WordPress: PII of users can be downloaded from export pages

Sensitive personally identifiable information PII of users, including their name, email, phone number, role, and organization, was exposed on the https://doaction.org/ website. The PII was found in CSV files that could be downloaded from various endpoints on the website, which could be enumerated...

Shopify: Insufficient session expiration in the **com.shopify.ping** android app

It was identified that despite a logout action will be taken by the user at the com.shopify.ping application, the authentication token is not invalidated which allows fully recovery of the initially acquired session. More specifically, after the user provides the required credentials, an...

U.S. Dept Of Defense: Reflected XSS through ClickJacking

Description: Hello DoD team i found an reflected XSS that require user interaction, but it's suspicious due the reflected payload in the page ███████ So in this case i chain it with click-jacking with image background same like the legal website to make it more trusting ████████ below is the code...

Reddit: Missing rate limit in current password change settings leads to Account takeover

Summary: Happy Wednesday, I've found a missing rate limit protection in https://reddit.com and https://vip.reddit.com in password change settings. Enter the current password security mechanism is implemented to prevent the the cyber attackers not to change the password without knowing the current...

Nextcloud: Attacker can obtain write access to any federated share/public link

Hi mates, I stumbled across this with public links. But the same holds true for any federated share. I will try to describe the link scenario. At first I thought there were more steps and resharing was involved. But it really is very simples: 1. An attacker obtains a public link again plenty of...

Lark Technologies: Improper Access Control on Lark Footer Feature

Due to improper access control within Lark's footer feature, an attacker could have potentially accessed private files. We thank @imrannisar for reporting this to our team and confirming the resolution...

Nextcloud: Password policy changes not enforced for existing passwords

So this is two reports in one. Sort of. But they are the same issue, or at least related. 1. When you setup your nextcloud there is no password policy at all. There is the strength indicator. I get the password policy app is not yet active at that point. But a minimum length would not be that...

Nextcloud: Targeted phishing attacks in Login flow v2

Vulnerability description not provided...

Acronis: Reflected XSS on my.acronis.com

Reflected XSS was possible on my.acronis.com via GET parameter "Error"...

Reddit: Application level DOS at Login Page ( Accepts Long Password )

Application-level Denial of Service DOS It is an emerging class of security attacks on sites. They aim to overwhelm the site by flooding the server with requests that are disguised as legitimate users. The sudden increase in traffic shuts down machines and networks to make them unavailable to oth...

Elastic: RCE hazard in reporting (via Chromium)

Summary: Reporting embeds a Chromium that is susceptible to RCEs Description: Reporting uses a headless Chromium to generate PNGs and PDFs. This is invoked at least on Elastic Cloud, ECE and ECK with --no-sandbox to work at all. There are RCEs readily available for Chrome, and at least the versio...

Valve: https://srcds.valve.net/find/ is leaking server config / API keys

The https://srcds.valve.net/find/ website allowed unauthenticated visitors to access sensitive configuration information about Source game servers...

Elastic: Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges

Summary Hello team, I hope you're doing well! App Search has a credentials page located at /as/credentials that lists all the API keys a user has access to, if any. That same page will 404 for users with Analyst or Editor role. This is all working as intended, however there is also an API endpoin...

Lark Technologies: Non privileged user is able to approve his own app himself leading to mass privilege escalations.

A privilege escalation vulnerability was identified in Lark which could have potentially allowed an attacker to approve the apps in the same tenant by bypassing the admin approval. We thank @imrannisar for reporting this to our team...

Ruby: 'net/http': HTTP Header Injection in the set_content_type method

The set\content\type's parameter is not filtered to prevent the injection from altering the entire request. The vulnerable code: ruby def setcontenttypetype, params = @header'content-type' = type + params.map|k,v|"; k=v".join'' end PoC 1. ruby require 'net/http' uri = URI'http://127.0.0.1:8080' r...

U.S. General Services Administration: Weak password policy leading to exposure of administrator account access

Hi, The login endpoint https://mysmartplans.gsa.gov/Marathon/Default.aspx is having weak password policy. During the recon, I came across a mysmartplans overview document http://www.accentimaging.com/accent/pdfs/Accent%20MySmartPlans.pdf . In this document few users are mentioned like - rick, ban...

Nextcloud: Nextcloud deck sharee search leaks searches to lookupserver by default

So, in short this is related to the other 2 reports https://hackerone.com/reports/1167916 and https://hackerone.com/reports/1167919 While I could not find deck on your h1 page. I kind of assume it is in scope as well as this is something you sell with the 'groupware' subscription...

Nextcloud: File drop public link can also be converted to federated share

So bear with me. Because this one requires some user interaction and makes some assumptions. 1. victim creates a files drop public link 2. attacker has that link 3. the 'add to your nextcloud is hidden' but if you manually craft the request and send it a federated share will still be created. for...

Nextcloud: Default Nextcloud server config and iOS Nextcloud client leak sharee searches to Nextcloud

In short this is the same as https://hackerone.com/reports/1167916 but then for iOS so please forgive the copy paste On a clean Nextcloud setup the functionality "Search global and public address book for users" is enabled. Now when searching for a sharee to share with. The lookup parameter is no...

Nextcloud: Default Nextcloud Server and Android Client leak sharee searches to Nextcloud

On a clean Nextcloud setup the functionality "Search global and public address book for users" is enabled. Now when searching for a sharee to share with. The lookup parameter is not passed to the server. Resulting in...

Nextcloud: Trusted servers exchange can be triggered by attacker

Hi again, So this seems to be less bad these days as the trusted servers are no longer enabled by default however they were some versions ago. The trusted servers exchanged the full user list with another server. As soon as 1 federated share is created between two instances. It is questionable if...

Nextcloud: Federated shares are not password protected

Hi again, So more from me. Bare with me because this is a highly theoretical issue. But I never the less thing it should be mitigated. Or at least disclosed. Premissie: 1. user1 on serverA has a federated share established with user2 on serverB 2. the database not the full system of serverB is...

Kubernetes: Loading YAML in Java client can lead to command execution

The io.kubernetes.client.util.Yaml file in the Kubernetes client library for Java uses a popular library SnakeYAML to serialize and deserialize YAML. The library has a feature which makes it possible to initiate instances of Java classes by using a YAML tag like !!some.Class "argument1" . More in...

Nextcloud: Unexpected federated shares added via public link

So I'm not 100% sure if this is an security issue or not. But it is in my opinion at least unexpected and could be handled better to make sure people trust the system. 1. Get a public link share again plenty of those around 2. Click the 'add to your Nextcloud' 3. A federated share is added/create...

Shopify: Add new managed stores without permission

Details A staff member who has permission to add, archive and unarchive development stores as shown in managedStoreA.png can also add new managed stores. I can't tell if the issue I pointed out in 1167453 has the same root cause as this. A staff member with the said permission can access...

Homebrew: Broken parsing of Git diff allows an attacker to inject arbitrary Ruby scripts to Casks on official taps

Description Due to improper parsing of Git diff in Homebrew/actions/review-cask-pr, it's possible to confuse parser to ignore additional lines. Which leads injection of malicious Ruby scripts. Root cause review-cask-pr uses the git diff file to check if the pull request is "simple" enough to...

PortSwigger Web Security: RCE in 'Copy as Node Request' BApp via code injection

Description Copy as Node Request is a burp suite extension that allows users to copy requests as Node.js code. Due to improper sanitization of cookie, it's possible to inject arbitrary Node.js code in copied text, which may lead remote code execution with a significant amount of user interaction...

Shopify: Add new development stores without permission

Details A staff member who only has permission to add and remove managed stores can also create development stores. It appears proper permission checks are not performed when /organizationID/stores/signupobject/devstore endpoint is queried, as long as a staff member has store access, a token is...

LY Corporation: Reflected XSS in OAUTH2 login flow (https://access.line.me)

Vulnerability description not provided...

Ozon: DOM XSS в learning.ozon.ru

DOM XSS in learning.ozon.ru via return parameter routerback...

Acronis: Reflected Cross Site Scripting at http://www.grouplogic.com/files/glidownload/verify3.asp [Uppercase Filter Bypass]

Summary The below URL checks if the product serial number provided in the url parameter serial is valid or not. http://www.grouplogic.com/files/glidownload/verify3.asp?version=CC1100x7660&serial= If an invalid product serial is provided, the user submitted serial is displayed in the response. It...

Reddit: Broken Authendication And Session Management

Summary: Broken Authendication And Session Management On reddit.com Here I'm Using 2 Browsers 1.Chrome victim Browser 2.Firefoxattacker browser Steps To Reproduce: 1. Login your Account Chrome Browser 2. Copy Cookies 3. Paste it in firefox Browser and reload 4. you login without username and...

Mail.ru: Subdomain takeover on "info-edcrunch.skillfactory.ru"

Domain, site, application -- http://info-edcrunch.skillfactory.ru/ Here there is a skillfactory domain info-edcrunch.skillfactory.ru which is pointing towards tilda pages so this domain can be taken over can can be used to do any type of attacks mostly i can make a fake login page on your behalf...

Stripo Inc: Ability to use premium templates as free user via https://stripo.email/templates/?utm_source=viewstripo&utm_medium=referral

Summary: Hello, I found security vulnerability in your web application, another business logic. Steps To Reproduce 1. Go to https://stripo.email/templates/?utmsource=viewstripo&utmmedium=referral 2. Choose any premium template and click use in editor 3. Then sign in to save and it is in your...

Mail.ru: [la.mail.ru] - SSRF + кража cookie

Blind SSRF in la.mail.ru 0day exploit for vBulletin 3.8.x-5.0...

Mail.ru: [tanks.mail.ru] SSRF + Кража cookie

Введение: Этим прекрасным вечером решили начать движок форума vBulletin, ведь он стоит на 7 сайтах которые относятся к Ext.B, а награды Вы там подняли в 3 раза практически, звучит вкусно : Глаз упал на forumrunner, ведь там была sql-injcve 16 года ПРимерно за час была обнаружена SSRF, да не прост...

Acronis: Reflected Cross Site Scripting at ColdFusion Debugging Panel http://www.grouplogic.com/CFIDE/debug/cf_debugFr.cfm

Summary The ColdFusion Debugging Panel exposed at below URL. http://www.grouplogic.com/CFIDE/debug/cfdebugFr.cfm?userPage= The userPage parameter is not properly sanitized and is displayed without proper output encoding. This results in reflected cross site scripting. Steps To Reproduce Enter any...

Reddit: Content Spoofing/Text Injection at https://gateway-production.dubsmash.com

Summary:- Hi team i found security issue on your website https://gateway-production.dubsmash.com Description:- I have found a "Content Spoofing/Text Injection" on one of the domain which is in scope https://gateway-production.dubsmash.com in which Using the link the attacker can trick any genuine...

Stripo Inc: Bypassing Content-Security-Policy leads to open-redirect and iframe xss

Summary: https://my.stripo.email/cabinet//template-editor/..... has the ff: code to make iframes more secure: html pointing to other domains won't work but, the whitelist in frame-src data has listed .firebaseapp.com, a free hosting domain, leading to iframe abuse and redirects Steps To Reproduce...

Homebrew: Brew bootstrap process is insecure

The process described in this page is not secure - no checksum / PGP signature is published and there is no way to check the download is legit: https://brew.sh/ "/bin/bash -c "$curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh"" This can lead to supply chain attacks su...

UPchieve: Zero click account Takeover due to Api misconfiguration 🏂🎩

Hacker reported that full account takeover was possible through exploitation of one our forms. Hacker provided sufficient information to prove capability and how to remediate. Our team remediated the issue so that the takeover is no longer possible. i was able to take over any account without any...

UPchieve: old session dose not expire after password change

hello all :: I discovered that the application Failure to invalidate session after password changed . In this scenario changing the password doesn't destroys the other sessions which are logged in with old passwords. url:: ==https://app.upchieve.org/== STEPS TO REPRODUCE: 1- create account in...

UPchieve: Hyper Link Injection while signup

Summary: Attacker can add their name to a URL in order to send email containing malicious hyperlinks. while signup Steps To Reproduce: 1-Go to https://app.upchieve.org and create account with the first name http://attacker.com/ and last name . 2-Now check your email and you notice there is...

UPchieve: No Rate Limit On Contact Us

hello dear suuport i have found issue on https://app.upchieve.org step 1 goto here https://app.upchieve.org 2 login into your account 3 goto here https://app.upchieve.org/contact contact 4 type Message and open burp HTTP request =========== POST /api-public/contact/send HTTP/2 Host:...

UPchieve: No Rate Limit On Reset Password

welcome all : i found that no rate limit in reset password in ::: ==https://app.upchieve.org/resetpassword== Summary: No rate limit check on forgot password which can lead to mass mailing and spamming of users and possible employees A little bit about Rate Limit: A rate limiting algorithm is used...

UPchieve: User enumeration through forget password

Vulnerability:- -User enumeration is possible through forgot password feature. steps to reproduce:- -Go to the above selected domain and go to forgot password. -submit random email and then intercept request by burp suit -in response you will get HTTP/1.1 500 Internal Server Error with "err":"No...

Reddit: Content Spoofing

Vulnerability: Content Spoofing or Text Injection Description: This vulnerability will reflect text on to the web page which is used to scam a victim to visit or send information to a malicious website. Because it is inside the domain and trusted web page, there is chances of scam. Open the Url a...

Kryptor: Kryptor/SECURITY.md missing HACKERONE program update.

Hi Team, I was going through code and found that in this https://github.com/samuel-lucas6/Kryptor/blob/master/SECURITY.md , "Security Policy" is missing update regrading Hackerone platform that "Security Bug now be submitted @ https://hackerone.com/kryptor/ this . Please update the policy...

Ruby: 'net/ftp': Uncontrolled Resource Consumption (Memory/CPU)

Current TIMEPARSER implementation allows attackers to cause a denial of service memory consumption via a large integer value for the fractions property. The problem code: ruby TIMEPARSER = -value, local = false unless /\A?\d4?\d2?\d2 ?\d2?\d2?\d2 ?:.?\d+?/x = value raise FTPProtoError, "invalid...

Glovo: Moodle XSS on evolve.glovoapp.com

Cross Site Scripting XSS / Moodle XSS Summary : Cross-site scripting XSS is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by...