15404 matches found
Acronis: Local privilege escalation via insecure MSI file
Summary I've found a vulnerability which leads to a local privilege escalation starting from a non-admin user. When True Image client installs it drops 2 MSI files into C:\Windows\Installer folder. Since this folder by default is readable by anyone, a non-admin user can execute commands like...
Doppler VDP: No rate limit into email change leads to email notification boombing to its victim.
hello team, I have tested your application and found no any rate limit into password changing mechanism which allow attacker to send unlimited number of email notification to his victim, Basically in every part of your application has implemented rate limit block system but email changing area do...
U.S. Dept Of Defense: Reflected XSS on https://█████████html?url
Vulnerable Website URL or Application: https://███████html?url=javascript:alert"nagli" Description of Security Issue: please limit to one site/app per submission Reflected XSS due to no input validation █████████ Remediation Sanitize the input on the that parameter Best Regards nagli Impact...
Doppler VDP: email spoofing on doppler.team
Summary: There is an Email Spoofing vulnerability on your domain doppler.team which allows an attacker to send an email with your domain namesuch as [email protected] and so on. Steps To Reproduce: 1. Go to http://emkei.cz 1. Fill "From Email" field to [email protected] or any other doppler...
Mail.ru: Eval-based XSS in Game JS API (mailru.core.js) via cross-origin postMessage()
mailru.core.js as used by GMR/store.my.games application was vulnerable to XSS via PostMessage handler...
Rocket.Chat: Registration bypass with leaked Invite Token
The Rocket.Chat API route 'validateInviteToken' was vulnerable to a registration bypass attack. The route allowed unauthenticated users to guess valid invite tokens by sending a crafted JSON payload with a regular expression. Once a valid token was obtained, the user could access private channels...
Palo Alto Software: [Bypass #870709] Unauthorised access to pagespeed global admin at https://webtools.paloalto.com/
Hi team, I found bypass of report 870709. Just by using X-Forwarded-For: 127.0.0.1 you can again get access to global admin page. Bypass request Request GET /pagespeed-global-admin/ HTTP/1.1 Host: webtools.paloalto.com X-Forwarded-For: 127.0.0.1...
Logitech: Stored XSS on oslo.io in notifications via project name change
Hey Logitech team. Summary: It is possible for an editor on a project to rename a project to a malicious HTML element, which when opened in the notification dropdown will render and fire javascript. Steps To Reproduce: add details for how we can reproduce the issue 1. Invite user to join the...
Valve: CS:GO Server -> Client RCE through OOB access in CSVCMsg_SplitScreen + Info leak in HTTP download
Title: CS:GO Server - Client RCE through OOB access in CSVCMsgSplitScreen + Info leak in HTTP download Scope: csgo.exe Weakness: Out-of-bounds Read Severity: Critical 9.6 Link: https://hackerone.com/reports/1070835 Date: 2021-01-04 00:22:02 +0000 By: @simonscannell Details: We managed to write an...
Acronis: Acronis True Image 2021 (windows) does not validate server hostname on a login TLS connection
Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac did not properly validate SSL certificate. The issue was assigned CVE-2021-32581. We have seen no signs of the exploitation of this vulnerability...
MTN Group: RCE Apache Struts2 remote command execution (S2-045) on [wifi-partner.mtn.com.gh]
Summary: A Remote Code Execution vulnerability exists in Apache Struts2 when performing file upload based on Jakarta Multipart parser. It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value isn't valid an exception is thrown which is then used to...
Logitech: Manipulating response leads to free access to Streamlabs Prime
Heyy team, I have a found cool bug which allows me to get access to streamlabs prime features for free. Here is the api endpoint which checks whether the user has a prime subscription or not: https://streamlabs.com/api/v5/user/prime/subscription json "isactive": false, "ispending": false,...
WHO COVID-19 Mobile App: ArcGIS Rest Service linked to unsecured survey data
ArcGIS rest service url was followed, allowing discovery of unsecured survey data. Now fixed. This wasn't part of the WHO COVID-19 Mobile App but was resolved as it was reported here...
VK.com: Stored XSS в выборе метки на странице списка заказов.
XSS в разделе управления заказами. При выборе метки для фильтра на странице списка заказов в сообществе была xss...
Phabricator: Git flag injection leads to arbitrary file write
keyword : mongoose PoC 1. Login and generate API token 2. Create a repo and push several commits to phabricator 3. Execute diffusion api curl http://dev.localhost/api/diffusion.internal.gitrawdiffquery \ -d api.token=api-token \ -d commit=--output%3D/tmp/qqq \ -d repository=R2 4. qqq file will be...
Automattic: information disclosure lead to disclose users private notes
dear automattic the bug i will share with you a bug that allow attackers to access users notes without permission the bug is here http://simp.ly/p and here http://app.simplenote.com/ and its using web.archive.org website web archive: is a website like google search but he save all links like you...
Automattic: SQL Injection intensedebate.com
hello dear support I have found SQL Injection on intensedebate.com parameters injectable ?acctid=1 URL:https://www.intensedebate.com/js/importStatus.php?acctid=1 I'm used sqlmap to injection command sqlmap --url https://www.intensedebate.com/js/importStatus.php?acctid=1 --dbs F1140562 available...
MTN Group: Blind SQL Injection
hello dear support I have found Blind SQL Injection on https://futexpert.mtngbissau.com/signin/ parameters injectable phonenumber=0&pin=1&submit=Continuar via post URL:https://futexpert.mtngbissau.com/signin/ Post: email=0 my payload :...
MTN Group: Reflected XSS on gamesclub.mtn.com.g
hello dear I have found Reflected XSS on gamesclub.mtn.com.g parameters injectable /header.aspx my payload "; HTTP Header input Referer was set to https://www.google.com/search?hl=en&q=testing'"&%gQmT9082 HTTP request =========== GET /header.aspx HTTP/1.1 Host: gamesclub.mtn.com.gh...
MTN Group: Reflected XSS on mtnhottseat.mtn.com.gh
hello dear I have found Reflected XSS on mtnhottseat.mtn.com.gh parameters injectable /api/v2/subscribe/; my payload " URL: https://mtnhottseat.mtn.com.gh/api/v2/subscribe/;%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain%3E F1140524 Impact Malicious JavaScript has access to all the same objec...
Node.js: DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)
Summary: While the debugger i.e., the --inspect option tries to prevent DNS rebinding, the whitelist is excessive. Description: The whitelist includes “localhost6”, which is not that widespread. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS...
h1-ctf: H1 Hackyholidays CTF - The Grinch was defeated
The following writeup will underline all the steps and tools used to solve the 12 challenges of the H1 Holidays CTF. The theme of the competition was the Grinch. How it is possible to read from the competition blog post https://www.hackerone.com/blog/12-days-hacky-holidays-ctf , the goal was to...
h1-ctf: Hackyholidays [ h1-ctf] writeup [mission:- stop the grinch ]
Hello Team Description In the continuous series of 12 days, twelve flags were hidden inside Hackyholidays site - hackyholidays.h1ctf.com in which once we get all the flags, grinch can be stopped. This write-up will describe solving all the 12 days challenges. Step To Reproduce + It all started wh...
U.S. Dept Of Defense: Old Session Does Not Expires After Password Change
Hello Team, I am Hemant Patidar working as a security researcher and I found a bug in your site. Report of bug is as follows:- Description: While conducting my research I discovered that the application Failure to invalidate the session after the password change. In this scenario changing the...
h1-ctf: It's just a man on a mission
Preface --------------------- Like any other good stories, this adventure has also begun with a few long days of preparation leading up to the start of the challenge. Tools were sharpened, command lines were dusted-off and one-too-many cups of coffee were consumed. The morale was high and the...
h1-ctf: [hackyholidays] CTF write-up
hi, this is my write-up for hackyholidays CTF. I attached the write-up in PDF format. thanks, REND Impact saving the Christmas... fix this otherwise people would be happy...
h1-ctf: How The Hackers Saved Christmas
F1139789 Challenge I 🤖 "What are you doing?" I asked myself. I was about to trespass a clear warning to keep out. F1139744 "Have you lost your mind?" But I couldn't help it. I was born for this. And I wasn't going to back down. There are 12 more days until Christmas Eve, and I wasn't going to let...
h1-ctf: First CTF ever!
Pretext Started looking into hacking this autumn and then found out HackerOne was doing a Christmas themed CTF. Further investigation showed that the deplorable Grinch might be up to no good again - Christmas is in danger! TLDR Lots of hacking took place, the Grinch was stopped, Christmas saved a...
h1-ctf: Grinch-Networks taken down - hacky holidays CTF
Summary: CTF Submission Day 1: flag48104912-28b0-494a-9995-a203d1e261e7 Day 2: flagb7ebcb75-9100-4f91-8454-cfb9574459f7 Day 3: flagb705fb11-fb55-442f-847f-0931be82ed9a Day 4: flag972e7072-b1b6-4bf7-b825-a912d3fd38d6 Day 5: flag2e6f9bf8-fdbd-483b-8c18-bdf371b2b004 Day 6:...
h1-ctf: h1-ctf : 12 days of hack holiday writeup
Summary This was a real fun CTF and I really enjoyed solving the challenges. Great job on creating the challenges. This is my writeup for the "12 Days of Hacky Holidays CTF". I hope you enjoy reading it, and I hope others reading it will pick up a trick or two. Flags: This is all the flags found...
h1-ctf: [H1 hackyholidays] CTF Writeup
Hello team, Here is my CTF writeup for HackyHolidays. Main page The main page doesn't contain any interesting stuff, just a few assets. Maybe we will find some known files in webapp root: index.php, .htaccess, robots.txt, ...? robots.txt file exists, and there is the first flag: User-agent:...
h1-ctf: Infiltrating into Grinch-Networks and saving Christmas!
Hi, you can find the write-up for this CTF here : https://castilho101.github.io/posts/hackerone-ctf-christmas...
MTN Group: 2x Remote file inclusion within your VMware Instances
Summary: 2x Remote file inclusion within your VMware Instances Hosts: nmc.vc.mtn.co.ug h28a.n1.ips.mtn.co.ug Steps To Reproduce: Navigate to the URLs given below, /etc/passwd will be displayed. https://nmc.vc.mtn.co.ug/eam/vib?id=/etc/passwd https://h28a.n1.ips.mtn.co.ug/eam/vib?id=/etc/passwd...
h1-ctf: hackyholidays CTF Writeup
Summary: As per the referenced blog entry, the Grinch has gone hi-tech this year with the intentions of ruining the holidays. The challenge was about infiltrating the Grinch's network and take it down. As outlined on https://hackerone.com/h1-ctf, the domain hackyholidays.h1ctf.com was in scope. I...
Mail.ru: [web.icq.com] Stored XSS in Account Name
Stored XSS in web.icq.com via account data...
Reddit: GPS metadata preserved when converting HEIF to PNG
Summary: Users who upload HEIC/HEIF files sometimes called "Live Photos" to reddit.com or old.reddit.com expect their GPS metadata to be stripped before being displayed publicly. Uploaded HEIC files are converted to PNG, but GPS metadata is incorrectly preserved, in violation of user privacy. The...
h1-ctf: Grinchs website takendown with various other exploits
The HackyHolidays This is my first HackerOne CTF challenge writeup. Contents: flag1: Day 1 Check the files, robots.txt flag2: Day 2 one more : jquery.min.js flag3: Day 3 People Rater flag4: Day 4 Brute Force, Swag Shop flag5: Day 5 Brute Force, Secure Login flag6: Day 6 Brute Force, My Diary flag...
h1-ctf: [h1ctf-Grinch Networks] MrR3b00t Saving the Christmas
Disclaimer: Certain things are a bit modified to set the pieces for the story. Also you can find the flags for all 12 challenges in file F1138300 , Now enjoy : █▀▄▀█ █▀█ ░ █▀█ █▄▄ █▀█ █▀█ ▀█▀ █░▀░█ █▀▄ ▄ █▀▄ █▄█ █▄█ █▄█ ░█░ saves the Christmas Episode - 0x00 Pil0t.py It was a gloomy clear night,...
h1-ctf: HackyHolidays H1 CTF Writeup
HackyHolidays Day 1 Once the CTF started and the Grinch released the scope hackyholidays.h1ctf.com, I started the CTF by a good old Nmap scan, to see whats running on the server. So the nmap command looked like nmap -sC -sV -oA nmap hackyholidays.h1ctf.com/. The result showed a promising entry...
h1-ctf: Writeup Submission
The Write-Up will be published within the next hours latest till Dec. 31st 12:00 PST under https://blogs.tippexs.io User: h4ck4r0ne Pass: s4nt4sucks Let me know if I need to submit anything else. I have started crafting an PDF but it become that huge that I have decided to create a complete new...
Brave Software: Phishing/Malware site blocking on Brave iOS can be bypassed with trailing dot in hostname
A vulnerability was discovered in Brave iOS nightly build that allowed bypassing of the phishing/malware site blocking feature by adding a trailing dot in the hostname. This allowed users to access prohibited sites without being blocked by Brave Shield protection...
Trellix: RXSS in https://jp.mcafee.com/apps/mdm/jp/3.0_asp/
A cross-site scripting XSS vulnerability was discovered in https://jp.mcafee.com/apps/mdm/jp/3.0asp/. The vulnerability was verified in Chrome 87 and Firefox. The vulnerability allowed execution of arbitrary JavaScript code by injecting it into the website's URL...
h1-ctf: HackyHolidays 2020 Full Write-up: Information Disclosure of 12 Flags
Intro This is my report for the 2020 Hacky Holidays HackerOne CTF. I managed to find all 12 flags with the assistance of my little helper, Jake. He specialises in brute-forcing via a unique keyboard mashing technique: F1134543 Anywho, let's get started... Flag 1: Robots The first one was a nice...
h1-ctf: 12 Days of CTF Walkthroughs
h1-ctf: 12 Days of Hacky Holidays This is my writeup for 12 Days of Hacky Holidays. The report is written such that beginners to CTFs will be able to learn the tricks of the trade. The Mission: The Grinch has gone hi-tech this year with the intention of ruining the holidays 😱We need you to...
Glassdoor: Dom XSS Rootkit on [https://www.glassdoor.com/]
The report was vulnerable to DOM-based XSS via sc.keyword on https://www.glassdoor.com/Job/jobs.htm?sc.keyword=test and got resolved by another report 1064892. Thanks, @4peace for your submission...
LY Corporation: File sizes may be manipulated into negative numbers when uploading
The file sizes were manipulated into negative numbers when uploading. The message indicating insufficient storage space was displayed. However, the file size was recalculated and transmitted during the upload process, allowing the upload to proceed despite the negative file size...
Slack: Cross-site leak allows attacker to de-anonymize members of his team from another origin
This issue was reported by researcher @jub0bs via HackerOne on December 29, 2020. The Slack security team reviewed the issue, understanding the nature of information disclosure on Dec 30th. We closed the issue as informative, which we do to reflect that the report, while accurate, has not taken...
TikTok: Blocked user can see live video
A flaw had the potential to cause a user's live videos to be suggested to a blocked user. We thank @sandipgyawali for reporting this to our team and confirming the resolution...
h1-ctf: A Visit from The Grinch ~ 'Twas the night before Hackmas...
Foreword This was an amazing CTF! The first from Hackerone that I've finished and one that I have enjoyed the most. Huge shout out to @adamtlangley for creating this downright poetic challenge. My whopping 20+ invitations are already being put to good use. Hacky Holidays and Merry Hackmas! Flag 1...