Concrete CMS: Stored unauth XSS in calendar event via CSRF

crayons Description The description parameter in the scenario /index.php/ccm/calendar/dialogs/event/add/save is affected by Stored XSS due to lack of user supplied data filtration. Also in should be mentioned that this endpoint does not verify CSRF token ccmtoken, which leads to an ability to...

Mail.ru: Reflected XSS https://tracker.my.com

Reflected XSS on tracker.my.com via GET parameter iconUrl...

curl: CVE-2021-22876: Automatic referer leaks credentials

Summary: When using the --referer ';auto' feature the current URL is copied as-is to the referrer header of the subsequent request. The recommendation 1 is to strip these along with the URL fragment. I can imagine this may, in rare cases, result in unwanted/unexpected disclosure of credentials e....

8x8: DNS Misconfiguration (Subdomain Takeover) ███████.8x8.com

An EC2 instance was replaced but the DNS record was initially not updated/removed. The issue has been rectified. https://medium.com/bugbountywriteup/dangling-dns-aws-ec2-e2d801701e8...

Rockstar Games: Open redirect on https://signin.rockstargames.com/connect/authorize/rsg

In this report, the researcher found that a previously-addressed Open Redirect vulnerability on https://signin.rockstargames.com/connect/authorize/rsg had once again become exploitable. We were able to quickly re-apply our previous solution and once again resolve the vulnerability...

VK.com: Stored XSS при удалении группы из беседы (m.vk.com)

Недостаточная фильтрация символов в названии сообщества...

U.S. Dept Of Defense: Course Registration Form Allowing an attacker to dump all the candidate name who had enrolled for the course

The application allowed an attacker to enumerate all candidate names who had applied for various courses by cycling a numeric parameter in the application's URL...

GitHub Security Lab: [Java] CWE-295: Disabled certificate validation in JXBrowser

This bug was reported directly to GitHub Security Lab...

Automattic: Reflected XSS due to vulnerable version of sockjs

Summary: There is reflected XSS on .simperium.com. The bug exists due to a vulnerable version of sockjs library. Platforms Affected: simperium.com js.simperium.com Steps To Reproduce: 1. Visit https://simperium.com/sock/1/0/0/0/htmlfile?c=alert'XSS'// 2. You will see an alert message because of...

Automattic: SSRF & Blind XSS in Gravatar email

Nathan Cavitt rockybandana reported a blind XSS issue in the Gravatar service, which was due to incorrect/insufficient sanitization on adding emails to one's profile. The report was of good quality and the issue was fixed within a couple of days of report...

Mail.ru: REST API Endpoint leads to Unauthorized user disclosed private [ issue ] details

Summary Jira allows an administrator to restrict access to projects to specific users only. Or adjusting all project properties to be available only to the system administrator, which means that all users in the jira account cannot access issues, project, dashboard and any information about the...

Kartpay: Host Header Injection

Summary: Hello Team, While performing security testing on your Main Domain, I found a Host Header Injection Vulnerability. Vulnerability Description: An attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multip...

GitLab: Kroki Arbitrary File Read/Write

Summary In short, I've found a potentially weird bug in asciidoctor that could lead to arbitrary file read/write in asciidoctor-kroki even though Gitlab have already made an attempt to disable kroki-plantuml-include lib/gitlab/asciidoc.rb rb module Gitlab Parser/renderer for the AsciiDoc format...

Revive Adserver: Reflected XSS on /admin/campaign-zone-zones.php

I found a reflected XSS attack on /admin/campaign-zone-zones.php. Revive-Adserver version is revive-adserver-5.1.1. - Go to http://revive-adserver.loc/admin/campaign-zone-zones.php?=&clientid=1&campaignid=1&status=available%22%3E%3Cimg%20src=1%20onerror=alertdocument.domain%3E&text= - Malicious...

Revive Adserver: Reflected XSS on /admin/stats.php

Linked to the report https://hackerone.com/reports/1083376 I found a reflected XSS attack on /admin/stats.php. Revive-Adserver version is revive-adserver-5.1.1. This time I found the parameter statsBreakdown - Go to...

Glassdoor: Open redirect on https://www.glassdoor.com/profile/siwa.htm via state parameter

An open redirect was found at https://www.glassdoor.com/profile/siwa.htm due to improper validation of the state parameter. Thanks, @0x7 for finding this and reporting this to us and looking forward to more reports from you...

Kubernetes: API Server DoS (crash?) if many large resources (~1MB each) are concurrently/repeatedly sent to an external Validating WebHook endpoint

Report Submission Form Summary: I was trying to explore a way to stealthily send lots of data outside a private GKE cluster by way of misusing the Validating Webhook mechanism. The idea would be that a cluster-admin could install a webhook and then initiate resources like a secret or configmap th...

Shopify: https://themes.shopify.com::: Host header web cache poisoning lead to DoS

Hi there, I just found the website: https://themes.shopify.com is infected with "Web cache poisoning" via HOST header lead to Denial of Services Abuse this bug, Attacker can: Poison your cache with HTTP header Host header with arbitrary PORT which is not opened. This attack may lead to Denial of...

X (Formerly Twitter): Ability to add arbitrary images/descriptions/titles to ohter people's issues via IDOR on getrevue.co

Summary: Hi team, I discovered a vulnerability that allows an attacker to add arbitrary images/descriptions/titles to other people's issues via IDOR Description: It's possible to perform a IDOR attacker on getrevue.cowhen adding a image to your issue it's also possible to add descriptions and mor...

ExpressionEngine: Comment/channel unsubscribe GET CSRF

A vulnerability was identified and fixed that could have allowed attackers to unsubscribe users from comment notifications by exploiting the lack of CSRF protection...

ExpressionEngine: Arbitrary forum topic close with GET CSRF.

The vulnerability allowed attackers to open or close forum threads by exploiting the lack of CSRF protection...

ImpressCMS: CSRF to XSS in /htdocs/modules/system/admin.php

The "admin.php" file in the "system" module of ImpressCMS version 1.4.2 was vulnerable to a Cross-Site Scripting XSS attack. This vulnerability allowed an attacker to execute malicious scripts in the context of an authorized user by exploiting a lack of input sanitization. The vulnerability was...

ExpressionEngine: Arbitrary comment content change with GET CSRF.

The vulnerability in Expression Engine 6.0.1 allowed unauthorized modification of comments through improperly protected requests...

ExpressionEngine: Stored XSS filter bypass on discussion forum. "URL" tag.

A vulnerability was identified and fixed that could have allowed attackers to bypass the XSS filter in the discussion forum, enabling arbitrary JavaScript execution in the victim's browser...

ExpressionEngine: Stored XSS filter bypass on discussion forum.

A vulnerability was identified and fixed that could have allowed attackers to bypass the XSS filter in the discussion forum, enabling arbitrary JavaScript execution in the victim's browser...

ExpressionEngine: Import/Convert user file exposure leading to logins/passwords/PII leak.

The user data files processed through admin tools were stored in a predictable location, making them accessible without authentication due to an insecure system configuration...

ExpressionEngine: Non-authenticated path traversal leading to arbitrary file read

Non-authenticated path traversal leading to arbitrary file read. Insufficient user input filtering resulted in arbitrary file read by non-authenticated attacker, leading to sensitive information disclosure...

FetLife: Stored XSS via Angular Expression injection via Subject while starting conversation with other users.

The reporter pointed out that the Subject field for sending private messages using FetLife's onsite chat was vulnerable to a stored XSS exploit, allowing people to execute potentially malicious contents on the receiving end of the message...

U.S. Dept Of Defense: CRXDE Lite/CRX is on ██████ exposed that leads to PII disclosure

hi team , i found that aem is running on ████████ and CRXDE Lite/CRX is exposed to unauthenticated user that can lead to information disclosure POC ==== 1-visit https://██████//██████████ 2-go to query and search for admin then execute 3-go to this endpoint to retrieve the information...

Informatica: Cross site scripting

Researcher identified a XSS vulnerability in a service used by Informatica. Informatica worked with the vendor to patch their service for us and all other customers of the vendor. Thanks rawezhali for your responsible disclosure...

U.S. Dept Of Defense: Reflected XSS in https://██████████ via "████████" parameter

Hello Security Team, I would like to report the XSS vulnerability on your system. The ██████████ parameter is not escaped properly for URL encoded values. ██████ Impact An XSS attack allows an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user...

GitHub Security Lab: [Java] CWE-522: Insecure LDAP authentication

This bug was reported directly to GitHub Security Lab...

WordPress: Authenticated XXE

Description: The WordPress core Media Library does not securely parse XML content when running on PHP 8. By uploading a malicious .wav file, an authenticated attacker can trigger a XXE vulnerability which enables to read secret system files, DoS the web server, perform SSRF, or aim at Remote Code...

VK.com: [VK Android] Access to app protected components leads to arbitrary code execution

Arbitrary code execution...

Kubernetes: Node Validation Admission does not observe all oldObject fields

Summary: The Validating Admission webhook for Node Objects is passing oldObject fields incorrectly on AdmissionReview.Request. It was identified initially in metadata.labels, but a list of impacted fields follows below: oldNode.Spec.PodCIDRs oldNode.Spec.ProviderID oldNode.Spec.ConfigSource...

LY Corporation: Theft of arbitrary files in LINE Lite client for Android

Due to one of the exported activitiescom.linecorp.linelite.ui.android.share.SelectShareActivity of LINE Lite client for Android before 2.17.0 not verifying the URI sent by a third-party application installed on the user device, the application with some interaction of the user would be able to...

GitHub Security Lab: [Java] CWE-326: Query to detect weak encryption with an insufficient key size

This bug was reported directly to GitHub Security Lab...

U.S. Dept Of Defense: Reflected XSS In https://███████

Hi security team, According to my report 1092618, The VDP team agreed that ████ and it's subdomains is in the scope of the DoD program So I continue testing that domain Vulnerable Website URL: https://███████████████%3CSvg%20OnLoad=alert1%3E Description of Security Issue: Reflected XSS in path...

Glassdoor: Reflected XSS on https://help.glassdoor.com/gd_requestsubmitpage

The endpoint at help.glassdoor.com/gdrequestsubmitpage suffers from a Cross-Site Scripting vulnerability via the lang parameter. Thanks, @0x7 for finding and reporting this to us. Looking forward to more reports from you...

Rockset: Leaking Rockset API key on Github

Summary: We all know that Github is great, but it runs the risk of some credentials being revealed by mistake. In this case I found a Rockset API key, This API key is not in the current code, but it is visible in an old commit. Steps To Reproduce: You can find the leak in this link :...

Nextcloud: Take over a mail account due missing validation of account id

A validation is missing to make sure the account id belongs to the logged in user. To reproduce: 1. Login as user 2. Add a mail account to mail 3. Go to account settings 4. Update the account again See a request like below: curl 'http://localhost:50001/index.php/apps/mail/api/accounts/%7Bid%7D' ...

U.S. Dept Of Defense: IDOR leads to Leakage an ██████████ Login Information

Hi security team, According to my report 1092618, The VDP team agreed that █████████ and it's subdomains is in the scope of the DoD program I continue testing that domain . . Issue Description: There is an IDOR in██████.███████ that connected with ████████.███████ highly protected encryption chat...

Zenly: Google Maps API key stored as plain text leading to DOS and financial damage

The researcher highlighted the fact that the Google Maps API key which is by design easily retrievable from the .apk was missing some restrictions. It then could be used by anyone to query the Google Static Map API, and possibly lead to financial damage. Resolved by enforcing missing restrictions...

MercadoLibre: Reflected Cross Site Scripting

Reflected Cross Site Scripting was reported by @madara. A proof-of-concept code was provided to demonstrate the vulnerability. The issue was acknowledged and addressed internally by MercadoLibre...

ExpressionEngine: PHP Code Injection through "Translate::save()" method

A vulnerability was identified and fixed that could have allowed attackers to inject and execute arbitrary PHP code through improperly sanitized user input...

GitHub Security Lab: ihsinme: CPP Add query for CWE-401 memory leak on unsuccessful call to realloc function

This bug was reported directly to GitHub Security Lab...

Kubernetes: KOPS documentation references domains which were not registered

Summary: While researching the kubernetes documentation, I found that the KOPS project's Route53 configuration references dangling DNS servers. I was able to register 3 / 4 of these domain names. I was also able to verify that some companies have been using this configuration, making them...

Glassdoor: CSRF in Demographic Settings with valid gdtoken of other account

Hi Security Team, I found CSRF in account settings exactly in Demographic leads to change Brith Years and Gender . Steps To produce : 1.Creat to 2 account [email protected] [email protected] 2. Login with attacker account and Go to Demographic settings i change gender and brith years 3. Start burp...

Shopify: Password reset token leak via "Host header" on third party website

Hi Security Team, Product / URL https://your-store.wholesale.shopifyapps.com/ Description It has been identified that the application is leaking Token to third party sites. In this case it was found that the Token is being leaked to third party sites which is a issue knowing the fact that it can...

U.S. Dept Of Defense: Self stored Xss + Login Csrf

Description: User can set username between 8-20 alphanumeric characters, but with the help of inspect element attacker can manipulate ██████= & can insert a xss payload resulting in self stored xss & with the help of login csrf attacker can force the victim into attacker's account causing...