curl: CVE-2021-22901: TLS session caching disaster

Summary: lib/vtls/openssl.c osslconnectstep1 sets up the osslnewsessioncb sessionid callback with SSLCTXsesssetnewcb, and adds association from dataidx and connectdataidx to current conn and data respectively: SSLCTXsetsessioncachemodebackend-ctx, SSLSESSCACHECLIENT | SSLSESSCACHENOINTERNAL;...

Valve: Buffer overrun in Steam SILK voice decoder

Vulnerability The SteamWorks SDK has a function available named DecompressVoice, which takes as input some compressed voice data, and returns the raw audio data. The format for the input voice data is as follows: 8 bytes - steamid 1 byte - payload type 2 bytes - payload size 4 bytes - CRC checksu...

HackerOne: Private program disclosure of `██████████` through notifications

Summary: Private program disclosure of ██████ through notifications Description: It looks like there is a private program called ████████ - https://hackerone.com/████████ which I'm not yet invited yet. However, I received a notification alert in my H1 account notification box indicating the priva...

CS Money: Able to blocking users with 2fa from login into their accounts by just knowing the SteamID

A vulnerability was discovered where an attacker could block users with two-factor authentication from logging into their accounts on a website by modifying the steamid cookie in the two-factor authentication code confirmation request. By changing the steamid cookie to the victim's and sending...

Palo Alto Software: Subdomain takeover of www2.growasyouplan.com

Summary www2.growasyouplan.com points to an AWS EC2 instance at 67.202.62.93 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are...

Ruby: imap: StartTLS stripping attack (CVE-2016-0772).

net/imap does not seem to raise an exception when the remote end imap server fails to respond with taggedresponse NO/BAD or OK to an explicit call of imap.starttls. This may allow a malicious MITM to perform a starttls stripping attack if the client code does not explicitly set usessl = true on...

Node.js: Improper handling of untypical characters in domain names

Description Missing input validation of host names returned by Domain Name Servers in node's dns library can lead to output of wrong hostnames leading to Domain Hijacking and injection vulnerabilities in applications using the library leading to Remote Code Execution, XSS, Applications crashes,...

Logitech: session takeover via open protocol redirection on streamlabs.com

Summary: Hi Logitech team, on streamlabs.com the endpoint: streamlabs.com/global/identity?popup=1&r=protocol://merch.streamlabs.com redirect any authenticated user to a arbitrary protocol, and it merge the redirect link with an accesstoken. F1281409 this means that if a malicious app that handle...

Mail.ru: [geekbrains.ru] Node modules path disclosure due to lack of error handling

Full stack error trace at HTTP 404-error on nexus.geekbrains.ru discloses the full path of the Node.js module directory on the server...

Mail.ru: [mcs.mail.ru] Пользователь с ролью наблюдателя может создавать ключи доступа для очереди сообщений (sqs.mcs.mail.ru)

IDOR for X-Pid header allowed user with observer role to elevate privileges for SQS service of MCS sqs.mcs.mail.ru by using role from the different project. Insecure check of header parameter leaded to ability of account creation in SQS service by project observer...

Uber: pam_ussh does not properly validate the SSH certificate authority

The pamussh module that Uber open-sourced in https://github.com/uber/pam-ussh does not validate that the SSH certificate presented by a user is actually signed by a trusted CA listed in the configured cafile...

UPchieve: Password reset token leak on third party website via Referer header

Summary: It has been identified that the application is leaking referrer token to third party sites. In this case it was found that the password reset token is being leaked to third party sites which is a issue knowing the fact that it can allow any malicious users to use the token and reset the...

FetLife: Specific Payload makes a Users Posts unavailable

Good Morning, Like we talked about in the email, I'm reporting an issue that I've found that is possible, by crafting a specific payload, other users that try to access /posts of a user will face the 500 Internal Server Error issue, not only when they access the specific crafted post. With this,...

curl: CVE-2021-22898: TELNET stack contents disclosure

Summary: lib/telnet.c suboption function incorrecly checks for the sscanf return value. Instead of checking that 2 elements are parsed, the code also continues if just one element matches: ifsscanfv-data, "%127^,,%127s", varname, varval As such it is possible to construct environment values that...

MariaDB: Git Config

Hey Team, I am a Security Researcher and I have found that one of your domain is leaking the git file which may led to source code of git repository exposing can led to sophisticated attacks so kindly remove it. Vuln URL - http://foundation01.mariadb.org/.git/config BEST, ABHINAV SHARMA -...

Sifchain: Clickjacking misconfiguration bug

Hi team, While performing security testing of your website i have found the vulnerability called Clickjacking. Many URLS are in scope and vulnerable to Clickjacking. What is Clickjacking ? Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of...

Sifchain: Email Spoofing bug

Hi team, An SPF/DMARC record is a type of Domain Name Service DNS record that identifies which mail servers are permitted to send email on behalf of your domain. The purpose of an SPF/DMARC record is to prevent spammers from sending messages on the behalf of your organization. Remediation: Create...

U.S. General Services Administration: [Transportation Management Services Solution 2.0] Improper authorization at tmss.gsa.gov leads to data exposure of all registered users

Summary: Hi team! I hope you are having a great Tuesday : Where: https://tmss.gsa.gov/ Who: Unathenticated users Why: Improper Access Control at /tmssserver/api/public/customerregistration/:id/userId/ I found an endpoint /tmssserver/api/public/customerregistration/:id/userId/ at...

GitHub Security Lab: [Java] Query for detecting Jakarta Expression Language injections

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: JSONP Injection

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java] CWE-094: Query to detect Groovy Code Injections

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: ihsinme: CPP Add query for CWE-691 Insufficient Control Flow Management When Using Bit Operations

This bug was reported directly to GitHub Security Lab...

UPchieve: Full account takeover of any user through reset password

Summary: Hi Security team members, Usually, If we reset our password on https://app.upchieve.org that time we got a password reset link on the email. And through that password reset link, we can reset our password. But, I noticed that if we add another email in the request of forgot password...

EXNESS: Access control vulnerability (read/write)

Horizontal privilege escalation that could be used to gain read/write access to some resources not associated with the current user...

Logitech: Privilege Escalation Leads to Control The Owner Access Token Which leads to control the stream [streamlabs.com]

Hi Security team, Summary: I was able as Administrator to change the account owner access token Description: As Administrator i have high privileges but i have some restricted areas F1278364 For example i got invitation from MrX with Administrator role. When i navigated to MrX account as...

EXNESS: Acess control vulnerability (read/write)

Horizontal privilege escalation that could be used to gain read/write access to some resources not associated with the current user...

U.S. Dept Of Defense: Remote Code Execution via Insecure Deserialization in Telerik UI (CVE-2019-18935)

Description: https://██████/██████████/Telerik.Web.UI.WebResource.axd?type=rau is vulnerable to CVE-2017-11317 and CVE-2019-18935, allowing an attacker to upload arbitrary files and gain remote code execution on the underlying system. References...

Nextcloud: index.php/apps/files_sharing/shareinfo endpoint is not properly protected

When federated shares between two Nextclouds are created they do not use standard webdav to communciate. But to obtain the filelist they seem to use the SERVER/index.php/apps/filessharing/shareinfo endpoint. Unlike the other endpoint for tokens like public link shares. There is no brute force...

Nextcloud: Trusted server shared secret stored unencrypted in the database

The attack vector here is that somebody gets their hands on your database. When two servers have added each other as trusted server they exchange shared secret token. With this token they can sync down each other user lists. However it seems that this token is stored in plain text in the...

U.S. Dept Of Defense: S3 bucket listing/download

It's possible to get a listing and download every file in the S3 bucket ██████████ and ███████ . Supporting Material/References https://hackerone.com/reports/278191 Impact An attacker can download files that are not intended to be public, both buckets are very big. An attacker can increase...

U.S. Dept Of Defense: Reflected XSS at www.███████ at /██████████ via the ████████ parameter

Description: The www.████████ site is using ████, which is vulnerable to reflected XSS in the /█████ component via the █████████ parameter. References https://www.cvedetails.com/cve/CVE-2017-14651/ https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265 Impact An attacker can caus...

Nextcloud: Default settings leak federated cloud id to lookup server of all users

So with the default settings Nextcloud still sends requests to the lookup server if users update their profile. Even if none of the fields are set to 'published'. I must admit this is somewhat of a surprise as there is no reason for this. As long as the visibility of none of the fields change and...

Nextcloud: Nextcloud update checks leaks information

Hi, I think this is more of a privacy concern than a security concern. However I wanted to check here first. Please direct me to an other suitable location if needed. It is in relation to https://github.com/nextcloud/server/blob/master/lib/private/Updater/VersionCheck.phpL78 This is sending sever...

New Relic: HTML Injection In Email In one.newrelic.com

Hi, There's a HTML injection vulnerability present inside emails sent from Newrelic when the name on the organization inviting user contains HTML. The html is stored in the backend database and when emails are sent invitation, the HTML is sent along with the rest of the email. Steps to reproduce:...

Exodus: Cache Poisoning DoS on downloads.exodus.com

Summary: Hello, The subdomain downloads.exodus.com hosts all files meant to be downloaded by exodus users. A few of the file I found are: https://downloads.exodus.com/releases/exodus-linux-x64-21.4.9.zip https://downloads.exodus.com/releases/hashes-exodus-21.2.12.txt...

HackerOne: Stored XSS in IE11 on hackerone.com via custom fields

Hi There, i found stored xss via Custom Fields F1275694 ---------------------------------- F1275691 POC: F1275692 Impact The attacker can use this issue to execute malicious script code in the victim user browser also redirect the victim user to malicious sites...

curl: CVE-2021-22897: schannel cipher selection surprise

Summary: Commit "schannel: support selecting ciphers" added support for selecting the ciphers with SCHANNEL. However, due to use of a static algIds array for ciphers in setsslciphers the last configured cipher list will override configuration used by other connections, leading to potential wrong...

WordPress: PII of users can be downloaded from export pages

Sensitive personally identifiable information PII of users, including their name, email, phone number, role, and organization, was exposed on the https://doaction.org/ website. The PII was found in CSV files that could be downloaded from various endpoints on the website, which could be enumerated...

Shopify: Insufficient session expiration in the **com.shopify.ping** android app

It was identified that despite a logout action will be taken by the user at the com.shopify.ping application, the authentication token is not invalidated which allows fully recovery of the initially acquired session. More specifically, after the user provides the required credentials, an...

U.S. Dept Of Defense: Reflected XSS through ClickJacking

Description: Hello DoD team i found an reflected XSS that require user interaction, but it's suspicious due the reflected payload in the page ███████ So in this case i chain it with click-jacking with image background same like the legal website to make it more trusting ████████ below is the code...

Reddit: Missing rate limit in current password change settings leads to Account takeover

Summary: Happy Wednesday, I've found a missing rate limit protection in https://reddit.com and https://vip.reddit.com in password change settings. Enter the current password security mechanism is implemented to prevent the the cyber attackers not to change the password without knowing the current...

Nextcloud: Attacker can obtain write access to any federated share/public link

Hi mates, I stumbled across this with public links. But the same holds true for any federated share. I will try to describe the link scenario. At first I thought there were more steps and resharing was involved. But it really is very simples: 1. An attacker obtains a public link again plenty of...

Lark Technologies: Improper Access Control on Lark Footer Feature

Due to improper access control within Lark's footer feature, an attacker could have potentially accessed private files. We thank @imrannisar for reporting this to our team and confirming the resolution...

Nextcloud: Password policy changes not enforced for existing passwords

So this is two reports in one. Sort of. But they are the same issue, or at least related. 1. When you setup your nextcloud there is no password policy at all. There is the strength indicator. I get the password policy app is not yet active at that point. But a minimum length would not be that...

Nextcloud: Targeted phishing attacks in Login flow v2

Vulnerability description not provided...

Acronis: Reflected XSS on my.acronis.com

Reflected XSS was possible on my.acronis.com via GET parameter "Error"...

Reddit: Application level DOS at Login Page ( Accepts Long Password )

Application-level Denial of Service DOS It is an emerging class of security attacks on sites. They aim to overwhelm the site by flooding the server with requests that are disguised as legitimate users. The sudden increase in traffic shuts down machines and networks to make them unavailable to oth...

Elastic: RCE hazard in reporting (via Chromium)

Summary: Reporting embeds a Chromium that is susceptible to RCEs Description: Reporting uses a headless Chromium to generate PNGs and PDFs. This is invoked at least on Elastic Cloud, ECE and ECK with --no-sandbox to work at all. There are RCEs readily available for Chrome, and at least the versio...

Valve: https://srcds.valve.net/find/ is leaking server config / API keys

The https://srcds.valve.net/find/ website allowed unauthenticated visitors to access sensitive configuration information about Source game servers...

Elastic: Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges

Summary Hello team, I hope you're doing well! App Search has a credentials page located at /as/credentials that lists all the API keys a user has access to, if any. That same page will 404 for users with Analyst or Editor role. This is all working as intended, however there is also an API endpoin...