Valve: Big Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover)

Researcher reported an issue where certain secure cookies would be included in a web request initiated through Steam Big Picture mode that was initially to a trusted origin but subsequently forwarded to a site on a different origin...

Mail.ru: [city-mobil.ru/taxiserv/] SQLi at /taxiserv/requests path at driver_company param

SQL Injections in city-mobil.ru/taxiserv due to unsafe usage of GET parameters...

Mail.ru: [city-mobil.ru/taxiserv/] SQLi at /taxiserv/tariffs/dictionary at filter{"id_locality"} param

SQL Injections in city-mobil.ru/taxiserv due to unsafe usage of GET parameters...

Mail.ru: Full Account Takeover Student Account In https://********.ru/signin/main/student/email

3rd party project with Mail.ru investitions had no sufficient protection against authentication code bruteforce...

Mail.ru: Full Account Takeover In ****.ru

IDOR vulnerability in project related to recent acquision could lead to account takeover within this project It's a new technique about random account takeover, - scenario is: 1 - we registered in website.com and get a fixed cookie that maybe stored in DB and if you loged in again you will get sa...

Mail.ru: todo.mail.ru open .git

todo.mail.ru landing .git folder was publicly accessible...

Acronis: Credentials leaked via Github

Vulnerability description not provided...

Showmax: https://secure.showmax.com/profile/payments

As part of testing user credentials distribution the security researchers were awarded 3 different activation codes, each one granting them subscription for a different country. The researcher reported that it's possible to use a code for country "A" with account associated to country "B". Such...

Nextcloud: Nextcloud Desktop Client RCE via malicious URI schemes

Nextcloud Desktop utilizes QT's QDesktopServices::openUrl to open URLs. This function invokes the OS'/Desktop environment's default application to handling the URI scheme and file extension. During the Nextcloud Add Account flow, the server's login website is opened within a native window/WebView...

Showmax: Parental Pin Bypass

The security researcher contacted us about improper PIN protection authorisation on our content. Showmax users can setup parental PIN protection for different levels of content maturity. If such content is accessed, the user must enter the PIN. It was reported that the PIN protection is easily...

Slack: Denial of Service via Hyperlinks in Posts

Summary Via html injection its possible to override all document functions, causing the application to crash because its using the element as a function. Brief explanation of how its possible override document functions with html injection: In some html elements, the name attribute becomes a...

Brave Software: Brave Browser Tor Window leaks user's real IP to the external DNS server

Summary: When a user navigates to a URL in Tor Window, the DNS requests are sent directly without using the Tor proxy, which leaks the user's real IP address and the requested domain name to the user's ISP and the DNS server. Products affected: OS: Ubuntu 18.04.5 LTS x8664 Brave: Version 1.18.78...

Stripo Inc: Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/

Summary: I have found a bypass for the report https://hackerone.com/reports/1047119 It seems that a proper fix was not issued therefore the issue still remains. Steps To Reproduce: 1. Create a Plug-In and capture the request. 1. Send this to Intruder 1. Follow the rest in the Video POC. POC Video...

TikTok: Lack of rate limitation on careers site allows the attacker to brute force the verification code

An attacker could have potentially attempted to brute force the verification code needed to reset a candidate's password by leveraging a lack of rate limiting on the TikTok careers portal. We thank @iambouali for reporting this to our team and confirming the resolution...

Doppler VDP: Limited access to billing dashboard by Admin and Collaborator in conflict with user role permissions.

Summary: Hello Team, The admin and collaborator roles aren't supposed to be able to have read access to the billing dashboard. However, a bug was found where both roles have limited read access to the dashboard contrary to Doppler docs. F1151905 Steps To Reproduce: 1. Log in to your...

Acronis: Local Privilege Escalation when updating Acronis True Image

Vulnerability description not provided...

Mail.ru: unauthorized Access To Elastic DB

Unauthorized access to the Elastic DB without user data on developer stand running in MCS public cloud computing host Writeup: https://bugreader.com/blitz@unauthorized-access-to-the-elastic-data-base-269...

Keybase: Keybase /AppData/Local/Keybase/uploadtemps folder stores pasted photos

During research, I had noticed that Keybase does not adequately clear the cache and some residual files can be viewed, with no form of encryption on the files. In addition, these pasted photos remain even after clearing the containing chat. Not all of the pasted photos remain, so it's unclear wha...

Mail.ru: Social Oauth Disconnect CSRF at znakcup.ru

The social-disconnect/twitter/ API maded possible to unlink Twitter OAuth from user account on znakcup.ru...

DuckDuckGo: com.duckduckgo.mobile.android - Cache corruption

Summary: By opening a special url, the app cache can be corrupted which can't be resolved by the user without reinstalling the app. Steps To Reproduce: 1. Download and install the DuckDuckGo App 2. Open https://%22t.dev/ 3. Try to reopen the app The app keeps crashing Additional information -...

Lark Technologies: IDOR Allows Viewer to Delete Bin's Files

An IDOR Insecure Direct Object Reference vulnerability was found where if a user with only view permissions knew the alphanumeric token of a folder, they could permanently delete it from an admin's bin. We thank @snapsec for reporting this to our team...

Doppler VDP: Bypass Email Verification.

steps to reproduce:- 1- sign up into doppler here https://dashboard.doppler.com/register. 2- then it will go to this page https://dashboard.doppler.com/confirm and ask you to confirm your email. 3- go to source code and search for tagsconfirmemail . 4- you will find the email Verification token...

U.S. Dept Of Defense: Bypassed a fix to gain access to PII of more than 100 Officers

Summary: Hey team I hope this report finds you well and you're having a great day in these difficult times ; While doing my Recon I have found out that https://www.███/ is leaking PII of many Officers Severity according to me- Critical Step-by-step Reproduction Instructions 1. Go to...

Bumble: Misconfigured oauth leads to Pre account takeover

Summary While testing badoo i have noticed that users can use SMAL Google,MSN,VKontakte,Odnoklassniki,Yandex Mail.Ru to create and login to badoo accounts. Now there are two ways of registering into badoo By email registration Google,MSN,VKontakte,Odnoklassniki,Yandex,Mail.Ru oauth login Now here...

Mail.ru: Stored XSS on store.my.games

Stored XSS in comment viewing functionality on store.my.games...

U.S. Dept Of Defense: [hta3] Chain of ESI Injection & Reflected XSS leading to Account Takeover on [███]

Hi, Summary There is an ESI injection vulnerability in the https://████████/portal/page/portal/TOPLEVELSITE/SearchResults/PerspectiveResults endpoint on the ms parameter. With this injection, we're able to extract session cookies that have the HttpOnly flag by using this payload. xml...

Doppler VDP: User Access Control in Community Plan

Summary: Hello, I have found a logical issue in the Billing Subscription section. A given user is able to maintain User Access Control UAC feature in Community Plan. Steps To Reproduce: Setup two accounts let's say Alice and Bob 1. Login using Alice account and create a workspace with any name sa...

Doppler VDP: Stored XSS in [https://dashboard.doppler.com/workplace/*/logs] pages

Summary: I have found a stored XSS vulnerability in the following config setting page. https://dashboard.doppler.com/workplace//projects/example-project/configs/dev/logs When you invite other users to the workspace, the xss could be used to exploit other users also. Steps To Reproduce: 1 . Visit...

Insulet Corporation: DOM XSS on www.omnipod.com/freedom/birthdate-confirmation and www.omnipod.com/pif/thanks-freedom

The DOM-based XSS vulnerability was found on the www.omnipod.com/freedom/birthdate-confirmation and www.omnipod.com/pif/thanks-freedom pages. The vulnerability was triggered by crafting a URL with malicious code in the query parameters, which was then executed by the vulnerable script on the page...

Glassdoor: Reflected XSS on https://www.glassdoor.com/parts/header.htm

Reflected XSS was reported on https://www.glassdoor.com/parts/header.htm via the nonce parameter. Thanks, @0x7 for reporting the finding and also reporting additional endpoints affected by this - added a bonus for reporting those additional endpoints and also for your collaboration with us in the...

VK.com: XSS в обработчике ссылок

XSS в парсере ссылок...

X (Formerly Twitter): Open Redirect on https://www.twitterflightschool.com/widgets/experience?destination_url=https://evil.com

This report details an open redirect issue that enabled crafting potentially malicious URLs which could be used to redirect users to a site specified in a URL parameter of the URL creator's choosing. This may allow an attacker to exploit a user's trust by leveraging open redirect on the affected...

Mail.ru: kds.ucs.ru - раскрытие информации.

При посещение главной страницы, прогружается main-страница, она ссылается на JS-скрипт https://kds.ucs.ru/app/apiMock.js В скрипте сетятся такие данные, как: Токенскорее всего авторизации Почта аккаунта диллера: "data":"id":"[email protected]","userRole":"Dealer"; Список всех клиентов, кто пользуетс...

Kubernetes: XSS on kubernetes-csi.github.io (mdBook)

Report Submission Form Summary: Hi, I have recently found XSS vulnerability in mdBook CVE-2020-26297, fixed and disclosed on 4th January 2020. The details were published in a security advisory here: https://blog.rust-lang.org/2021/01/04/mdbook-security-advisory.html I did a quick recon and found ...

Mail.ru: [Biz] [Mailer] Кроп любых* изображений расположенных на сервере

Crop any images at site mailer.i.bizml.ru...

Topcoder: IDOR at https://fast.trychameleon.com/observe/v2/profiles/ via uid parameter discloses users' PII data

Summary: Hello, A API on apps.topcoder.com/forums/ exposes the email of any user on topcoder.com and some PIIs name, surname, id. Steps To Reproduce: 1 Create a profile at topcoder.com 2 Go to apps.topcoder.com/forums and login forum 3 Entery any topic example:...

Kubernetes: Index Out Of Bounds in protobuf unmarshalling

Report Submission Form Summary: I have recently discovered a bug in the gogo/protobuf code generator. This bug allows for an index out of bounds when unmarshalling certain protobuf objects. The bug is that a check is lacking when skipping certain bytes. There are numerous occurrences of this bug...

Internet Bug Bounty: Canonical Snapcraft vulnerable to remote code execution under certain conditions

Preface: I apologize for previously submitting this bug to hacker1 before it was fully addressed by the Ubuntu Security Team I have reported this issue to the Ubuntu Security team and it has been fixed: CVE-2020-27348 Bug link: https://bugs.launchpad.net/snapcraft/+bug/1901572 Ubuntu Security Tea...

X (Formerly Twitter): 2 Subdomains Takeover at readfu.com

Hi , I believe that readfu.com is now belong to Twitter,inc. I was able to takeover 2 subdomains via Heroku Services & Normal domain Buy! F1147316 Poc : Please visit http://alpha.readfu.com/ via Heroku steps : https://youtu.be/mpPXrvhvD4A Please check dns of rb.readfu.com you will see it hqn.ro...

Logitech: Sensitive information disclosure to shared access user via streamlabs platform api

Summary: Hi there, Hope you are doing well and stay safe. Streamlab allows us to invite other users to manage our dashboard and cloudbot functions via following setting which named "Shared Access". https://streamlabs.com/dashboard/settings/shared-access If we invite other users with Moderator rol...

Acronis: SSRF when configuring Website Backup on Acronis Cloud

Hi, I hope everything goes well. I have found a SSRF in https://mc-beta-cloud.acronis.com/ui//backup-console/resources when configuring the backup plan for a website. Summary While I was looking at the functionality of managing backups on websites, I saw that if you specify a local IP where to ge...

GitLab: Stored XSS in repository file viewer

Summary There exists XSS in swagger-ui version used in GitLab open API viewer. The XSS exists due to the old version of DOMpurify used in swagger-ui that allows an attacker can inject any HTML elements with any attributes except script tag on the page. The XSS in POC requires 1 click anywhere on...

Mail.ru: [titans.3clans.ru] phpBB 3.0.8 - Захват аккаунта администратора + удалённое выполнение кода.

Наткнулся на сайт http://titans.3clans.ru, он стоит на 188.93.63.60 hostname: newsdclans.ext.terrhq.ru Везде весело мыло админа [email protected], вбив его в интернете, я нашёл пароли от почты. К форуму подошла такая комбинация: Negasus:43046721 Дальше идём в админ-панель, "/adm/index.php", в...

U.S. Dept Of Defense: [hta3] Remote Code Execution on ████

Vulnerability description not provided...

Doppler VDP: Owner can change themself for another Role Mode but application doesnot have this function.

Hello team, I have found a Privilege escalation bug in your application. Basically your website doesn't allow owner to change role mode for themself, they only can able to change role mode of another user. But i found authorization bug in your application that if we add user id of themself in...

U.S. Dept Of Defense: Stored XSS through name / last name on https://██████████/

Description: There is stored XSS Vulnerability on https://█████/██████ by rendering unsafe input being registered on the account name and last name. ███ Step-by-step Reproduction Instructions 1. Navigate to javascript...

Logitech: Host Header injection in oslo.io (using X-Forwarded-For header) leading to email spoofing

Hello team I hope it will be a happy year for you and for me 😇 Summary: I found Host Header injection in oslo.io I tried to use it to show the security effect on users And I found this Steps To Reproduce: 1. Well, first of all, enter your project 2.Make an invitation by email 3.Now through the...

Doppler VDP: Access page must be reloaded to perform multiple requests

Hello team, I have found a authorization issues in your website. With this issue Low privileged user's like collaborator users can still access DEV environment even workplace owner unchecked dev access permission from owner account. With this issue collaborator user can unlimited access that dev...

GitHub Security Lab: [Java] CWE-555: Query to detect password in Java EE configuration files

This bug was reported directly to GitHub Security Lab...

Logitech: Moderator user has access to owner's support portal and tickets

Summary: Hi there, In https://streamlabs.com, there's a function where users can share his account to other users to manage their dashboard via following link. https://streamlabs.com/dashboard/settings/shared-access. In shared-access setting, user can invite other user with two roles Moderator an...