Rockstar Games: phpinfo() on graph.rockstargames.com exposes sensitive information

In this report, the researcher identified a subdomain that was improperly made public while sensitive information was disclosed, including phpinfo. We were able to fix the deployment and remove the sensitive information, thus resolving the issue...

Kartpay: Full Path Disclosure of Server through 500 Server Error

Hello team, EXPLANATION ============ I found a interesting vulnerability into your site that it unexpected disclosing the server path where the PHP files are being hosted. When application sends account verification links in email then if anyone tries to verify his account with that link at a twi...

Kartpay: Disclosure of Merchant_id into the source code without entered OTP code leads to Victims MID takeover.

The System Encryption for the merchant registration was revealing the details which can be further exploitable for the Registration of the merchant. After sharing the details by the @bugera it was fixed by the team...

O1 Labs: SPF Records

The vulnerability was that you can spoof their email address and then the attacker can send emails from their email address which could lead to sending fake emails or attempts of phishing. To see if you can send an email of a target domain you need to check if it has an SPF Sender Policy Framewor...

U.S. Dept Of Defense: Stored XSS at https://www.█████████.mil

Summary: Stored XSS exists at https://www.██████.mil. A user can fill out the form and upload a file containing javascript code to trigger XSS. Description: Stored XSS exists at https://www.████.mil. A user can fill out the form and upload a file containing javascript code to trigger XSS. Impact ...

ImpressCMS: Potential Authentication Bypass through "autologin" feature

Summary: The vulnerability is located in the /plugins/preloads/autologin.php script: 45. $uname = $myts-stripSlashesGPC$autologinName; 46. $pass = $myts-stripSlashesGPC$autologinPass; 47. if empty$uname || isnumeric$pass 48. $user = false ; 49. else 50. // V3 51. $uname4sql = addslashes$uname; 52...

ImpressCMS: Arbitrary File Deletion via Path Traversal in image-edit.php

Summary: The vulnerability is located in the /libraries/image-editor/image-edit.php script: 161. if @copy ICMSIMANAGERFOLDERPATH . '/temp/' . $simagetemp, $categpath . $simage-getVar 'imagename' 162. if @unlink ICMSIMANAGERFOLDERPATH . '/temp/' . $simagetemp 163. $msg = MDAMDBUPDATED; ... 190. el...

QIWI: mysql.initial.sql file is accessable for everyone

здравствуйте. я нашел mysql.initial.sql файл Roundcube Webmail initial database structure. оно открыта для всех. это sql файл которая создает структуру разных таблиц как user,session,cache и так далее PoC url: https://contact.rapida.ru/mysql.initial.sql F1164134 F1164136 Impact information...

Enjin: Unrestricted Upload of File with Dangerous Type

The security researcher was able to execute CWE-434: Unrestricted Upload of File with Dangerous Type through a legacy API endpoint used to upload images. This file was directly upload to our CDN with the appropriate MIME time of the file...

Informatica: loing in to marketplace panel on enablement.informatica.com

hello dear support I have found the issue and you can log in in to panel with any password and username F1163976 url: https://enablement.informatica.com/marketplace/ F1163979 Impact Can gain access to admin panel...

Acronis: Cross Site Scripting (Reflected) on https://www.acronis.cz/dotaznik/roadshow-2020/

Vulnerability description not provided...

Informatica: Html injection on ██████.informatica.com via search.html?q=1

hello dear I have found HTML injection on ██████.informatica.com parameters injectable search.html?q=1 URL : https://████████.informatica.com/search.html?q=1%22%3E%3Cimg%20src=https://www.no-gods-no-masters.com/imagesdesigns/anonymous-gandhi-d001001207265.png%3E%E2%80%[email protected]%20%22 payload ; 1"”@x...

Revive Adserver: Open redirect in ck.php and lg.php

An opportunity for open redirects has been available by design since the early versions of Revive Adserver's predecessors in the impression and click tracking scripts to allow third party ad servers to track such metrics when delivering ads. Historically the display advertising industry has...

QIWI: crlf injection на https://bug.qiwi.com

звдравствуйте. я нашел crlf injection на https://bug.qiwi.com. спомошъю этого злоумышленник может установить новые заголовки и cookie загрезняя кэш инфа: site: https://bug.qiwi.com path: /landing/ payload: /%0d%0aSet-Cookie:MyHeader=value PoC:...

Nextcloud: [nextcloud.com] Control character allowed in Submit Question

Issue descriptions We found that the maximum length of the first and last name fields was not set to 32 characters at registration and to 1000 characters when using the profile update form. The attacker can use this method as a malware attack, the user will redirect to a website that contains...

Shopify: Read/Write arbitrary (non-HttpOnly) cookies on checkout pages via GoogleAnalyticsAdditionalScripts postMessage handler

Background Shopify shops can be configured with a Google Analytics integration within the admin settings for a shop /admin/onlinestore/preferences. This is a deeper integration than simply including analytics.js via a liquid template, for example ecommerce tracking can be enabled. Within this...

Mail.ru: CSRF + XSS leads to ATO

Reflected XSS on dwar.mail.ru via POST parameter formnick There was a Self-XSS issue on Request with no CSRF Protection leading to full Account Takeover due to Insecure Session Cookies...

ImpressCMS: SQL Injection through /include/findusers.php

Summary: The vulnerability is located in the /include/findusers.php script: 281. $total = $userhandler-getUserCountByGroupLink@$POST"groups", $criteria; 282. 283. $validsort = array"uname", "email", "lastlogin", "userregdate", "posts"; 284. $sort = !inarray$POST'usersort', $validsort ? "uname" :...

ImpressCMS: Incorrect Authorization Checks in /include/findusers.php

Summary: The vulnerability is located in the /include/findusers.php script: 16. include "../mainfile.php"; 17. xoopsheaderfalse; 18. 19. $denied = true; 20. if !empty$REQUEST'token' 21. if icms::$security-validateToken$REQUEST'token', false 22. $denied = false; 23. 24. elseif isobjecticms::$user ...

Kartpay: Misconfiguration of Merchant id in jwt header + Weird Debug mode enabling behavior leads to exposed OTP of mobile number.

The Verification email Content was able to decrypt easily and leads to disclosure of information that was supposed to be provided after account verification is completed. Secondly, For a Limited time Production was put on debug mode but it was left with it. so now it has been fixed...

CS Money: Able to upload backgrounds before entering 2FA

Summary: Hi Team, I am able to see and use uploaded backgrounds and able to upload new ones without proper authentication of 2FA. I hope you remember this report 993786. Steps To Reproduce: 1. Login with a steam account and enable 2FA. 1. Now logout your account. Clear all the cookies. 1. Now aga...

Lark Technologies: Viewer is able to leak the previous versions of the file

A vulnerability was found where a low level user with only view permissions to a specific file version was able to access previous versions of the file without proper access permissions. We thank @snapsec for reporting this to our team...

Mail.ru: [int.ucs.ru] Атаки на внутреннюю сеть UCS через СУБД Clickhouse

Some requests to clickhouse in ucs.ru were externally available potentially allowing SQL-like requests execution...

Bumble: Bumble API exposes read status of chat messages

Summary The Bumble app allows matches to chat with each other. In the mobile apps it is possible to see whether a message has been delivered the webapp does not offer this feature, but the read status of messages is never disclosed. However, by issuing a POST request to the API endpoint at...

Mail.ru: Theft of Arbitrary file

FolderBrowserActivity of Mail.ru Cloud application for Android insufficiently restricted access to files in application folder...

Acronis: licenses key disclosure

Summary Hi team i found the licenses key stored as cleat text i think it important Steps To Reproduce 1. Go to this link https://dl.acronis.com/u/pdf/workstationlicenses.txt 2.And this link https://dl.acronis.com/u/pdf/serverlicenses.txt 3. You can see all licenses key Impact I think I can use th...

Valve: Big Picture web browser leaks login cookies and discloses sensitive information (may lead to account takeover)

Researcher reported an issue where certain secure cookies would be included in a web request initiated through Steam Big Picture mode that was initially to a trusted origin but subsequently forwarded to a site on a different origin...

Mail.ru: [city-mobil.ru/taxiserv/] SQLi at /taxiserv/requests path at driver_company param

SQL Injections in city-mobil.ru/taxiserv due to unsafe usage of GET parameters...

Mail.ru: [city-mobil.ru/taxiserv/] SQLi at /taxiserv/tariffs/dictionary at filter{"id_locality"} param

SQL Injections in city-mobil.ru/taxiserv due to unsafe usage of GET parameters...

Mail.ru: Full Account Takeover Student Account In https://********.ru/signin/main/student/email

3rd party project with Mail.ru investitions had no sufficient protection against authentication code bruteforce...

Mail.ru: Full Account Takeover In ****.ru

IDOR vulnerability in project related to recent acquision could lead to account takeover within this project It's a new technique about random account takeover, - scenario is: 1 - we registered in website.com and get a fixed cookie that maybe stored in DB and if you loged in again you will get sa...

Mail.ru: todo.mail.ru open .git

todo.mail.ru landing .git folder was publicly accessible...

Acronis: Credentials leaked via Github

Vulnerability description not provided...

Showmax: https://secure.showmax.com/profile/payments

As part of testing user credentials distribution the security researchers were awarded 3 different activation codes, each one granting them subscription for a different country. The researcher reported that it's possible to use a code for country "A" with account associated to country "B". Such...

Nextcloud: Nextcloud Desktop Client RCE via malicious URI schemes

Nextcloud Desktop utilizes QT's QDesktopServices::openUrl to open URLs. This function invokes the OS'/Desktop environment's default application to handling the URI scheme and file extension. During the Nextcloud Add Account flow, the server's login website is opened within a native window/WebView...

Showmax: Parental Pin Bypass

The security researcher contacted us about improper PIN protection authorisation on our content. Showmax users can setup parental PIN protection for different levels of content maturity. If such content is accessed, the user must enter the PIN. It was reported that the PIN protection is easily...

Slack: Denial of Service via Hyperlinks in Posts

Summary Via html injection its possible to override all document functions, causing the application to crash because its using the element as a function. Brief explanation of how its possible override document functions with html injection: In some html elements, the name attribute becomes a...

Brave Software: Brave Browser Tor Window leaks user's real IP to the external DNS server

Summary: When a user navigates to a URL in Tor Window, the DNS requests are sent directly without using the Tor proxy, which leaks the user's real IP address and the requested domain name to the user's ISP and the DNS server. Products affected: OS: Ubuntu 18.04.5 LTS x8664 Brave: Version 1.18.78...

Stripo Inc: Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/

Summary: I have found a bypass for the report https://hackerone.com/reports/1047119 It seems that a proper fix was not issued therefore the issue still remains. Steps To Reproduce: 1. Create a Plug-In and capture the request. 1. Send this to Intruder 1. Follow the rest in the Video POC. POC Video...

TikTok: Lack of rate limitation on careers site allows the attacker to brute force the verification code

An attacker could have potentially attempted to brute force the verification code needed to reset a candidate's password by leveraging a lack of rate limiting on the TikTok careers portal. We thank @iambouali for reporting this to our team and confirming the resolution...

Doppler VDP: Limited access to billing dashboard by Admin and Collaborator in conflict with user role permissions.

Summary: Hello Team, The admin and collaborator roles aren't supposed to be able to have read access to the billing dashboard. However, a bug was found where both roles have limited read access to the dashboard contrary to Doppler docs. F1151905 Steps To Reproduce: 1. Log in to your...

Acronis: Local Privilege Escalation when updating Acronis True Image

Vulnerability description not provided...

Mail.ru: unauthorized Access To Elastic DB

Unauthorized access to the Elastic DB without user data on developer stand running in MCS public cloud computing host Writeup: https://bugreader.com/blitz@unauthorized-access-to-the-elastic-data-base-269...

Keybase: Keybase /AppData/Local/Keybase/uploadtemps folder stores pasted photos

During research, I had noticed that Keybase does not adequately clear the cache and some residual files can be viewed, with no form of encryption on the files. In addition, these pasted photos remain even after clearing the containing chat. Not all of the pasted photos remain, so it's unclear wha...

Mail.ru: Social Oauth Disconnect CSRF at znakcup.ru

The social-disconnect/twitter/ API maded possible to unlink Twitter OAuth from user account on znakcup.ru...

DuckDuckGo: com.duckduckgo.mobile.android - Cache corruption

Summary: By opening a special url, the app cache can be corrupted which can't be resolved by the user without reinstalling the app. Steps To Reproduce: 1. Download and install the DuckDuckGo App 2. Open https://%22t.dev/ 3. Try to reopen the app The app keeps crashing Additional information -...

Lark Technologies: IDOR Allows Viewer to Delete Bin's Files

An IDOR Insecure Direct Object Reference vulnerability was found where if a user with only view permissions knew the alphanumeric token of a folder, they could permanently delete it from an admin's bin. We thank @snapsec for reporting this to our team...

Doppler VDP: Bypass Email Verification.

steps to reproduce:- 1- sign up into doppler here https://dashboard.doppler.com/register. 2- then it will go to this page https://dashboard.doppler.com/confirm and ask you to confirm your email. 3- go to source code and search for tagsconfirmemail . 4- you will find the email Verification token...

U.S. Dept Of Defense: Bypassed a fix to gain access to PII of more than 100 Officers

Summary: Hey team I hope this report finds you well and you're having a great day in these difficult times ; While doing my Recon I have found out that https://www.███/ is leaking PII of many Officers Severity according to me- Critical Step-by-step Reproduction Instructions 1. Go to...

Bumble: Misconfigured oauth leads to Pre account takeover

Summary While testing badoo i have noticed that users can use SMAL Google,MSN,VKontakte,Odnoklassniki,Yandex Mail.Ru to create and login to badoo accounts. Now there are two ways of registering into badoo By email registration Google,MSN,VKontakte,Odnoklassniki,Yandex,Mail.Ru oauth login Now here...