FetLife: Google API key leaked to Public

Hi team, I found a bunch of endpoints that is leaking you Google Api key. I tested the key and found it is vulnerable to Geocode Api. List of vulnerable endpoints https://ass0.fetlife.com https://ass2.fetlife.com https://app.fetlife.com https://ass1.fetlife.com https://ass3.fetlife.com...

Shopify: Informations disclosure - Access to some checkout informations

It came to my attention that using the CheckoutStatus query on https://arrive-server.shopifycloud.com/graphql it is possible to access some checkout details, specifically the query can be called with an ID value ranging from 1 up to 48908. Unfortunately, as I could not figure out how to create a...

Mail.ru: XSS on ub.icq.net

Not blind SSRF on ub.icq.net via url parameter value makes internal port scanning possible...

WHO COVID-19 Mobile App: Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify Users

Summary: Note: I noticed that that the team has fixed issues like an XSS that's caused only from a header value typically OOS since it's not directly exploitable https://github.com/WorldHealthOrganization/app/pull/855, so in the spirit of this I'm also reporting another "good-to-fix" issue. On th...

Acronis: Stored XSS in Acronis Cyber Protect Console

Dear Acronis Security Team, Summary There is a possibility of storing an XSS on the https://mc-beta-cloud.acronis.com/ui/ console. Steps To Reproduce add details for how we can reproduce the issue 1. Login to the console with the given account 2. Go to "Protection" under "PLANS" 3. Click on "Crea...

WHO COVID-19 Mobile App: DMARC and SPF records

If you are encountering this error of No DMARC Record found, this means that your domain does not have a published DMARC record. DMARC Records are published via DNS as a textTXT record. They will let receiving servers know what they should do with non-aligned email received from your domain...

Acronis: HTTP Request Smuggling on https://consumer.acronis.com

Summary The website https://consumer.acronis.com is vulnerable to HTTP Request Smuggling which can be abused by an attacker to redirect all the users to a malicious website. A redirect can be forced by changing the Host request header using the path /sf but the website will redirect you to...

Acronis: HTTP Request Smuggling on https://promosandbox.acronis.com

Summary The website https://promosandbox.acronis.com is vulnerable to HTTP Request Smuggling which can be abused by an attacker to redirect all the users to a malicious website. A redirect can be forced by changing the Host request header using the path /sf but the website will redirect you to...

U.S. Dept Of Defense: Sensitive Information Leaking Through DoD Owned Website https://www.█████.mil

Summary: While checking for some vulnerabilities in dod website I came across this sensitive document which contains sensitive details such as personal mail ids, names, phone numbers, client IP, and address. Description: The above website is leaking information such as - personal mail ids, names,...

U.S. General Services Administration: Unauthorized access to employee panel with default credentials.

Summary: Hello, When hunting for your web application. I have managed to go https://cars.fas.gsa.gov/cars/cars and get displayed with a form. I have already tried to login to Cars and without success. However i've noticed the loginChk function and change the value of the form hence bypassing it a...

U.S. Dept Of Defense: [CVE-2018-7600] Remote Code Execution due to outdated Drupal server on www.█████████

Summary Due to an outdated Drupal version, remote code execution is possible on www.█████ via CVE-2018-7600. Description Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple...

Rocket.Chat: Unauthenticated clients can modify Livechat Business Hours

The Meteor method "livechat:saveOfficeHours" allowed unauthenticated clients to modify the global Livechat Business Hours by directly updating the database model...

Rocket.Chat: Unread Messages can leak Message IDs

The Meteor Method "unreadMessages" could leak existing Message IDs to unauthorized clients when called with a regular expression. The vulnerability was present in Rocket.Chat versions 3.9.3 and develop...

Concrete CMS: Phar Deserialization Vulnerability via Logging Settings

Vulnerability Description: The vulnerable code is located within the concrete/controllers/singlepage/dashboard/system/environment/logging.php script. Specifically, into the Logging::updatelogging method: public function updatelogging $config = $this-app-make'config'; $request = $this-request; if...

Uber: Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees

A Business employee with the user role was able to escalate their privilege to admin using a crafted request to the https://business.uber.com/rpc?rpc=updateEmployees endpoint, as long as the employeeUuid is known...

TikTok: External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processing

A local file disclosure vulnerability was found which an attacker could have used to upload a payload file via the TikTok website and potentially exfiltrate arbitrary local system files. We thank @ach for reporting this to our team and confirming the resolution. Summary: FFmpeg is a free and...

U.S. Dept Of Defense: Misconfigured AWS S3 bucket leaks senstive data such of admin, Prdouction,beta, localhost and many more directories....

Description: It has been observed that the amazon s3 bucket which i believe belongs to DoD as it contains data related to Dod prod,admin,localhost documents and all is misconfigured as a result any unauthenticated users can access it without any restrictions Step-by-step Reproduction Instructions...

Rocket.Chat: Pinning leaks message content

The message content could be improperly pinned, allowing the content to be leaked to an unauthorized client. Validation was lacking in the pinMessage method, which allowed arbitrary messages to be pinned regardless of the user's access. This permitted messages from private channels to be exposed ...

U.S. Dept Of Defense: Reflected XSS on ███████

Summary Reflected XSS on ████████. Description During my explorations I found █████████/search/node, which provides a basic search functionality. If we search something, the value is reflected and not properly sanitized. For example if we search ██████████/search/node/chron0x we can see in the...

U.S. Dept Of Defense: Unauthorized access to PII leads to MASS account Takeover

Hi, I hope you doing well I found a critical endpoint which disclosed the personal information which can use to takeover any account present on https://██████████ Steps: 1. Visit the link https://www.████████/███████ you will get my details, including first name and last name, mobile number and...

Khan Academy: Access to alerta.khanacademy.org leak sensitive data

Hi , I found to access https://alerta.khanacademy.org/ using signup bypass.That leak access to sensitive data of khanacademy.org Step To Reproduce: 1. Go to https://alerta.khanacademy.org//signup 2. Inspect Q and remove ng-hide F1121291 3. You got Signup Form. Signup account using...

Mail.ru: Partner's manager can aсccess statistics of all drivers [city-mobil.ru/taxiserv]

User with partner's manager role was able to obtain statistics for drivers of different partner company...

Nextcloud: Acting under any different user via DB-stored credentials

The issue is related to all Nextcloud versions. It is not patched yet. All versions 18-20 seems to be vulnerable. The issue came up in the following environment: - nextcloud docker image 20.0.2 and 20.0.3 - LDAP authentication - external SMB shares via DB stored credentials The problem came up...

Mail.ru: XSS на странице "Платежи водителей" [city-mobil.ru/taxiserv]

Stored XSS in city-mobil.ru/taxiserv via driver account data...

Mail.ru: XSS при Изменения машины на странице "Контроль" [city-mobil.ru/taxiserv]

Stored XSS on city-mobil.ru/taxiserv car page via firstname and lastname of driver...

U.S. General Services Administration: TAMS registration details API for admins open at https://tamsapi.gsa.gov/user/tams/api/usermgmnt/pendingUserDetails/

Summary: TAMS administrators are supposed to approve or deny all registration requests. The dashboard that shows these administrators details of a registration request calls the endpoint https://tamsapi.gsa.gov/user/tams/api/usermgmnt/pendingUserDetails/REGISTRATIONID, where REGISTRATIONID is...

GitHub Security Lab: [Java] CWE-755: Query to detect Local Android DoS caused by NFE

This bug was reported directly to GitHub Security Lab...

U.S. Dept Of Defense: CVE 2020 14179 on jira instance

Summary: An remote attacker can view the custom sla fields used in the jira instance and also can use the sla fields to make a jql query. Impact Information disclosure of the custom sla fields, senstive information leakage throught he jql query parameter Read more about the impact here:...

MTN Group: Reflected XSS on play.mtn.co.za

hello dear I have found Reflected XSS on play.mtn.co.za parameters injectable ?page=2 my payload "; URL: https://play.mtn.co.za/callertunez/?page=2%27%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain%3E&search=A F1120432 Impact Malicious JavaScript has access to all the same objects as the rest...

GitHub Security Lab: Java: Add SSRF query for Java

This bug was reported directly to GitHub Security Lab...

Rocket.Chat: Improper ACL in Message Starring

The vulnerability allowed attackers to manipulate the starred attribute of arbitrary messages by providing an unrelated room ID where they had access. The vulnerability existed due to improper access checks when starring messages...

MTN Group: No rate limit lead to otp brute forcing

Summary: Hello. There is no rate limit protection in the endpoint https://mtnonline.com/nim/submit , Which could lead to brute force otp code. How To Reproduce: Visit https://mtnonline.com/nim and complete all the required field and submit. when next page load, user will be ask otp code. Enter an...

MTN Group: No rate limit in otp code sending

Summary: There is no rate limit in sendind otp code. Thus, attacker can use this vulnerability to bomb out the mobile inbox of the victim. Steps To Reproduce: Step 1. Open burp suite, and click on "Intercept is on " button from Proxy tab. Step 2. Launch browser and visit https://mtnonline.com/nim...

U.S. Dept Of Defense: Full account takeover in ███████ due lack of rate limiting in forgot password

Steps: 1. Visit the link https://www.██████/██████████and enter the valid ████████. 2. You will be redirect to the page where it will ask you to fill your ████████ and ████████ that you get in your mail. 3. Enter the wrong ███ and intercept the request. 4. Then bruteforce the ███.You can use burp...

U.S. Dept Of Defense: Reflected XSS on █████████

Summary Reflected XSS on █████. Description The page █████ has a reflected parameter ██████████. The parameter is used in a javascript function. For example for requesting http://█████████/?█████████=chron0x the javascript is as follows: javascript ... //alert'boo'; function clickit var █████████...

Zilliqa: Using gossip to drain miner wallets

Summary: Using a flaw in the gossip protocol, a malicious shard member can trick any other fellow shard member into signing an arbitrary message. One way this can be exploited is by creating a transaction transferring funds from the account corresponding to a target node's public key; having the...

Imgur: xss reflected on imgur.com

Steps to reproduce : - i log in to my account and navigate to see other profile - i intercept the request then click Give Emerald F1115658 Request look like : POST /account/v1/gifting/purchase?clientid=546c25a59c58ad7 HTTP/1.1 Host: api.imgur.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:83.0...

LY Corporation: DoS of LINE client for Android via message containing multiple unicode characters (0x0e & 0x0f)

Due to an improper Unicode character processing, the recipient's LINE client for Android may terminate abnormally when an attacker sends large quantities of unicode characters 0x0e and 0x0f characters and the recipient opens the message containing them...

MTN Group: Developer Mistake

Check this path https://mtn.cm/components/ Impact Admin Mistake...

U.S. Dept Of Defense: Full account takeover on https://████████.mil

Description The flow in application is to sign up and wait for an email containing a one-time password, as soon as you login using that password, it asks you to change it. I took that password change request and applied on any email changing their password and it worked Steps to produce: 1- Copy...

Mail.ru: XSS на странице "Создать водителя" [city-mobil.ru/taxiserv]

Stored XSS on city-mobil.ru/taxiserv driver page via firstname and lastname of driver...

Automattic: GET /api/v2/url_info endpoint is vulnerable to Blind SSRF

Summary: GET /api/v2/urlinfo endpoint is vulnerable to Blind SSRF. I am able to hit both Internal and External services via url parameter by replacing with internal and external url. Platforms Affected: https://www.tumblr.com/ Steps To Reproduce: 1. Login to https://www.tumblr.com/ 2. Follow any...

Stripo Inc: Permanent DOS for new users!

Summary: Hi team its me Akash Hamal, and while testing my.stripo.email website which is in scope of your program i was able to DOS permanently any new mail,user which might use your service in future but they won't be able to use ! While registration on my.stripo.email there are three fields...

U.S. Dept Of Defense: Reflected XSS on ███

Summary Reflected XSS on █████████ for invalid paths. Description Requesting a non-existent path on █████, such as https://██████████/chron0x the site responds with No jsonpage404 is /chron0x versus /chron0x./chron0x does not exist. As it can be seen, the path is reflected. This can be exploited...

U.S. Dept Of Defense: PII Information Leak at https://████████.mil/

Summary: While making use of some recon techniques I came across this file which is leaking PII information publically on the Internet. In the description section, I explain the contents of the file and why it shouldn't be public like this. Description: The file in the POC section contains more...

Ruby on Rails: Regex Injection from request header (Rack::Sendfile, send_file)

I have confirmed that Rack::Sendfile and the Rails sendfile that handles it have a problem handling custom headers for request. It is expected that the X-Sendfile-type and X-Accel-Mapping headers will be sent from nginx, but these headers can also be sent from a user agent such as a browser. This...

VK.com: XSS в названии звонка

XSS в сниппете звонка. Уязвимость позволяла выполнить скрипт на стороне пользователя, позвонив ему...

VK.com: Обход приватности у фотографий/документов

Просмотр некоторых фотографий и документов через вики-страницы. Интересный баг в wiki-страницах позволял достать почти любую приватную фотографию и любой приватный документ...

Mail.ru: Bypass the reverse proxy. Request admin

Incorrect configuration of nginx led to path restrictions bypass...

MTN Group: Unauthenticated Arbitrary File Deletion (CVE-2020-3187)

Summary: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a...