Ruby: OS Command Injection in 'rdoc' documentation generator

Details: If the removeunparseable function receives a list of files with a command in the name of one of them, it will be executed. Just enough the name to match the pattern. The problem code: ruby def removeunparseable files files.reject do |file, | file =...

Nextcloud: Notification implicit PendingIntent in com.nextcloud.client allows to access contacts

When the victim downloads files in nextcloud.A notification will be triggered. The content of the notification is "Downloaded".This notification is used to remind the user that the download is complete.The pendingintent in this notification is an implicit intent. At this time a malicious app with...

Acronis: Cross-site Scripting (XSS) - Stored | forum.acronis.com

Summary There is an XSS vulnerability in the search function of the forum forum.acronis.com. Steps To Reproduce 1. Modify your own forum Nickname, add the following payload after the original nickname: alert0 2. Fill in your nickname in the Author form of the search function and wait for the...

HackerOne: Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token.

Details Title: Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token. Risk: High Impact: High Exploitability: High Target: baseurl parameter on UpdatePhabricatorIntegration mutation at /graphql endpoint. Introduction Sensitive data...

GitLab: Cache poisoning Denial of Service affecting assets.gitlab-static.net

Summary Hi, Gitlab.com is hosting JS and CSS on https://assets.gitlab-static.net/ and uses them on gitlab.com/ The static files seem to be stored on a gcp host, which by default accepts the x-http-method-override header. Since the CDN is using Varnish to cache files, I was able to combine the GCP...

Ozon: Захват домена ozoncorporate.ru

Ozoncorporate.ru domain was delegated to Tilda.cc and not used...

HackerOne: New link opening method makes hackerone vulnerable to tabnabbing

Summary: Hackerone recently changed how it opens the external links and this new way is vulnerable to tabnabbing. Description: Please see the POC. Steps To Reproduce 1. Click here: https://awasthi7.github.io/ 2. Click on proceed when warning appears. 3. The site will open in new tab and hackerone...

U.S. Dept Of Defense: [www.█████] Path-based reflected Cross Site Scripting

Description: The www.██████ endpoint is vulnerable to path-based reflected XSS which allows attackers to pass rogue JavaScript to unsuspecting users. Impact This flaw allows attackers to pass rogue JavaScript to unsuspecting users. Since the user’s browser has no way to know the script should not...

EXNESS: Access control vulnerability (read-only)

Horizontal privilege escalation that could be used to gain access to some information not associated with the current user...

MTN Group: Cross-site Scripting (XSS) - Reflected on http://h1b4e.n2.ips.mtn.co.ug:8080 via Nginx-module

The Cross-site Scripting XSS vulnerability was discovered on http://h1b4e.n2.ips.mtn.co.ug:8080 via the Nginx module. The vulnerability allowed the injection of arbitrary JavaScript code through the URL, which could be executed in the victim's browser...

U.S. Dept Of Defense: DOM Based XSS on https://████ via backURL param

Description: The following endpoint suffers from DOM Based XSS https://████████/██████=javascript:alertdocument.domain The ████████ param determines the content which will be displayed on the "Back to Search Result" button, eventually leading to RXSS. References ██████ Regards nagli Impact...

Ruby: OS Command Injection in '/lib/un.rb -- Utilities to replace common UNIX commands in Makefiles etc'

If the waitwritable command receives a list of files with a command in the name of one of them, it will be executed. PoC bash $ touch |\ touch\ evil.txt $ ls '| touch evil.txt' $ ruby -run -e waitwritable -- -w 1 -v $ ls evil.txt '| touch evil.txt' The vulnerability has the same severity as...

MTN Group: Cross-site Scripting (XSS) - Reflected on https://api.mtn.sd/carbon/admin/login.jsp via `msgId` parameter - CVE-2020-17453

A reflected cross-site scripting XSS vulnerability was discovered in the msgId parameter of the login page at https://api.mtn.sd/carbon/admin/login.jsp. This vulnerability allowed an attacker to execute arbitrary JavaScript code in the context of the vulnerable page...

Algolia: PHP-FPM status page disclosure

A page leaking debug information was publicly accessible...

Flickr: Incorrect Deep-link validation leading to unresponsive application and device

A specifically crafted URL provided to a victim caused their Flickr for Android app to become unresponsive...

Elastic: XXE in Enterprise Search's App Search web crawler

Summary Hello team! The latest version of Enterprise Search 7.12.0 is vulnerable to XXE when parsing sitemaps. Up to now I'm only able to read file that contain one line. I'm reporting now to avoid duplicates, but I'll keep working to find a way to extract entire files or HTTP request bodies...

GitLab: RCE when removing metadata with ExifTool

Summary When uploading image files, GitLab Workhorse passes any files with the extensions jpg|jpeg|tiff through to ExifTool to remove any non-whitelisted tags. An issue with this is that ExifTool will ignore the file extension and try to determine what the file is based on the content, allowing f...

U.S. Dept Of Defense: Reflected XSS on https://██████

Description: Reflected XSS on https://███████ POC: https://███/████=https://████████████/%3C/script%3E%3Cscript%3Ealertorigin%3C/script%3E&██████ References ███████ Impact Unauthenticated Reflected XSS System Hosts ████████ Affected Products and Versions CVE Numbers Steps to Reproduce Step 1: Go ...

Ruby on Rails: Argument/Code Injection via ActiveStorage's image transformation functionality

An argument/code injection vulnerability was discovered in ActiveStorage's image transformation functionality. This vulnerability allowed an attacker to inject arbitrary arguments into the image transformation command, potentially leading to remote code execution. The vulnerability was found in t...

Nextcloud: Ratelimiting can be bypassed using IPv6 subnets

Nextcloud hardcodes IPv6 subnets to /128. End users get at least a /64 subnet more than the whole IPv4 address space!, most providers assign even larger subnets like /48. The subnet is used to block bruteforce attempts 3 and rate limiting 4. An attacker can easily generate random addresses from t...

QIWI: SSRF на https://qiwi.com с помощью "Prerender HAR Capturer"

Здравствуйте! На сайте https://qiwi.com вы используете Prerender HAR Capturer 5.6.0 на основе Headless Chrome для рендеринга HTML, снимков экрана, PDF-файлов и файлов HAR с любой веб-страницы https://github.com/prerender/prerender. Если на qiwi.com послать запрос с измененным юзер-агентом...

U.S. Dept Of Defense: Sensitive data exposure via https://███████/jira//secure/QueryComponent!Default.jspa - CVE-2020-14179

Description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. Impact...

Nextcloud: Improper input-size validation on the user new session name can result in server-side DDoS.

Advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5w...

Clario: Social media link hijack of team member [Linkedin] at https://mackeeper.com/team/

Steps To Reproduce: - Go to at https://mackeeper.com/team/ - You can see your team members photos - I have Hijacked social media link for member name as Mammon PPC Account who seems to be Manager - You can click on his photo and you will be redirected to My account on Linkedin here at...

U.S. Dept Of Defense: XML Injection / External Service Interaction (HTTP/DNS) On https://█████████.mil

Greetings, I found on one of your sites an XML Injection + External service Interaction DNS/HTTP Link of the vulnerable file : https://█████.mil/██████████ Payload XML Injection : fkp please change the link of burp collaborator and + URL encode the payload How to reproduce █████ I cut the video...

U.S. Dept Of Defense: ████████ portal is open to enumeration once authenticated. Session ID's appear static. All PII available once a valid session ID is found.

Description: Once Authenticated to █████████ portal with valid credentials you can type in another members session id and you can see any service members data as if you were authenticated as them. https://█████████ I did not see if there was a way to dump all session id's, but wouldn't be too...

U.S. Dept Of Defense: Reflected XSS through clickjacking at https://████

Description: I'm able to control the url being inserted into the query line at https://█████/████&url=http%3a%2f%2fgalnagli.com%2f%3Cimg+src%3dx+onerror%3dalert%28document.domain%29%3E The server issues a request there is also SSRF here I'll report later to the domain specified, and it renders th...

Uber: Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PII

The security researchers discovered a number of connected IDORs in the Uber business and voucher applications. By chaining these vulnerabilities together, the researchers could retrieve information related to existing voucher policies and modify those policies for monetary gain, such as for free...

X (Formerly Twitter): Bypass t.co link shortener in Twitter direct messages

The researcher demonstrated a way to create a link that will not be replaced with safe shortened t.co url, by sending Direct Messages containing more than 50 t.co links to another Twitter user. If the recipient views the message using Twitter’s Android app, and clicks the 51st link in the...

GitLab: Mint Oauth2 access token for targeted user

The vulnerability allowed a group owner to create an application that was trusted by default, bypassing CSRF controls for the authorization flow. This enabled the minting of access tokens for targeted users without their consent...

U.S. Dept Of Defense: CVE-2019-3403 on https://████/rest/api/2/user/picker?query=

Description: The endpoint at https://████████/rest/api/2/user/picker?query= Suffers from CVE-2019-3403 Due to old version of jira. F125281 References https://nvd.nist.gov/vuln/detail/CVE-2019-3403 @naglinagli Impact The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from...

U.S. Dept Of Defense: CSRF Based XSS @ https://██████████

Summary: Good Afternoon Team, I recently discovered subdomain https://██████████/█████████ from a POST Based XSS which when combined with CSRF allows for seemless XSS. ███ HTTP Request POST /██████ HTTP/1.1 Host: █████████ Connection: close Content-Length: 619 Cache-Control: max-age=0 sec-ch-ua:...

Nextcloud: DoS due to improper input validation can break the admin access into the user data will disallow him from editing that user's data.

Impact A malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. Patches It is recommended that the Nextcloud Server is upgraded to 19.0.11, 20.0.10 or 21.0.2 Workarounds Use the OCC command line tool to...

Sifchain: xmlrpc.php And /wp-json/wp/v2/users FILE IS enable it will used for bruteforce attack and denial of service

Hi Team : i am abbas heybati ; Summary: After reviewing the given scope, I realized that the main domain "http://sifchain.finance" has several vulnerabilities that I will report to you as a scenario. I realize that I have reported to you outside of Scope. The report is related to the mentioned...

Shopify: Stored XSS in /admin/product and /admin/collections

Hello Security Team, I was going through previous reports of XSS and I have found this, https://hackerone.com/reports/978125 As stated by team on this page even on https://hackerone.com/shopify?type=team under Known issues that we can now report XSS under Rich Text Editor on Product description a...

MTN Group: Cross-site Scripting (XSS) - Reflected on http://callertunez.mtn.com.gh/wap/noauth/sharedetail.ftl via `callback` parameter

The vulnerability was a reflected cross-site scripting XSS found on the website http://callertunez.mtn.com.gh/wap/noauth/sharedetail.ftl via the "callback" parameter. The vulnerability allowed the execution of arbitrary JavaScript code...

U.S. Dept Of Defense: Reflected XSS

Summary Reflected cross-site scripting XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. An attacker can execute JavaScript arbitrary code on the victim's session. Impact - Perform any action within the applicati...

U.S. Dept Of Defense: Administration Authentication Bypass on https://█████

Hi there I found a way to connect to an administration space on your website https://██████████ how to reproduce ? 1 - go to this link : https://███/██████████ 2 - create a html file with : html 3 - launch the file, click on the button and return to the page https://███████/█████ 4 - refresh the...

Acronis: Reflected XSS on www.acronis.com/de-de/my/subscriptions/index.html

Vulnerability description not provided...

Sifchain: Private KEY of crypto wallet

Summary: Hello, I'm writing in order to inform you that in your source code is stored the Private key of your crypto wallet that contains some money, as EOS, FNDR, and more. Your wallet address is this: 0x627306090abaB3A6e1400e9345bC60c78a8BEf57 Steps To Reproduce: The key is stored in "those...

HackerOne: Tab nabbing in Hackerone inbox.

Description: Tab nabbing vulnerability occurs When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change its location using the window.opener property and from this a lot of phishing attacks could happen. This scenario occurs on...

Ruby: lib/net/ftp.rb: trusting PASV responses allow client abuse

When net/ftp performs a passive FTP transfer, it tries to using PASV. Passive mode is what net/ftp uses by default. A server response to a PASV command includes the IPv4 address and port number for the client to connect back to in order to perform the actual data transfer. This is how the FTP...

Uber: Chain of vulnerabilities in Uber for Business Vouchers program allows for attacker to perform arbitrary charges to victim's U4B payment account

We have determined that through a chain of 3 vulnerabilities, it is possible for any U4B user to apply credit card charges or holds to any business using the Vouchers site. These charges originate from Uber and are unsolicited by the victim business, and can be made in any amount of the attacker'...

Moneybird: No rate Limit

Mailing to our support team using the support center in the application was improperly rate limited. There is now a better rate limiter in place...

Shopify: XSS at https://exchangemarketplace.com/blogsearch

There is an XSS vulnerability on https://exchangemarketplace.com/blogsearch page through the q parameters. https://exchangemarketplace.com/blogsearch?q=OnMoUsEoVeR=prompt/hacked/// F1251282 Impact XSS at https://exchangemarketplace.com/blogsearch...

Kubernetes: Holes in EndpointSlice Validation Enable Host Network Hijack

Summary: A user with permission to create Services and EndpointSlices can configure these resources to allow sending traffic to arbitrary ports in the host network. Kubernetes Version: Any version with EndpointSliceProxying enabled, default in 1.19+ Component Version: 1.19+ Steps To Reproduce:...

U.S. Dept Of Defense: xss reflected on https://███████- (███ parameters)

Greetings, i've found an xss on█████████████████ parameters link : █████████████████ Payload : "/alert1; vulnerable parameters █████████ ████ ████ Impact A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing...

U.S. Dept Of Defense: xss on https://███████(█████████ parameter)

Greetings, i've found an xss on https://██████████████████ parameter link :████████.█████████████=%22/%3E%3Cimg%20src=x%20onerror=alert1%3E Payload : "/ ████████ best regards, frenchvlad Impact A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the...

U.S. Dept Of Defense: XSS Reflected on https://███ (███ parameter)

Greetings, i've found an xss on https://█████ ██████████ parameter link : https://█████/████████?████████=%22%3E%3Cscript%3Ealert/frenchvlad/;%3C/script%3E&██████████ Payload : "alert/frenchvlad/; ██████ best regards, frenchvlad Impact A reflected XSS vulnerability happens when the user input fro...

Nextcloud: Leak arbitrary file under nextcloud android client privacy directory

Steps to reproduce: 1.install and login nextcloud android client 2.create a directory and set it 'shareable' 3.install the poc app "setresultcontactphotocrop" key code: EvilActivity public class EvilActivity extends AppCompatActivity final static String PRIVATEURI =...