15691 matches found
MTN Group: Missing captcha and rate limit protection in help form
Hello One of your form that you are using to receive help message from users, lack captcha and its backend/server does not block massive request. The page is https://mtn.cm/fr/help/ Steps To Reproduce: 1. Visit https://mtn.cm/fr/help/ and fill all the field and submit. 2. Intercept the request wi...
GitHub Security Lab: [Java] CWE-1004: Query to check sensitive cookies without the HttpOnly flag set
This bug was reported directly to GitHub Security Lab...
Liberapay: Disavowing an account doesn't disable it
Hello security team, while I testing your website, I found improper email verification while sign-up liberapay.com. Steps to reproduce: 1 Go to https://liberapay.com. 2 Create new account with any email. 3 You will receive an email verification to the given email. 4 Open that email and click "No,...
Acronis: Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm
Summary The store admin page is accessible without authentication at below URL: http://www.grouplogic.com/ADMIN/store/index.cfm The store admin page provides functionalities such as the following: - Add Edit Items - Search Products - Search Results - Search Orders - Orders Search Results - Add Ne...
Acronis: Stored Cross Site Scripting at http://www.grouplogic.com/ADMIN/store/index.cfm?fa=disprocode
Summary The application exposes store ADMIN page at below URL and is accessible without authentication. http://www.grouplogic.com/ADMIN/store/index.cfm The ADMIN page provides several functionalities. Among them the below functionality is found to be vulnerable to stored XSS. - View and Edit Prom...
MTN Group: Remote code execution due to unvalidated file upload
Summary: Hello I found a critical vunerability in one of your site, where user can upload any file type as a profile picture including php file Steps To Reproduce: 1. Visit https://careers.mtn.cm and register as a user. 2. After successful registration, login and update your data. 3. When uploadi...
Shopify: No Session Expiry after log-out, attacker can reuse the old cookies
The session fixation vulnerability allowed an attacker to reuse old session cookies to log in to a victim's account on the Exchange Marketplace, even after the victim had logged out. The service has been decommissioned, and the issue has been resolved...
GitHub Security Lab: porcupiney.hairs : Java/Android - Insecure Loading of a Dex File
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Java] CWE-759: Query to detect password hash without a salt
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: ihsinme: CPP Add query for CWE-570 detect and handle memory allocation errors.
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [codeql-go]: Add CWE-79: HTML template escaping passthrough
This bug was reported directly to GitHub Security Lab...
Ruby: OS Command Injection in 'rdoc' documentation generator
Details: If the removeunparseable function receives a list of files with a command in the name of one of them, it will be executed. Just enough the name to match the pattern. The problem code: ruby def removeunparseable files files.reject do |file, | file =...
Nextcloud: Notification implicit PendingIntent in com.nextcloud.client allows to access contacts
When the victim downloads files in nextcloud.A notification will be triggered. The content of the notification is "Downloaded".This notification is used to remind the user that the download is complete.The pendingintent in this notification is an implicit intent. At this time a malicious app with...
Acronis: Cross-site Scripting (XSS) - Stored | forum.acronis.com
Summary There is an XSS vulnerability in the search function of the forum forum.acronis.com. Steps To Reproduce 1. Modify your own forum Nickname, add the following payload after the original nickname: alert0 2. Fill in your nickname in the Author form of the search function and wait for the...
HackerOne: Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token.
Details Title: Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token. Risk: High Impact: High Exploitability: High Target: baseurl parameter on UpdatePhabricatorIntegration mutation at /graphql endpoint. Introduction Sensitive data...
GitLab: Cache poisoning Denial of Service affecting assets.gitlab-static.net
Summary Hi, Gitlab.com is hosting JS and CSS on https://assets.gitlab-static.net/ and uses them on gitlab.com/ The static files seem to be stored on a gcp host, which by default accepts the x-http-method-override header. Since the CDN is using Varnish to cache files, I was able to combine the GCP...
Ozon: Захват домена ozoncorporate.ru
Ozoncorporate.ru domain was delegated to Tilda.cc and not used...
HackerOne: New link opening method makes hackerone vulnerable to tabnabbing
Summary: Hackerone recently changed how it opens the external links and this new way is vulnerable to tabnabbing. Description: Please see the POC. Steps To Reproduce 1. Click here: https://awasthi7.github.io/ 2. Click on proceed when warning appears. 3. The site will open in new tab and hackerone...
U.S. Dept Of Defense: [www.█████] Path-based reflected Cross Site Scripting
Description: The www.██████ endpoint is vulnerable to path-based reflected XSS which allows attackers to pass rogue JavaScript to unsuspecting users. Impact This flaw allows attackers to pass rogue JavaScript to unsuspecting users. Since the user’s browser has no way to know the script should not...
EXNESS: Access control vulnerability (read-only)
Horizontal privilege escalation that could be used to gain access to some information not associated with the current user...
MTN Group: Cross-site Scripting (XSS) - Reflected on http://h1b4e.n2.ips.mtn.co.ug:8080 via Nginx-module
The Cross-site Scripting XSS vulnerability was discovered on http://h1b4e.n2.ips.mtn.co.ug:8080 via the Nginx module. The vulnerability allowed the injection of arbitrary JavaScript code through the URL, which could be executed in the victim's browser...
U.S. Dept Of Defense: DOM Based XSS on https://████ via backURL param
Description: The following endpoint suffers from DOM Based XSS https://████████/██████=javascript:alertdocument.domain The ████████ param determines the content which will be displayed on the "Back to Search Result" button, eventually leading to RXSS. References ██████ Regards nagli Impact...
Ruby: OS Command Injection in '/lib/un.rb -- Utilities to replace common UNIX commands in Makefiles etc'
If the waitwritable command receives a list of files with a command in the name of one of them, it will be executed. PoC bash $ touch |\ touch\ evil.txt $ ls '| touch evil.txt' $ ruby -run -e waitwritable -- -w 1 -v $ ls evil.txt '| touch evil.txt' The vulnerability has the same severity as...
MTN Group: Cross-site Scripting (XSS) - Reflected on https://api.mtn.sd/carbon/admin/login.jsp via `msgId` parameter - CVE-2020-17453
A reflected cross-site scripting XSS vulnerability was discovered in the msgId parameter of the login page at https://api.mtn.sd/carbon/admin/login.jsp. This vulnerability allowed an attacker to execute arbitrary JavaScript code in the context of the vulnerable page...
Algolia: PHP-FPM status page disclosure
A page leaking debug information was publicly accessible...
Flickr: Incorrect Deep-link validation leading to unresponsive application and device
A specifically crafted URL provided to a victim caused their Flickr for Android app to become unresponsive...
Elastic: XXE in Enterprise Search's App Search web crawler
Summary Hello team! The latest version of Enterprise Search 7.12.0 is vulnerable to XXE when parsing sitemaps. Up to now I'm only able to read file that contain one line. I'm reporting now to avoid duplicates, but I'll keep working to find a way to extract entire files or HTTP request bodies...
GitLab: RCE when removing metadata with ExifTool
Summary When uploading image files, GitLab Workhorse passes any files with the extensions jpg|jpeg|tiff through to ExifTool to remove any non-whitelisted tags. An issue with this is that ExifTool will ignore the file extension and try to determine what the file is based on the content, allowing f...
U.S. Dept Of Defense: Reflected XSS on https://██████
Description: Reflected XSS on https://███████ POC: https://███/████=https://████████████/%3C/script%3E%3Cscript%3Ealertorigin%3C/script%3E&██████ References ███████ Impact Unauthenticated Reflected XSS System Hosts ████████ Affected Products and Versions CVE Numbers Steps to Reproduce Step 1: Go ...
Ruby on Rails: Argument/Code Injection via ActiveStorage's image transformation functionality
An argument/code injection vulnerability was discovered in ActiveStorage's image transformation functionality. This vulnerability allowed an attacker to inject arbitrary arguments into the image transformation command, potentially leading to remote code execution. The vulnerability was found in t...
Nextcloud: Ratelimiting can be bypassed using IPv6 subnets
Nextcloud hardcodes IPv6 subnets to /128. End users get at least a /64 subnet more than the whole IPv4 address space!, most providers assign even larger subnets like /48. The subnet is used to block bruteforce attempts 3 and rate limiting 4. An attacker can easily generate random addresses from t...
QIWI: SSRF на https://qiwi.com с помощью "Prerender HAR Capturer"
Здравствуйте! На сайте https://qiwi.com вы используете Prerender HAR Capturer 5.6.0 на основе Headless Chrome для рендеринга HTML, снимков экрана, PDF-файлов и файлов HAR с любой веб-страницы https://github.com/prerender/prerender. Если на qiwi.com послать запрос с измененным юзер-агентом...
U.S. Dept Of Defense: Sensitive data exposure via https://███████/jira//secure/QueryComponent!Default.jspa - CVE-2020-14179
Description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. Impact...
Nextcloud: Improper input-size validation on the user new session name can result in server-side DDoS.
Advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5w...
Clario: Social media link hijack of team member [Linkedin] at https://mackeeper.com/team/
Steps To Reproduce: - Go to at https://mackeeper.com/team/ - You can see your team members photos - I have Hijacked social media link for member name as Mammon PPC Account who seems to be Manager - You can click on his photo and you will be redirected to My account on Linkedin here at...
U.S. Dept Of Defense: XML Injection / External Service Interaction (HTTP/DNS) On https://█████████.mil
Greetings, I found on one of your sites an XML Injection + External service Interaction DNS/HTTP Link of the vulnerable file : https://█████.mil/██████████ Payload XML Injection : fkp please change the link of burp collaborator and + URL encode the payload How to reproduce █████ I cut the video...
U.S. Dept Of Defense: ████████ portal is open to enumeration once authenticated. Session ID's appear static. All PII available once a valid session ID is found.
Description: Once Authenticated to █████████ portal with valid credentials you can type in another members session id and you can see any service members data as if you were authenticated as them. https://█████████ I did not see if there was a way to dump all session id's, but wouldn't be too...
U.S. Dept Of Defense: Reflected XSS through clickjacking at https://████
Description: I'm able to control the url being inserted into the query line at https://█████/████&url=http%3a%2f%2fgalnagli.com%2f%3Cimg+src%3dx+onerror%3dalert%28document.domain%29%3E The server issues a request there is also SSRF here I'll report later to the domain specified, and it renders th...
Uber: Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PII
The security researchers discovered a number of connected IDORs in the Uber business and voucher applications. By chaining these vulnerabilities together, the researchers could retrieve information related to existing voucher policies and modify those policies for monetary gain, such as for free...
X (Formerly Twitter): Bypass t.co link shortener in Twitter direct messages
The researcher demonstrated a way to create a link that will not be replaced with safe shortened t.co url, by sending Direct Messages containing more than 50 t.co links to another Twitter user. If the recipient views the message using Twitter’s Android app, and clicks the 51st link in the...
GitLab: Mint Oauth2 access token for targeted user
The vulnerability allowed a group owner to create an application that was trusted by default, bypassing CSRF controls for the authorization flow. This enabled the minting of access tokens for targeted users without their consent...
U.S. Dept Of Defense: CVE-2019-3403 on https://████/rest/api/2/user/picker?query=
Description: The endpoint at https://████████/rest/api/2/user/picker?query= Suffers from CVE-2019-3403 Due to old version of jira. F125281 References https://nvd.nist.gov/vuln/detail/CVE-2019-3403 @naglinagli Impact The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from...
U.S. Dept Of Defense: CSRF Based XSS @ https://██████████
Summary: Good Afternoon Team, I recently discovered subdomain https://██████████/█████████ from a POST Based XSS which when combined with CSRF allows for seemless XSS. ███ HTTP Request POST /██████ HTTP/1.1 Host: █████████ Connection: close Content-Length: 619 Cache-Control: max-age=0 sec-ch-ua:...
Nextcloud: DoS due to improper input validation can break the admin access into the user data will disallow him from editing that user's data.
Impact A malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. Patches It is recommended that the Nextcloud Server is upgraded to 19.0.11, 20.0.10 or 21.0.2 Workarounds Use the OCC command line tool to...
Sifchain: xmlrpc.php And /wp-json/wp/v2/users FILE IS enable it will used for bruteforce attack and denial of service
Hi Team : i am abbas heybati ; Summary: After reviewing the given scope, I realized that the main domain "http://sifchain.finance" has several vulnerabilities that I will report to you as a scenario. I realize that I have reported to you outside of Scope. The report is related to the mentioned...
Shopify: Stored XSS in /admin/product and /admin/collections
Hello Security Team, I was going through previous reports of XSS and I have found this, https://hackerone.com/reports/978125 As stated by team on this page even on https://hackerone.com/shopify?type=team under Known issues that we can now report XSS under Rich Text Editor on Product description a...
MTN Group: Cross-site Scripting (XSS) - Reflected on http://callertunez.mtn.com.gh/wap/noauth/sharedetail.ftl via `callback` parameter
The vulnerability was a reflected cross-site scripting XSS found on the website http://callertunez.mtn.com.gh/wap/noauth/sharedetail.ftl via the "callback" parameter. The vulnerability allowed the execution of arbitrary JavaScript code...
U.S. Dept Of Defense: Reflected XSS
Summary Reflected cross-site scripting XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. An attacker can execute JavaScript arbitrary code on the victim's session. Impact - Perform any action within the applicati...
U.S. Dept Of Defense: Administration Authentication Bypass on https://█████
Hi there I found a way to connect to an administration space on your website https://██████████ how to reproduce ? 1 - go to this link : https://███/██████████ 2 - create a html file with : html 3 - launch the file, click on the button and return to the page https://███████/█████ 4 - refresh the...