15580 matches found
Lark Technologies: Non privileged user is able to approve his own app himself leading to mass privilege escalations.
A privilege escalation vulnerability was identified in Lark which could have potentially allowed an attacker to approve the apps in the same tenant by bypassing the admin approval. We thank @imrannisar for reporting this to our team...
Ruby: 'net/http': HTTP Header Injection in the set_content_type method
The set\content\type's parameter is not filtered to prevent the injection from altering the entire request. The vulnerable code: ruby def setcontenttypetype, params = @header'content-type' = type + params.map|k,v|"; k=v".join'' end PoC 1. ruby require 'net/http' uri = URI'http://127.0.0.1:8080' r...
U.S. General Services Administration: Weak password policy leading to exposure of administrator account access
Hi, The login endpoint https://mysmartplans.gsa.gov/Marathon/Default.aspx is having weak password policy. During the recon, I came across a mysmartplans overview document http://www.accentimaging.com/accent/pdfs/Accent%20MySmartPlans.pdf . In this document few users are mentioned like - rick, ban...
Nextcloud: Nextcloud deck sharee search leaks searches to lookupserver by default
So, in short this is related to the other 2 reports https://hackerone.com/reports/1167916 and https://hackerone.com/reports/1167919 While I could not find deck on your h1 page. I kind of assume it is in scope as well as this is something you sell with the 'groupware' subscription...
Nextcloud: File drop public link can also be converted to federated share
So bear with me. Because this one requires some user interaction and makes some assumptions. 1. victim creates a files drop public link 2. attacker has that link 3. the 'add to your nextcloud is hidden' but if you manually craft the request and send it a federated share will still be created. for...
Nextcloud: Default Nextcloud server config and iOS Nextcloud client leak sharee searches to Nextcloud
In short this is the same as https://hackerone.com/reports/1167916 but then for iOS so please forgive the copy paste On a clean Nextcloud setup the functionality "Search global and public address book for users" is enabled. Now when searching for a sharee to share with. The lookup parameter is no...
Nextcloud: Default Nextcloud Server and Android Client leak sharee searches to Nextcloud
On a clean Nextcloud setup the functionality "Search global and public address book for users" is enabled. Now when searching for a sharee to share with. The lookup parameter is not passed to the server. Resulting in...
Nextcloud: Trusted servers exchange can be triggered by attacker
Hi again, So this seems to be less bad these days as the trusted servers are no longer enabled by default however they were some versions ago. The trusted servers exchanged the full user list with another server. As soon as 1 federated share is created between two instances. It is questionable if...
Nextcloud: Federated shares are not password protected
Hi again, So more from me. Bare with me because this is a highly theoretical issue. But I never the less thing it should be mitigated. Or at least disclosed. Premissie: 1. user1 on serverA has a federated share established with user2 on serverB 2. the database not the full system of serverB is...
Kubernetes: Loading YAML in Java client can lead to command execution
The io.kubernetes.client.util.Yaml file in the Kubernetes client library for Java uses a popular library SnakeYAML to serialize and deserialize YAML. The library has a feature which makes it possible to initiate instances of Java classes by using a YAML tag like !!some.Class "argument1" . More in...
Nextcloud: Unexpected federated shares added via public link
So I'm not 100% sure if this is an security issue or not. But it is in my opinion at least unexpected and could be handled better to make sure people trust the system. 1. Get a public link share again plenty of those around 2. Click the 'add to your Nextcloud' 3. A federated share is added/create...
Shopify: Add new managed stores without permission
Details A staff member who has permission to add, archive and unarchive development stores as shown in managedStoreA.png can also add new managed stores. I can't tell if the issue I pointed out in 1167453 has the same root cause as this. A staff member with the said permission can access...
Homebrew: Broken parsing of Git diff allows an attacker to inject arbitrary Ruby scripts to Casks on official taps
Description Due to improper parsing of Git diff in Homebrew/actions/review-cask-pr, it's possible to confuse parser to ignore additional lines. Which leads injection of malicious Ruby scripts. Root cause review-cask-pr uses the git diff file to check if the pull request is "simple" enough to...
PortSwigger Web Security: RCE in 'Copy as Node Request' BApp via code injection
Description Copy as Node Request is a burp suite extension that allows users to copy requests as Node.js code. Due to improper sanitization of cookie, it's possible to inject arbitrary Node.js code in copied text, which may lead remote code execution with a significant amount of user interaction...
Shopify: Add new development stores without permission
Details A staff member who only has permission to add and remove managed stores can also create development stores. It appears proper permission checks are not performed when /organizationID/stores/signupobject/devstore endpoint is queried, as long as a staff member has store access, a token is...
LY Corporation: Reflected XSS in OAUTH2 login flow (https://access.line.me)
Vulnerability description not provided...
Ozon: DOM XSS ะฒ learning.ozon.ru
DOM XSS in learning.ozon.ru via return parameter routerback...
Acronis: Reflected Cross Site Scripting at http://www.grouplogic.com/files/glidownload/verify3.asp [Uppercase Filter Bypass]
Summary The below URL checks if the product serial number provided in the url parameter serial is valid or not. http://www.grouplogic.com/files/glidownload/verify3.asp?version=CC1100x7660&serial= If an invalid product serial is provided, the user submitted serial is displayed in the response. It...
Reddit: Broken Authendication And Session Management
Summary: Broken Authendication And Session Management On reddit.com Here I'm Using 2 Browsers 1.Chrome victim Browser 2.Firefoxattacker browser Steps To Reproduce: 1. Login your Account Chrome Browser 2. Copy Cookies 3. Paste it in firefox Browser and reload 4. you login without username and...
Mail.ru: Subdomain takeover on "info-edcrunch.skillfactory.ru"
Domain, site, application -- http://info-edcrunch.skillfactory.ru/ Here there is a skillfactory domain info-edcrunch.skillfactory.ru which is pointing towards tilda pages so this domain can be taken over can can be used to do any type of attacks mostly i can make a fake login page on your behalf...
Stripo Inc: Ability to use premium templates as free user via https://stripo.email/templates/?utm_source=viewstripo&utm_medium=referral
Summary: Hello, I found security vulnerability in your web application, another business logic. Steps To Reproduce 1. Go to https://stripo.email/templates/?utmsource=viewstripo&utmmedium=referral 2. Choose any premium template and click use in editor 3. Then sign in to save and it is in your...
Mail.ru: [la.mail.ru] - SSRF + ะบัะฐะถะฐ cookie
Blind SSRF in la.mail.ru 0day exploit for vBulletin 3.8.x-5.0...
Mail.ru: [tanks.mail.ru] SSRF + ะัะฐะถะฐ cookie
ะะฒะตะดะตะฝะธะต: ะญัะธะผ ะฟัะตะบัะฐัะฝัะผ ะฒะตัะตัะพะผ ัะตัะธะปะธ ะฝะฐัะฐัั ะดะฒะธะถะพะบ ัะพััะผะฐ vBulletin, ะฒะตะดั ะพะฝ ััะพะธั ะฝะฐ 7 ัะฐะนัะฐั ะบะพัะพััะต ะพัะฝะพััััั ะบ Ext.B, ะฐ ะฝะฐะณัะฐะดั ะั ัะฐะผ ะฟะพะดะฝัะปะธ ะฒ 3 ัะฐะทะฐ ะฟัะฐะบัะธัะตัะบะธ, ะทะฒััะธั ะฒะบััะฝะพ : ะะปะฐะท ัะฟะฐะป ะฝะฐ forumrunner, ะฒะตะดั ัะฐะผ ะฑัะปะฐ sql-injcve 16 ะณะพะดะฐ ะะ ะธะผะตัะฝะพ ะทะฐ ัะฐั ะฑัะปะฐ ะพะฑะฝะฐััะถะตะฝะฐ SSRF, ะดะฐ ะฝะต ะฟัะพัั...
Acronis: Reflected Cross Site Scripting at ColdFusion Debugging Panel http://www.grouplogic.com/CFIDE/debug/cf_debugFr.cfm
Summary The ColdFusion Debugging Panel exposed at below URL. http://www.grouplogic.com/CFIDE/debug/cfdebugFr.cfm?userPage= The userPage parameter is not properly sanitized and is displayed without proper output encoding. This results in reflected cross site scripting. Steps To Reproduce Enter any...
Reddit: Content Spoofing/Text Injection at https://gateway-production.dubsmash.com
Summary:- Hi team i found security issue on your website https://gateway-production.dubsmash.com Description:- I have found a "Content Spoofing/Text Injection" on one of the domain which is in scope https://gateway-production.dubsmash.com in which Using the link the attacker can trick any genuine...
Stripo Inc: Bypassing Content-Security-Policy leads to open-redirect and iframe xss
Summary: https://my.stripo.email/cabinet//template-editor/..... has the ff: code to make iframes more secure: html pointing to other domains won't work but, the whitelist in frame-src data has listed .firebaseapp.com, a free hosting domain, leading to iframe abuse and redirects Steps To Reproduce...
Homebrew: Brew bootstrap process is insecure
The process described in this page is not secure - no checksum / PGP signature is published and there is no way to check the download is legit: https://brew.sh/ "/bin/bash -c "$curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh"" This can lead to supply chain attacks su...
UPchieve: Zero click account Takeover due to Api misconfiguration ๐๐ฉ
Hacker reported that full account takeover was possible through exploitation of one our forms. Hacker provided sufficient information to prove capability and how to remediate. Our team remediated the issue so that the takeover is no longer possible. i was able to take over any account without any...
UPchieve: old session dose not expire after password change
hello all :: I discovered that the application Failure to invalidate session after password changed . In this scenario changing the password doesn't destroys the other sessions which are logged in with old passwords. url:: ==https://app.upchieve.org/== STEPS TO REPRODUCE: 1- create account in...
UPchieve: Hyper Link Injection while signup
Summary: Attacker can add their name to a URL in order to send email containing malicious hyperlinks. while signup Steps To Reproduce: 1-Go to https://app.upchieve.org and create account with the first name http://attacker.com/ and last name . 2-Now check your email and you notice there is...
UPchieve: No Rate Limit On Contact Us
hello dear suuport i have found issue on https://app.upchieve.org step 1 goto here https://app.upchieve.org 2 login into your account 3 goto here https://app.upchieve.org/contact contact 4 type Message and open burp HTTP request =========== POST /api-public/contact/send HTTP/2 Host:...
UPchieve: No Rate Limit On Reset Password
welcome all : i found that no rate limit in reset password in ::: ==https://app.upchieve.org/resetpassword== Summary: No rate limit check on forgot password which can lead to mass mailing and spamming of users and possible employees A little bit about Rate Limit: A rate limiting algorithm is used...
UPchieve: User enumeration through forget password
Vulnerability:- -User enumeration is possible through forgot password feature. steps to reproduce:- -Go to the above selected domain and go to forgot password. -submit random email and then intercept request by burp suit -in response you will get HTTP/1.1 500 Internal Server Error with "err":"No...
Reddit: Content Spoofing
Vulnerability: Content Spoofing or Text Injection Description: This vulnerability will reflect text on to the web page which is used to scam a victim to visit or send information to a malicious website. Because it is inside the domain and trusted web page, there is chances of scam. Open the Url a...
Kryptor: Kryptor/SECURITY.md missing HACKERONE program update.
Hi Team, I was going through code and found that in this https://github.com/samuel-lucas6/Kryptor/blob/master/SECURITY.md , "Security Policy" is missing update regrading Hackerone platform that "Security Bug now be submitted @ https://hackerone.com/kryptor/ this . Please update the policy...
Ruby: 'net/ftp': Uncontrolled Resource Consumption (Memory/CPU)
Current TIMEPARSER implementation allows attackers to cause a denial of service memory consumption via a large integer value for the fractions property. The problem code: ruby TIMEPARSER = -value, local = false unless /\A?\d4?\d2?\d2 ?\d2?\d2?\d2 ?:.?\d+?/x = value raise FTPProtoError, "invalid...
Glovo: Moodle XSS on evolve.glovoapp.com
Cross Site Scripting XSS / Moodle XSS Summary : Cross-site scripting XSS is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by...
Reddit: No Rate limit on change password leads to account takeover
Summary: I found when login and go to changing password, there is no rate limit on that function, which leads to takeover the account. Steps To Reproduce: 1-Create account on https://old.reddit.com & move to your setting,In my case I chose !23Qweasdzxc as the password. 2-Go to change password on...
Reddit: [dubsmash] Username and password bruteforce
Summary: Due to less complexity of password and no rate limiting attacker can bruteforce user name and password and takeover the victim account Login Page- No rate limits Password length is minimum five character with no variations. Plain password are easy to bruteforce Reset Password page- No ra...
MTN Group: Missing captcha and rate limit protection in help form
Hello One of your form that you are using to receive help message from users, lack captcha and its backend/server does not block massive request. The page is https://mtn.cm/fr/help/ Steps To Reproduce: 1. Visit https://mtn.cm/fr/help/ and fill all the field and submit. 2. Intercept the request wi...
GitHub Security Lab: [Java] CWE-1004: Query to check sensitive cookies without the HttpOnly flag set
This bug was reported directly to GitHub Security Lab...
Liberapay: Disavowing an account doesn't disable it
Hello security team, while I testing your website, I found improper email verification while sign-up liberapay.com. Steps to reproduce: 1 Go to https://liberapay.com. 2 Create new account with any email. 3 You will receive an email verification to the given email. 4 Open that email and click "No,...
Acronis: Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm
Summary The store admin page is accessible without authentication at below URL: http://www.grouplogic.com/ADMIN/store/index.cfm The store admin page provides functionalities such as the following: - Add Edit Items - Search Products - Search Results - Search Orders - Orders Search Results - Add Ne...
Acronis: Stored Cross Site Scripting at http://www.grouplogic.com/ADMIN/store/index.cfm?fa=disprocode
Summary The application exposes store ADMIN page at below URL and is accessible without authentication. http://www.grouplogic.com/ADMIN/store/index.cfm The ADMIN page provides several functionalities. Among them the below functionality is found to be vulnerable to stored XSS. - View and Edit Prom...
MTN Group: Remote code execution due to unvalidated file upload
Summary: Hello I found a critical vunerability in one of your site, where user can upload any file type as a profile picture including php file Steps To Reproduce: 1. Visit https://careers.mtn.cm and register as a user. 2. After successful registration, login and update your data. 3. When uploadi...
Shopify: No Session Expiry after log-out, attacker can reuse the old cookies
The session fixation vulnerability allowed an attacker to reuse old session cookies to log in to a victim's account on the Exchange Marketplace, even after the victim had logged out. The service has been decommissioned, and the issue has been resolved...
GitHub Security Lab: porcupiney.hairs : Java/Android - Insecure Loading of a Dex File
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Java] CWE-759: Query to detect password hash without a salt
This bug was reported directly to GitHub Security Lab...