15404 matches found
GitHub Security Lab: [Java] CWE-312: Query to detect cleartext storage of sensitive information using Android SharedPreferences
This bug was reported directly to GitHub Security Lab...
Acronis: Stored Cross-site Scripting on devicelock.com/forum/
Summary Hello, @acronis Team I hope you all doing well. I just found A Stored Cross-site Scripting on devicelock.com/forum/ by changing the City value on https://www.devicelock.com/bitrix/admin/useredit.php? to HTML/javascript code and lead to Stored Cross-site Scripting. 1. go to...
Mail.ru: Information Disclosure of Garbage Collection Cycle 'Again'
Performance metrics were available at youla.ru...
GitLab: CSRF on /api/graphql allows executing mutations through GET requests
Mutations are edit or create queries used in Graphql. Gitlab prevents CSRF in this functionality by sending a POST request with a X-CSRF-Token header. The bug I found here was that, when we send a GET request, the backend does not expect the X-CSRF-Token header. Using this, an attacker could...
Reddit: Third party app could steal access token as well as protected files using inAppBrowser
Summary: Reddit android app version : 2021.8.0 OS: Android 11 This app uses com.reddit.frontpage.RedditDeepLinkActivity class to route app links including deeplink and reddit.com links while this class does not check for scheme, host and it opens given url in InAppBrowser and IAB have access to...
Evernote: CSRF leads to account deactivation of users
Step to reproduce vulnerability:- 1 Create 2 account one account is for attacker and one is for victim 2 With attacker account go to https://www.evernote.com/secure/CloseAccount.action 3 Open your burpsuite and when you will press Deactivate your Evernote account you will see another popup of...
Mail.ru: Stored xss in calendar via call link
Call link URI schema in calendar.mail.ru web application was filtered improperly, allowing malicious javascript: links...
Acronis: admin password disclosure via log file
Hi I have log file disclose admin password on https://www.devicelock.com/log.txt u can see md5 password in log file , 2020-03-20 08:12:15 - main - Module: change password 4.1.2changepassword=yes;/forum/forumauth.php;login=admin;md5=2bca2f877b7a727861b59f4a4039d2e9 Impact this information admin...
Shopify: xss is triggered on your web
I don't know where my xsshunter script is, but my script is enabled on your web. is on your web 1. https://devicemanager.shopifycloud.com/admin Impact xss is triggered...
Stripe: Verifying email bypass
A vulnerability was discovered in Stripe's Connect API that allowed an attacker to create an account without verifying the email address. This allowed the attacker to impersonate a real company and generate invoices and payments on their behalf. The invoices appeared valid as they were sent by...
Acronis: Information Disclosure via ZIP file on AWS Bucket [http://acronis.1.s3.amazonaws.com]
Summary Hello, @acronis Team I hope you all doing well. during My recon, I found OPEN S3 BUCKET http://acronis.1.s3.amazonaws.com and this BUCKET has an ZIP file . and this file contains sensitive information about the internal system of Acronis. This Zip file Is from 2018. And it looks like it w...
GitHub Security Lab: Java: Fix NashornScriptEngine detection in ScriptEngine query
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [codeql-go]: Add query to find use of constant state parameter in Oauth2 flow
This bug was reported directly to GitHub Security Lab...
Acronis: Unrestricted file upload vulnerability in IMCE
Summary Steps To Reproduce POC 1. Go to "https://forum.acronis.com/" and creat user 1. Click on edit profile and go to Signature click on inser image usig imce file manger 1. Now upload php file and bypass to add .gif in the endpoint Recommendations...
Showmax: bypass parental pin succesfully
The researcher submitted an URL where our web application wasn't checking state properly and allowed users to see parental PIN settings without any authorization. As result, anyone at the computer was allowed to see and/or change the parental PIN. Update 10/21: This report as well...
Acronis: Account Confirmation bypass leads to acess some fucntionality
STEPS: 1. Go to the URL https://account.acronis.com//auth/signup 2. Create a Business Account 3. Intercept the request using burp suite 4. Now intercept the response of given HTTP REQUEST below 5. Change the field "confirmed":false to true 6. Even you can bypass Accept term condition by changing...
U.S. Dept Of Defense: HTTP Request Smuggling
hello dear support I have found HTTP Request Smuggling on www.████████ Issue description ============== HTTP request smuggling vulnerabilities arise when websites route HTTP requests through webservers with inconsistent HTTP parsing. By supplying a request that gets interpreted as being different...
U.S. Dept Of Defense: CVE-2021-26855 on ████████ resulting in SSRF
Description: CVE-2021-26855 exists on ███████ resulting in SSRF References https://vulners.com/cve/CVE-2021-26855 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855 Impact Server Side Request Frogery System Hosts ███████ Affected Products and Versions CVE Numbers...
U.S. Dept Of Defense: SSRF due to CVE-2021-26855 on ████████
Description: There exists a Server Side Request Frogery SSRF on █████████ due to CVE-2021-26855 References https://vulners.com/cve/CVE-2021-26855 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855 Impact Server Side Request Frogery System Hosts ██████ Affected...
RubyGems: Bundler's RCE with response using Marshal
A vulnerability was found in Bundler's dependency API endpoint, which uses Marshal serialization. This could allow for remote code execution if a client receives a specially crafted response. The impact is increased risk from specifying an untrusted source or man-in-the-middle attack...
U.S. General Services Administration: PHP info page disclosure
phpinfo is a debug functionality that prints out detailed information on both the system and the PHP configuration. Step to reproduce: Go here: https://mysmartplans.gsa.gov/phpinfo.php An attacker can obtain information such as: Exact PHP version. Exact OS and its version. Details of the PHP...
U.S. General Services Administration: IDOR at training.smartpay.gsa.gov/reports/quizzes-taken-by-user
Hey, I found an IDOR that allow anyone view other user result by changing USERID parameter. /reports/quizzes-taken-by-user.csv/USERID Step to Produce: Go to the Section quizzes-taken-by-user as Shown in the Screenshot attached. Step 2: Click on Download CSV. Step 3 Intercept the Request using the...
U.S. Dept Of Defense: CSRF to Cross-site Scripting (XSS)
hello dear support I have found csrf to XSS on https://██████ my payload "; url: POST ██████████ post data answer=A"; Impact Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session...
GitHub Security Lab: Java: Query for detecting JEXL injections
This bug was reported directly to GitHub Security Lab...
U.S. Dept Of Defense: CSRF to Cross-site Scripting (XSS)
hello dear support I have found csrf to XSS on█████████ my payload "; Impact Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attacker can obtain a user's session...
Liberapay: Failure to Invalid Session after Password Change
Summary While conducting my researching I discovered that the application Failure to invalidate session after password. In this scenario changing the password doesn't destroys the other sessions which are logged in with old passwords. Reproduction Steps -Login with the same account in Chrome and...
GitLab: Guest Users can create issues for Sentry errors and track their status
Summary According to the permission docs and Error Tracking Docs , only User with role Reporter or more can see or modify the Error Tracking details. However, the "Create Issue" allows a particular Guest user to create a reference issue for the error and track its status whenever some other user...
GitHub Security Lab: Java : Add query to detect Apache Struts enabled Development mode
This bug was reported directly to GitHub Security Lab...
Panther Labs: Broken Link Hijacking on Twitter link
Our website was not updated to include our new twitter handle, and resulted in pointing to an old one that we disavowed. As a result, the bug bounty participant was able to register that Twitter handle and could have masqueraded as us. Not an actual security vulnerability or exploitation, but a...
Uber: 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl )
The host at https://muberscolombia.com/ and http://sklep.ubereats.pl/ had a dangling record pointing to unclaimed Wix and Shoplo assets. The hacker registered the latter, and claimed ownership of the resource...
GitHub Security Lab: Java : Add a query to detect Spring View Manipulation Vulnerability
This bug was reported directly to GitHub Security Lab...
Uber: IDOR leads to leak analytics of any restaurant
The GraphQL service at https://restaurant.uber.com, did not properly perform an authZ check, allowing an attacker to obtain detailed sales statistics, etc for any restaurant. Writeup at https://0xprial.com/idor-leads-to-leak-any-uber-eats-restaurant-analytics/...
Mattermost: Persistant Arbitrary code execution in mattermost android
Summary: Activity com.mattermost.share.ShareActivity is is exported and is designed to allow file sharing from third party application to mattermost android app. I have found path tansversal vulnerability at com.mattermost.share.RealPathUtil.java file public static String...
VK.com: XSS в сюжетах.
Недостаточная валидация в названии сюжета на мвк...
VK.com: Отправляем смс на любой номер от имени vk.com. (Сообщение в смс всегда одно и то же, его менять нельзя.)
Отправка SMS на любой номер для установки официальных приложений есть лимиты...
Shopify: Bypassing HTML filter in "Packing Slip Template" Lead to SSRF to Internal Kubernetes Endpoints
Summary Shopify has a feature called Print Packing Slip, with this tool, users can easily print a packing slip after customers make an order. The generated packing slip can be downloaded as a PDF file. Users can edit an Edit packing slip template to adjust with a shop design. However, there's hav...
Mattermost: Privilege Escalation leading to post in channel without having privilege
Hi H1, mattermost.cloud has a feature of making a channel and once its set to public any other user can join the channel and post comments on that channel. In System Console -- Channel -- Permission channel owner can assign wether member can post comment or not. Once channel owner selects that...
Mattermost: Account takeover due to misconfiguration
A misconfiguration vulnerability allowed an attacker to take over an account due to the failure of the web application to invalidate tokens at major state changes in time. By changing the email address associated with the account and then changing it back, an attacker could verify the old email...
GitHub Security Lab: ihsinme: CPP add query for CWE-788 Access of memory location after the end of a buffer using strncat.
This bug was reported directly to GitHub Security Lab...
Mattermost: [mattermost.com] CORS Misconfiguration leakage of admin users
Sumarry : CORS policies on pages containing sensitive information should be reviewed to determine whether it is appropriate for the application to trust both the intentions and security posture of any domains granted access. It's possible to get information about the users registered such as: id,...
curl: Inadequate Cryptographic Key Size and Insecure Cryptographic Mode. File Name :- curl_ntlm_core.c
The application is generating cryptographic keys or key pairs using a short and inadequate length. This application is using the ECB Electronic Codebook mode of operation to perform encryption, which is considered semantically insecure. Vulnerable File name :- curlntlmcore.c Vulnerable line no. 2...
Starbucks: Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome
elber discovered a CSRF in webapp.starbucks.co.jp leaked an access token if an authenticated user opened a crafted HTML file in a browser other than Chrome which has Same Site Attribute for the cookie set by default. elber also demonstrated the ability to add a Starbucks card to the account with...
GitLab: Guest users can create new test cases
Summary According to the permission docs and test case docs , only user with a role Reporter or more is allowed to create a test case. This vulnerability allows, even Guest role users to create new test cases. Steps to reproduce 1. Consider a private project with Guest role user. 2. Consider the...
QIWI: gifts.flocktory.com/phpmyadmin is vulnerable csrf
Summary: Hello Team, I found that the PHPMyAdmin login panel is publicly accessible on https://gifts.flocktory.com and it is using the 4.6.6 version of PHPMyAdmin, which is vulnerable to several CVEs...
Internet Bug Bounty: Integer overflow in CipherUpdate
Summary: I reported an integer overflow to the OpenSSL security list on Dec 13, 2020 and it was fixed in OpenSSL 1.1.1j. Reporting it here for the bounty. It was assigned CVE-2021-23840 https://nvd.nist.gov/vuln/detail/CVE-2021-23840 which NVD rated CVSS 7.5. Amusingly, the same bug worked around...
HackerOne: Dangling cloud instance at vpn.inverselink.com
Summary: vpn.inverselink.com points to 54.202.130.246, which is currently serving a TLS certificate for Workday, Inc. This seems to indicate that the subdomain is no longer controlled by HackerOne. Optional: Supporting Material/References Screenshots % dig vpn.inverselink.com +short 54.202.130.24...
GitHub Security Lab: [Java] CWE-489: Query to detect main() method in Java EE applications
This bug was reported directly to GitHub Security Lab...
VK.com: Open Redirect и подмена ссылки в сниппете приложения VKMA
Открытое перенаправление в сниппетах ссылок мини-приложений...
GitLab: Reporters can upload design to issues using the "Move to" feature
Summary According to the permission documentation, only role of Developer or more can upload Design Management files. However, using the issue "Move to" feature, a reporter can create a issue with designs. Steps to reproduce 1. Consider a private project say Private Project with a member Reporter...