15691 matches found
Nutanix: Open Redirect at https://www.nutanix.com/tw/login via icid parameter
hi , i find open redirct in https://www.nutanix.com visit this url https://www.nutanix.com/tw/login?icid%3D24N58XTYY6AA=&isSigningAction=Yes&redirectUrl=https%3A%2F%2Fwww.baidu.com%23%40www.nutanix.com Impact open redirct...
LY Corporation: SSRF occurrence in website preview used by LINE Official Account Manager (https://manager.line.biz)
LINE Official Account Manager https://manager.line.biz uses PagePoker to provide website previews. Here it was not properly validated against the Opengraph image tag target, which could point to an internal network resource...
HackerOne: CSRF allows to test email forwarding
Summary: It is possible to send email forwarding emails in the name of victim. The main problem is that you don't verify the X-CSRF-Token in the endpoint /securityemailforwarding/testforwarding.json?id=$id. Steps To Reproduce: - Login as an program user who has access to the Email Forwarding -...
Ruby: Path traversal in Tempfile on windows OS due to unsanitized backslashes
Hi team, Summary We've noticed that both arguments basename and ext of Tempfile on Windows are vulnerable to a path traversal which could allow unintentional file creating in arbitrary writable directories. Tempfile often has a user control either by basename or ext or both. PoC irbmain:029:0...
HackerOne: User's who are banned from program can still be invited to the new reports as collaborators
Summary: Hello team! We have found out that the banned user's who are banned from program can be invited to the new reports as collaborator users. This is pretty weird because the hacker should be banned and no new reports shouldn't be allowed. If program bans the hacker the program can't invite...
Rocket.Chat: Post-Auth Blind NoSQL Injection in the users.list API leads to Remote Code Execution
Summary: The users.list API endpoint is vulnerable to NoSQL injection attacks. It can be used to take over accounts by leaking password reset tokens and 2FA secrets. Taking over an admin account leads to Remote Code Execution. Description: The users.list API endpoint takes a custom query via the...
Open-Xchange: Null pointer dereference in lib-sieve after calling sieve_binary_block_index
There are some places that program calls function sievebinaryblockindex without checking the return valuemainly in sieve-binary-dumper.c. Such as: pigeonhole/src/lib-sieve/sieve-binary-dumper.c: bool sievebinarydumperrunstruct sievebinarydumper dumper, struct ostream stream, bool verbose struct...
Rocket.Chat: Pre-Auth Blind NoSQL Injection leading to Remote Code Execution
Summary: The getPasswordPolicy method is vulnerable to NoSQL injection attacks and does not require authentication/authorization. It can be used to take over accounts by leaking password reset tokens. Taking over an admin account leads to Remote Code Execution. Description: The getPasswordPolicy...
Mail.ru: Подмена фотографий автомобиля [city-mobil.ru/taxiserv/]
Possibility to change the photo at external-storage.city-mobil.ru by controlling the parameter photourl and id on city-mobil.ru/taxiserv/...
Kubernetes: SHA512 incorrect on most/many releases
Report Submission Form Summary: SHA512 is incorrect for most versions of kubernetes.tar.gz releases https://github.com/kubernetes/kubernetes/releases/. Kubernetes Version: all Component Version: all Steps To Reproduce: add details for how we can reproduce the issue, including relevant cluster set...
Zomato: subdomain takeover on fddkim.zomato.com
Our subdomain fddkim.zomato.com was vulnerable to a 0-day subdomain takeover vulnerability on Freshdesk. The DNS entry was removed on our end to fix this. HOW I hacked thousand of subdomains writeup--https://medium.com/@moSec/how-i-hacked-thousand-of-subdomains-6aa43b92282c...
HackerOne: Hackers can reveal the names of private programs that have an external link and Enterprise Product Edition
Summary: Hi team, A few days ago, your engineers revealed a field in the report- Custom fields. The team removed it after a while, but did not remove the design line Custom fields Available only for Enterprise Product Edition , Therefore, the sandbox program cannot independently accept this versi...
Nextcloud: Create alias does not validate account id
The request to create a new alias does not validate that account id belongs to the current user. Also we don't validate that the account id exists. curl 'http://localhost:50001/index.php/apps/mail/api/accounts/2000/aliases' \ -H 'Connection: keep-alive' \ -H 'Pragma: no-cache' \ -H 'Cache-Control...
VK.com: Member still able close another user poll on communities topic
Insufficient validation in closing the poll of the community topic...
Moneybird: Open Redirect through POST Request in OAuth
Reporter found an open redirect issue in the OAuth flow. We added extra checks for all redirects in the OAuth flows to mitigate this issue...
HackerOne: Hackers can find out the ID of private programs
Summary: Hi team, Our team noticed that it is possible to find out the IDs of sandbox programs. This allows us to create a list, thereby determining that the rest of the list of IDs will belong to private programs or public or external programdirectory listing. But by removing ID all public and...
curl: CVE-2021-22890: TLS 1.3 session ticket proxy host mixup
Summary: I don't think that this can be easily exploitable, but I am submitting it as a security issue for precaution. I am not looking for a bounty. Commit 549310e907e82e44c59548351d4c6ac4aaada114 enables session resumption with TLS 1.3. Curl connections maintain two SSL contexts, one for the...
HackerOne: Lack warning label when receiving a letter
Summary: Hi team, When using the function ShareReportViaEmail the email is sent to the email address specified by the hacker.This email looks legitimate and comes from verification email addresses, leaving no doubt about it being replaced. This endpoint also applies to sandbox reports which makes...
GitHub Security Lab: ihsinme: CPP add query for: CPP Add query for CWE-20 Improper Input Validation
This bug was reported directly to GitHub Security Lab...
HackerOne: Used email confirmation link reveals the email address which is tied to it
Summary: If an attacker finds an used email confirmation link the token is in URL s/he will be able to see the email address which is tied to the confirmation link ID. The attack itself is pretty unlikely but the application should show the generic error message like The confirmation ID is invali...
Rockstar Games: Password and mail address stored unencrypted in memory - Rockstar Game Launcher
User credentials were stored unencrypted in memory for a short time during the login process for a game launcher application. The credentials could have been retrieved by dumping application memory after login. This issue has since been resolved to no longer expose passwords in memory...
HackerOne: Hackers can reveal the names of private programs that have an external link
Summary: Hi team, Our team has found a way to distinguish between private programs with external links. Due to the ability to select Severity Rating Options, the program can set two options : Rating or CVSS Score and CVSS Score Only. One of them removes the possibility of setting the...
New Relic: Missing Authorization check on View permissions for Alerting Conditions via /internal_api/1/accounts/XXXXXXX/policies/YYYYYYY/conditions?offs endpoint
@archangel reported that an elevation-of-privilege due to a missing authorization check on View permissions for Alerting Conditions could have allowed a user to see alerting policies without having the rights to do so...
Stripo Inc: Stored XSS at Module Name
Summary: Hello, I found stored xss at module name with this payload "Hello : Steps To Reproduce: 1. Add new container, it doesn't matter which is it 2. Paste this payload in the module name"Hello : 3. Update it then check the module name again in setting 4. Alert Popup Stored XSS Stored cross-sit...
Rocket.Chat: Bypass local authentication (PIN code)
Summary: An attacker with physical access to a mobile device can bypass local authentication PIN code. Description: When you set the PIN code to enter the application, the blocking occurs after the time set in the settings after the activity is closed. System time is used as a starting point. It ...
Sifchain: HTTPS not enforced at dex.sifchain.finance
Hi The requestes using non secured HTTP do not automatically upgraded to HTTPS , The impact of this an attacker can laucn a MITM attack and steal users information. Impact Data sent over HTTP, is being transmitted in plain , sniffers can see it , edit it , poison ads , know what contents being...
Tennessee Valley Authority: SQL Injection on https://soa-accp.glbx.tva.gov/ via "/api/" path - VI-21-015
Summary: i've found this subdomain soa-accp.glbx.tva.gov also is vulnerable to SQLI through /api/ path Steps To Reproduce: https://soa-accp.glbx.tva.gov/api/river/observed-data/GVDA1'+%2f!50000union%2f+SELECT+HOSTNAME--+- hostname dumped...
GitLab: RCE via unsafe inline Kramdown options when rendering certain Wiki pages
Summary When rendering wiki content with certain extensions such as .rmd, renderwikicontent will call othermarkupunsafe which will end up calling GitHub::Markup.render from the github-markup gem. Files with any extension can be uploaded by checking out the wiki with git, commiting the files and...
Mail.ru: [Plazius] SSRF через некорректно сконфигурированный Fiddler 46.148.201.206:10121
SSRF on ucs.ru...
U.S. Dept Of Defense: Unauth RCE on Jenkins Instance at https://█████████/
Description: Hi Team, While Doing Recon on U.s Government Sites, I Found below asset Belongs to U.S Government Please Check its SSL certificate to confirm or Please check attached POC Video █████████ https://███/ Attacker can execute Command Injection without Authentication. Impact Unauth RCE...
R3: No DMARC record at cordacon.com
I am happy to receive your invitation, and i will try my best to keep R3 secured. As this is my first report and can be considered as low severity and some companies even considered it as N/A, but as I see in your policy its not mention as out of scope. one of your domain has no DMARC record, whi...
Acronis: Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/
Summary Hello team. I found A security issue on devicelock.com where the attacker can access to any Ticket support and real all the information that The users sent to the support. and this without user interaction. In other words: an attacker can have full access to users Ticket using Ticket id...
Liberapay: Login CSRF : Login Authentication Flaw on https://liberapay.com/
Description: There is no csrf validation while logging in which leads to csrf. An attacker can craft an HTML page containing information to have the victim sign into an attacker's account, where the victim may add sensitive payment information to the attacker's new account assuming he/she is logg...
GitHub Security Lab: [Java] CWE-327: Add more broken crypto algorithms
This bug was reported directly to GitHub Security Lab...
U.S. Dept Of Defense: [hta3] Remote Code Execution on https://███ via improper access control to SCORM Zip upload/import
Summary: There is a Remote Code Execution vulnerability at https://█████████/Kview/CustomCodeBehind/base/courseware/scorm/management/scorm2004uploadcourse.aspx which allows any user to upload a SCORM course package. Furthermore, an attacker can add an ASPX shell to the SCORM package which will th...
GitHub Security Lab: ihsinme: CPP add query for CWE-788 Access of memory location after the end of a buffer using strlen.
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Java] CWE-598: Use of GET Request Method with Sensitive Query Strings
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Java] CWE-312: Query to detect cleartext storage of sensitive information using Android SharedPreferences
This bug was reported directly to GitHub Security Lab...
Acronis: Stored Cross-site Scripting on devicelock.com/forum/
Summary Hello, @acronis Team I hope you all doing well. I just found A Stored Cross-site Scripting on devicelock.com/forum/ by changing the City value on https://www.devicelock.com/bitrix/admin/useredit.php? to HTML/javascript code and lead to Stored Cross-site Scripting. 1. go to...
Mail.ru: Information Disclosure of Garbage Collection Cycle 'Again'
Performance metrics were available at youla.ru...
GitLab: CSRF on /api/graphql allows executing mutations through GET requests
Mutations are edit or create queries used in Graphql. Gitlab prevents CSRF in this functionality by sending a POST request with a X-CSRF-Token header. The bug I found here was that, when we send a GET request, the backend does not expect the X-CSRF-Token header. Using this, an attacker could...
Reddit: Third party app could steal access token as well as protected files using inAppBrowser
Summary: Reddit android app version : 2021.8.0 OS: Android 11 This app uses com.reddit.frontpage.RedditDeepLinkActivity class to route app links including deeplink and reddit.com links while this class does not check for scheme, host and it opens given url in InAppBrowser and IAB have access to...
Evernote: CSRF leads to account deactivation of users
Step to reproduce vulnerability:- 1 Create 2 account one account is for attacker and one is for victim 2 With attacker account go to https://www.evernote.com/secure/CloseAccount.action 3 Open your burpsuite and when you will press Deactivate your Evernote account you will see another popup of...
Mail.ru: Stored xss in calendar via call link
Call link URI schema in calendar.mail.ru web application was filtered improperly, allowing malicious javascript: links...
Acronis: admin password disclosure via log file
Hi I have log file disclose admin password on https://www.devicelock.com/log.txt u can see md5 password in log file , 2020-03-20 08:12:15 - main - Module: change password 4.1.2changepassword=yes;/forum/forumauth.php;login=admin;md5=2bca2f877b7a727861b59f4a4039d2e9 Impact this information admin...
Shopify: xss is triggered on your web
I don't know where my xsshunter script is, but my script is enabled on your web. is on your web 1. https://devicemanager.shopifycloud.com/admin Impact xss is triggered...
Stripe: Verifying email bypass
A vulnerability was discovered in Stripe's Connect API that allowed an attacker to create an account without verifying the email address. This allowed the attacker to impersonate a real company and generate invoices and payments on their behalf. The invoices appeared valid as they were sent by...
Acronis: Information Disclosure via ZIP file on AWS Bucket [http://acronis.1.s3.amazonaws.com]
Summary Hello, @acronis Team I hope you all doing well. during My recon, I found OPEN S3 BUCKET http://acronis.1.s3.amazonaws.com and this BUCKET has an ZIP file . and this file contains sensitive information about the internal system of Acronis. This Zip file Is from 2018. And it looks like it w...