in the attachment ownership verification process, it could be possible for an attacker to view unpublished images/videos in other users' drafts by...
Mail.ru: [185.30.178.57:8080] - Vulnerable to Jetleak
sfpc.euits.dev-my.games contains a vulnerable to JetLeak web server Jetty...
Basecamp: Password reset link not expiring after changing password in settings
@blackbibin reported password reset link not expiring when password was updated from an active session, by going to the Account's Login & Security setting. We were only expiring password reset links when the password was updated through a password reset request. Now we expire password reset links...
Mail.ru: [ii.worki.ru ] emarsys subdomain takeover
hi team i am find a subdomain takeover vulnerbility in ii.worki.ru subdomain the ii.worki.ru which is delegated to emarsys.net , which is vulnerable to takeover. CName :- ████████ Name: ii.worki.ru Type:CNAME when you search https://ii.worki.ru it redirects to █████████ which is emarsys.net servi...
GitHub Security Lab: [Java] CWE-601: Add Spring URL Redirect ResponseEntity sink
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Python]: Add SqlAlchemy support for SQL injection query
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Python] CWE-287: LDAP Improper Authentication
This bug was reported directly to GitHub Security Lab...