VK.com: Просмотр аватарки замороженной страницы/частной группы.

Недостаточные проверки при смене аватарки...

Shopify: Improper Input Validation on https://oberlo-image-proxy.shopifycloud.com/

The service under https://oberlo-image-proxy.shopifycloud.com/ seems to work like a image proxy through the url GET parameter and it suppose to handle only images. █████████ When other content type than an image is present the service returns a 404 error to the user. curl -si...

ExpressionEngine: Authenticated RCE via page title

A vulnerability was identified and fixed that could have allowed authenticated users to execute arbitrary PHP code by manipulating the page title in a specific API call...

Krisp: Authentication CSRF resulting in unauthorized account access on Krisp app

@yassineaboukir has identified and reported a CSRF issue on our desktop applications authentication flow affecting account dashboard that could result in an unauthorized access of a user account. We would like to thank Yassine Aboukir for reporting it responsibly to our bug bounty program !...

U.S. Dept Of Defense: Reflected XSS on [█████████]

Summary: Hi security team members, I found a reflected XSS on the URL Impact 1. An attacker can steal the victim's cookies. 2. An attacker can execute JS code. System Hosts █████ Affected Products and Versions CVE Numbers Steps to Reproduce 1. Navigate to this link:-...

JetBlue: Open Redirection

An open redirection vulnerability was discovered in a URL that allowed an attacker to construct a URL within the application that causes a redirection to an arbitrary external domain. This behavior could be leveraged to facilitate phishing attacks against users of the application. The vulnerabili...

JetBlue: Access to tomcat-manager with default creds

The Apache Tomcat/6.0.35 server used by a domain was vulnerable to improper authentication due to the use of default credentials, allowing unauthorized access to the admin manager. The vulnerability was discovered and reported...

Shopify: Staff who only have apps and channels permission can do a takeover account at the wholesale store (Bypass get invitation link)

When we invite customers at the wholesale store there is a feature to "Send invite" and "Get invite link" the get invite link feature displays the customner invitation link and can only be used once, but when the customer has accepted the invitation and actived their account already have access t...

QIWI: Subdomain Takeover on 1c-start.tochka.com pointing to unbouncepages

Actuall this report is same as of this one:- https://hackerone.com/reports/38007 Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker to set up a page on t...

GitHub Security Lab: [go]: Add query for detecting CORS misconfiguration

This bug was reported directly to GitHub Security Lab...

Elastic: Critical || Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employee

@prateek0490 was able to gain access to private Github repositories through a leaked Github token on bitbucket. We confirmed this token was valid, and have rotated...

Nextcloud: Lack of bruteforce protection for TOTP 2FA

Vulnerability description not provided...

Glassdoor: Reflected XSS on https://www.glassdoor.com/job-listing/spotlight

Summary: The application is vulnerable to reflected cross-site scripting attacks on the /job-listing/spotlight URI in the callback parameter. Affected URL or select Asset from In-Scope: https://www.glassdoor.com/job-listing/spotlight Affected Parameter: callback Vulnerability Type: see list below...

Acronis: Self-DoS due to template injection via email field in password reset form on access.acronis.com

Summary HI acronis security team , how are you I hope everyone is OK in the other side of the screen . I found Template Injection in https://access.acronis.com/resetpassword/new via the mail input . Steps To Reproduce: 1. Open https://access.acronis.com/resetpassword/new and Enter the mail Payloa...

Ian Dunn: Multiple server ssh usernames leaked in your github repository

hi security team,while searching on github,I have found multiple ssh usernames that belongs to your organization are exposed in the organization github repository STEPS TO REPRODUCE:- 1.Go to this repository. you will see the leaked multiple server ssh usernames...

MTN Group: cross site scripting in : mtn.bj

Summary: Xss vulnerability in mtn.bj in file name Steps To Reproduce: 1.Go to : https://www.mtn.bj/business/ressources/formulaires/plan-de-localisation-de-compte/?next=https://www.mtn.bj/business/ressources/formulaires/formulaire-de-souscription/ 2 - fill all inputs with any data 3 - in file uplo...

MTN Group: Reflected Cross-Site scripting in : mtn.bj

Hello Team I have found a Reflected XSS vulnerability in mtn.jb by file name Steps To Reproduce: add details for how we can reproduce the issue 1. go to : https://www.mtn.bj/business/ressources/formulaires/formulaire-dutilisation-du-service-mtn-corporate-bulk-sms/?suscribeTo=Sms-Pro 2. enter any...

Glovo: Reflected XSS on delivery.glovoapp.com

Summary: Hi, there's a reflected XSS vulnerability present on the https://delivery.glovoapp.com/referrals/ endpoint. Steps To Reproduce: Opening the following URL should trigger the prompt window specified in the request parameters, indicating that arbitrary javascript can be injected into the...

GitHub Security Lab: [Java]: CWE 295 - Insecure TrustManager - MiTM

This bug was reported directly to GitHub Security Lab...

HackerOne: Information disclosure - Feedback is accessible on Public profile even after 'disallowed' at https://hackerone.com/settings/feedback

Summary: Hi team, I noticed one possible information disclosure scenario related to My Feedback managed at https://hackerone.com/settings/feedback Description: In current scenario even after uncheck the option "Show this blurb on my profile" I can access the feedback using one one requestPOST...

Shopify: Apache Flink Dashboard exposure at https://streaming-sales-model-production.flink.shopifykloud.com

Hi team POC 1. https://streaming-sales-model-production.flink.shopifykloud.com//overview Thanks Impact access to flink dashboard...

U.S. Dept Of Defense: SQL injection located in `███` in POST param `████████`

Hey DoD security team! I was able to exploit an SQL injection 1 in one of your domains. Description An SQL injection 1 was discovered in domain https://████████/██████ in the parameter ██████████. The SQL injection was located in a WHERE statment fallowed by a INT value. The vulnerable parameter...

Shopify: Theme editor `oseid` parameter is leaked to third-party services through the `Referer` header which leads to somekind of storefront password bypass.

Hello Shopify, Summary While reading @danishalkatiri's report 997350, I remembered a report that @francisbeaudoin shared with me some time agomid-February 2021 about leaking the theme editor oseid parameter and being able to exploit it to a point where he was able to somewhat bypass the storefron...

Mail.ru: [allods.mail.ru] - WebCache Poisoning Host Header lead to Potential Stored XSS

Attacker can flush web cache to inject malicious payload in Host header at allods.mail.ru . Example: Host: allods.mail.ru:13373"--alert1;...

Nextcloud: HEIC image preview can be used to invoke Imagick

The HEIC image preview provider calls into Imagick at https://github.com/nextcloud/server/blob/5d097ddb4b99673f57b8c085dedd93880ee2539d/lib/private/Preview/HEIC.phpL98-L109. This is bad as Imagick processes all kind of image types. One can use this for example to exfiltrate arbitrary files by...

Nextcloud: High memory usage for generating preview of broken image

When the attached file is uploaded and a preview is generated e.g. in the folder overview of the files app, the PHP process allocates a very large amount of memory on my machine it was shortly around 5 GByte and CPU. Tested with latest master 1366b35081f1d92429787696f4175c19a602858a on Ubuntu 20....

GitLab: Stored-XSS in merge requests

Summary As an attacker I could do XSS on Web.com because it is vulnerable Stored XSS, also known as persistent XSS, is more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Steps to reproduce 1. Go to https://gitlab.com/ 2...

Adobe: DOM XSS on www.adobe.com

Thank you @saajanbhujel for your contributions and we look forward to collaborating with you again in the future!...

U.S. Dept Of Defense: Reflected XSS - https://███

Greetings, I just found an XSS vulnerability on a page of one of your websites URL : https://████=%22%3E%3Cscript%3Ealert1%3C/script%3E https://███="alert1 By the way, could you look at my "duplicated" report when it is not? I don't mean any disrespect, but this is not the same page. thank you -...

Shopify: Exposed Cortex API at https://cortex-ingest.shopifycloud.com/

Hi there, to be honest this is the first time I have seen this type of asset, but I think it is interesting/not supposed to be exposed. There is a Cortex metrics server running without authentication on https://cortex-ingest.shopifycloud.com/. This allows us to see the config for the server, call...

Nextcloud: Missing brute force protection on OAuth2 API controller

Vulnerability description not provided...

Stripe: HTML Injection in the Invoice memos field

The memo field in customer invoices on Stripe was vulnerable to HTML injection, allowing an attacker to create a login form and steal a victim's login credentials through the auto-save functionality of their browser. This could result in the takeover of a victim's account...

Reddit: Open Redirect on www.redditinc.com via `failed` query param

hello dear support I have found the issue on https://www.redditinc.com/ama HTTP request POST /ama HTTP/1.1 Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw Cookie:...

Yoti: PIN 📌 BYPASS 🥷

Summary: 983980808 IOS App has improper rate limit. When we try to brute force the PIN, we are rate limited for 5 minutes after 5 or 6 attempt. In my testing I found that it was checking the device's local date / time so by changing it we can brute force the PIN. Steps To Reproduce: 1.Install...

Shopify: Create free Shopify application credits.

Details According to docs available at https://shopify.dev/api/admin/rest/reference/billing/applicationcredit, appCreditCreate is used to issue credits to merchants that can be used towards future app purchases in Shopify. I believe appCreditCreate mutation shouldn't be accessible to store owners...

Uber: CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.com

The CISCO ASA instance at anyconnect.routematch.com was vulnerable to CVE-2020-3452, allowing an unauthenticated attacker to retrieve arbitrary files on the local filesystem...

Mail.ru: Угон домена photo-test.gb.ru (возможно)

photo-test.gb.ru subdomain was delegated to webflow.com , which is vulnerable to takeover...

GitLab: Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"

Summary A stored XXS exists in the main page of a project. By changing the "default branch name" of a group a malicious user can inject arbitrary JavaScript into the main page of a project. Any user that is either at least developer of the project, or an administrator of the GitLab instance, and...

MTN Group: HTML injection in email content during registration via FirstName/LastName parameter

Summary: Hi, I just found an issue when register account in https://mtnmobad.mtnbusiness.com.ng//auth/registerUser It allows an attacker to inject malicious text include html code in email content. Steps To Reproduce: 1. Go to https://uat.id.manulife.ca/mortgagecreditor/register?uilocales=en-CA. ...

Acronis: Subdomain takeover of main domain of https://www.cyberlynx.lu/

Summary Hi Acronis Security Team , Hope you well. I found one of your subdomains which is www.cyberlynx.lu One of your Acquisition is pointing towards www.cyberlynx.lu canonical name = www118.wixdns.net. www118.wixdns.net canonical name = balancer.wixdns.net. balancer.wixdns.net canonical name =...

Shopify: Blog posts atom feed of a store with password protection can be accessed by anyone

Hi shopify, DESCRIPTION I found a issue with blog posts atom feed of a shopify store. So without password we can't access the blog post atom feed at https://yourstore.myshopify.com/blogs/news.atom . But this can be bypass to access the atom feed of the blog posts. For example try out this. I have...

HackerOne: PII data Leakage through hackerone reports

Summary: I found PII data leakage through the HackerOne report. I found a link in one of the disclosed report that allow me to get the address and phone numbers of security researchers. Here I got the address and phone number of ████ ███ Vulnerability Name: PII data Leakage through Steps to...

MCUboot: private keys exposed on the GitHub repository

Summary: When I searched Github for sensitive information I found some privet key in GitHub repository. these are private RSA key and private server key, which could be used for unauthorized access. Steps To Reproduce: VISIT THESE LINKS: Repository : EX:...

Mail.ru: Blind XSS Stored and CORS misconfiguration в отчете "События" сервиса top.mail.ru

Details: Прежде чем начать, хотелось бы отметить что в правилах по XSS сказано including privilege escalations within the product are accepted without bounty, однако полученные таким образом Cookies жертвы не привязаны к домену продукта top.mail.ru. Вот пример, Cookies: ██████████ Domain, site,...

Basecamp: Domain Takeover [3737signals.com]

Hi, While i was analyzing the Basecamp3 Android app i found 3737signals.com on the source code as i understand you are passing it to the intentto view it on some case. F1368921 When I opened it on the browser I got DNS error says the domain name does not exist F1368922 As you can see at the botto...

Mattermost: Specially crafted message request crashes the webapp for users who view the message

A specially crafted message request with a modified deletedat JSON parameter could crash the webapp for all users viewing the channel, or for anyone viewing a different channel if they switch to that channel afterward. This vulnerability could be exploited to prevent users from accessing a channe...

TikTok: CSRF Account Takeover

A Cross-Site Request Forgery CSRF vulnerability was found on a TikTok endpoint which could have resulted in a full account takeover. We thank @s3c for reporting this to our team and confirming its resolution...

VK.com: XSS в выборе товара.

Недостаточная валидация полей в товарах...

U.S. Dept Of Defense: XSS on ███

Hi , I found XSS on ██████████ IP Enumeration ████ go to https://███/+CSCOE+/logon.html?a0=15&a1=&a2=&a3=1 intercept the request by burp suite and send it to repeater then edit the request to be like this GET /+CSCOE+/saml/sp/acs?tgname=a HTTP/1.1 Host: ██████████ User-Agent: Mozilla/5.0 Windows ...

U.S. Dept Of Defense: XSS on https://███████/██████████ parameter

PoC https://███████/███ Pameter 'xxslots' must be invalid Payload xss%22%20tabindex%3d1%20autofocus%20onfocus%3d%22alert ███████ Impact XSS on https://███████/ System Hosts ██████████ Affected Products and Versions CVE Numbers Steps to Reproduce Go to XSS on https://██████/██████████ Suggested...