Ruby: Command injection in OptionParser.load

OptionParser.load function use IO.readlines to read file, which can inject | command to exec command. poc: require 'optparse' OptionParser.new do |opts| opts.load"|touch /tmp/niubl" end.parse! Impact The command may be executed unintentionally...

Brave Software: Onion-Location header allows to open arbitrary URLs including chrome:

The "Open in Tor" feature in Brave Nightly for OSX allowed arbitrary URLs to be opened through the Onion-Location response header, including privileged URLs such as chrome://restart/. This could be exploited to bypass SOP restrictions and gain access to privileged URLs...

Shopify: [h1-2102] [Yaworski's Broskis] Suspected overcharge and chargebacks in PoS

Summary: NOTE: This one need verification from the side of Shopify as we can't set up a real payment GW or check the logs of the test one When checking out in PoS and paying with credit card, it is possible to manipulate numbers in the end request to overcharge a client charge more than the item...

GitLab: Responsible Disclosure of Privacy Leakage Issue

Greetings, I am Mojtaba Zaheri, a doctoral candidate in Computer Science, affiliated with the NJIT Cybersecurity Research Center. Together with my doctoral dissertation advisor, Prof. Reza Curtmola, we are reaching out to perform responsible disclosure of a vulnerability present on the GitLab...

IBM: Insecure Object Permissions for Guest User leads to access to internal documents!

An Insecure Object Permissions vulnerability was reported to IBM, analyzed and have been remediated. Thank you to mocr7...

8x8: DNS Misconfiguration (Subdomain Takeover) ███.wavecell.com

An S3 bucket was deleted, but a DNS record pointing to the bucket was initially not updated/removed. The issue has been rectified...

New Relic: Account Takeover via Email ID Change and Forgot Password Functionality

@dsdh discovered an issue with the email change flow, where emails would be sent to the new email address prior to that address being verified. An attacker could have abused this issue to access vulnerable user accounts...

Algolia: email verification bypass

An issue in the way email modification was handled during the email verification process allowed the creation of account with arbitrary email address, bypassing the email verification step. A logical flaw resulting in email verification bypass! :D...

Rocket.Chat: Hi! Security Team Rocket.Chat, It's possible to get information about the users emails without authentication

Description: Email enumeration vulnerability. Vulnerable api method: /api/v1/users.2fa.sendEmailCode Releases Affected:: Rocket.Chat up to 3.10.5 Request for existing account: POST /api/v1/users.2fa.sendEmailCode HTTP/1.1 Host: rocket-chat.local:3000 Referer: http://rocket-chat.local:3000/home...

Mail.ru: [int.ucs.ru] Доступ ко внутренней сети UCS через забытый прокси Fiddler на 217.25.235.214:7459

SSRF on ucs.ru...

HackerOne: Ability to invite a new member on Sandbox Program

In the description HackerOne offers a sandbox for hackers to help them test program functionality for security vulnerabilities. To create a program, go here. You can select any product edition, giving you access to almost all features HackerOne offers. Hackers can create up to 30 programs in the...

Shopify: [h1-2102] Break permissions waterfall

Summary: Shopify Plus User permission roles will propagate changes to all the users in the role Its possible to break this If you pass FULL along with other Pemrissions into a user role edit It will propagate to the users and give them full access while the role shows partial access Steps To...

Shopify: Improper deep link validation

The application contains an activity which validates and handles the deep link requests, initiated from a VIEW intent action. The declared schemes include http and https request for the domain shopify.com as well as .myshopify.com. The path prefixes include mostly subdirectories of the /admin pat...

GitHub Security Lab: ihsinme: CPP Add query for CWE-14 compiler removal of code to clear buffers.

This bug was reported directly to GitHub Security Lab...

X (Formerly Twitter): PI leakage By Brute Forcing and Phone number deleting without using password

Summary: This additional security measure from twitter provides protection to the victim's account, considering that a victim's session may have been hijacked by a hacker, however, due to this additional layer of security Implemented by twitter the hacker would not be able to disclose the victim'...

Shopify: Github access token exposure

While dissecting an application made by one of your employees I found his GitHub Personal Access Token PAT, he's a member of the org with pull and push access to all of your repositories. As a proof I can tell you that on the repo github.com/Shopify/shopify at commit hash cea9c273391d the sha512 ...

TikTok: CSRF on TikTok Ads Portal

A CSRF Cross Site Request Forgery vulnerability was reported in the TikTok Ads portal which could have been used to disable an ad campaign. We thank @probatorem for reporting this to our team...

Shopify: Store Deletion or Sell without authentication

In order for an owner to "close or sell" the store, a password is required in order to confirm the decision, when the action is applied in the web application. It was identified that the mobile application doesn't require credentials in order to perform the same action, thus by navigating to the...

Shopify: Open Redirect on Login Page of Stocky App

Vulnerable app is Stocky, 1. Visit login page of app with vulnerable parameter & malicious website address?returnto=//evil.com like https://stocky.shopifyapps.com/users/login?returnto=//evil.com 2. Then login to account 3. Open Redirect is executed PoC Video: F1172071 Impact Open Redirect...

Weblate: Race Condition allows to get more free trials and get more than 100 languages and strings for free

Hi there, As there is rate limit in the website, but it doesn't prevent users to take more than 1 trial which later leads to loss of the company, because by getting more trials I can get more strings and languages limit. Steps to reproduce: 1 Create an account on https://hosted.weblate.org and...

Shopify: [h1-2102] HTML injection in packing slips can lead to physical theft

Summary: A HTML injection vulnerability exists in the packing slip generator, allowing customers to alter the logistical process of their and other's orders for shops that choose to display the user's e-mail address on the packing slip. The success rate depends on the shops setup and can result i...

GitLab: Stored-XSS on wiki pages

Hello, A Stored-XSS is existing on Wiki pages. It is caused by recent change in show.html.hamlL10 ruby ... "".htmlsafe ... authorurl is defined by committed email in wikipageversion.rb: ruby delegate :message, :sha, :id, :authorname, :authoremail, :authoreddate, to: :commit def authorurl user =...

Sixt GmbH & Co. Autovermietung KG BBP: Cross domain token leakage via Referer header

Summary: The password reset link of user account on critical sixt+ domain/product can be obtained using the page https://www.sixt.com/php/profile/loginorpasswordforgotten. This page requires email address and surname/lastname of the user to send password reset link on email. This link contains th...

BlockDev Sp. Z o.o: xmlrpc.php FILE IS enabled it will used for Bruteforce attack and Denial of Service(DoS)

xmlrpc.php file is visible...

GitLab: Change project visibility to a restricted option

Summary When a GitLab administrator on gitlab.com or a private instance has restricted a project visibility option, the project visibility can still be changed to that option. This can be done using the API route. The same applies to groups. They can also be set to for example internal on the...

OpenMage: CSRF in changing password after using reset password link

Summary: Hey OpenMage, the forgot password page is not protected against CSRF attack which can lead to changing password. Use the below form to test html document.forms0.submit Steps To Reproduce: 1. Go to https://demo.openmage.org/customer/account/forgotpassword/ 2. Enter your email and ask for...

Mail.ru: restaurant.delivery-club.ru - возможность получить информацию об чужих акциях.

Уязвимая конечная точка: PUT /dashboard/promotions HTTP/1.1 Host: restaurant.delivery-club.ru User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:84.0 Gecko/20100101 Firefox/84.0 Accept: application/json, text/plain, / Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip...

curl: Proxy-Authorization header carried to a new host on a redirect

hi cURL team I am not entirely sure this is an issue, please feel free to close of it isn't. I noticed that when making an HTTP GET request with Proxy-Authorization header, together with the "-L" flag to follow redirects curl -H "Authorization-Proxy: Basic xxx==" http://host:8000 -L If the remote...

Acronis: Blind SSRF vulnerability on cz.acronis.com

Vulnerability description not provided...

Mail.ru: [https://geekbrains.ru/profile] - authenticity_token not tied to user session leads to CSRF attacks

CSRF on geekbrains.ru The CSRF token on /profile was valid, but not tied to user's session, e.g. Account A's Token was valid on Account B, this could have lead to change other user's phone number, birth date, legal name etc...

Shopify: [h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034)

Summary: Due to a missing domain format check in Shopify's wholesale functionality, it is possible to serve arbitrary content on the customer's domain through existing DNS records already configured to work with Shopify. I only tested with domains that I own but as far as I understand, this would...

FetLife: Stored XSS via `Create a Fetish` section.

The reporter pointed out that the fetish field for creating new fetishes on FetLife was vulnerable to a stored XSS exploit, after creating a fetish for which this exploit was used the contents would execute whenever people added the fetish to their profile and attempted to edit the fetish through...

U.S. Dept Of Defense: █████████ IDOR leads to disclosure of PHI/PII

Summary: ████ is designed in a way where there is a vulnerable endpoint that allows a non-medical user to view the ██████████ records of people who are not ████████s of the sponsor. Description: I am currently an Active Duty Airman and this vulnerability does require CAC authentication. When...

OpenMage: No error thrown when IDOR attempted while editing address

Summary: demo.openmage.org application having features to add, edit and delete addresses. When a user tries to edit the address of another user, the server adds a new address with a new id on the attacker's account. By sending it to an intruder, an attacker may cause Dos. Steps To Reproduce: 1...

Mail.ru: prometheus server monitoring System publicly accessible

Performance metrics were available at track.mail.ru...

Shopify: [h1-2102] Stored XSS in product description via `productUpdate` GraphQL query leads to XSS at handshake-web-internal.shopifycloud.com/products/[ID]

This is most likely going to be a duplicate, so I'll keep it short. A stored cross site scripting vulnerability exists at handshake-web-internal.shopifycloud.com through the product description field. Recruirements A shop with the Handshake plugin enabled and set-up Reproduction steps 1. Add a...

Snapchat: CSRF when unlocking lenses leads to lenses being forcefully installed without user interaction

Hi, The url below allows a user to unlock a particular lens. Once they have opened the URL on their phone, Snapchat opens up and prompts the user to unlock this lens. https://www.snapchat.com/unlock/?type=SNAPCODE&uuid=6ff5a565fca249a1948b1963ee2881b4&metadata=01 By changing the value of type in...

Shopify: [h1-2102] shopApps query from the graphql at /users/api returns all existing created apps, including private ones

Summary: I have seen that there is query called shopApps executable on the /ID/users/api graphql that returns a huge amount of apps it timeouts with a limiting. In the response I have noticed the returned apps also include the private apps, so I do not think that this is intented like this. Using...

OpenMage: No Limit on Email Subscription

Summary: Hello Madison As I have Found a Business Logic Error which cause unlimited amount of Newsletter Subscription as you can see in the image i have provided Steps To Reproduce: 1. Open Burpsuite and set the proxy and intercept on. 2.Then Go to https://demo.openmage.org/ and enter the Email y...

Shopify: [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserTfaEnforcement

Summary: There is an access control issue that happens when a Shopify Plus user tries to update the 2FA requirement of a user in another organisation. While the response shows an error message, an email is sent to the user with the 2FA status, first name, last name, email address, and shop id fro...

Shopify: [h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only

Summary: PLUS User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only Description: User with Store management permission as shown in below screenshot F1168574 Should not have the ability to enforce SAML organization...

Shopify: [h1-2102] [Plus] User with Store Management Permission can Make convertUsersFromSaml/convertUsersToSaml - that should be limited to User Management

Summary: Plus User with Store Management Permission can Make convertUsersFromSaml/convertUsersToSaml - that should be limited to User Management Only Description: User with Store management permission - F1168487 only, is able to convert users account from SAML and to SAML using the graphql Impact...

Shopify: [h1-2102] [Plus] User with Store Management Permission can Make changeDomainEnforcementState - that should be limited to User Management Only

Summary: User with Store Management Permission can Make changeDomainEnforcementState - that should be limited to User Management Only Description: User with Store management permission - F1168470 only, is able to change user management settings using the graphql Steps To Reproduce: - - - - - As a...

Shopify: [h1-2102] [Oberlo] Least privileged user can cancel account owner's subscription via POST on /payments/subscribe

Vulnerability description not provided...

Shopify: [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserRole

Summary: There is an access control issue that happens when a Shopify Plus admin tries to assign a role to a user in another organisation. While the response shows an error message, an email is sent to the shop admin with the first name, last name and email address of the user. Steps To Reproduce...

Internet Bug Bounty: Buffer overflow in PyCArg_repr in _ctypes/callproc.c for Python 3.x to 3.9.1

TL;DR Description Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to cdouble.fromparam. This occurs...

Acronis: Stored XSS in profile page

Summary There is a stored XSS vulnerability in the users profile page. Steps: 1-Go to https://forum.acronis.com , create an user and login 2-Go to profile and edit it 3- enter javascript code in Signature field for exampe use this code in Signature : test 4-send this profile to other users ,or se...

Acronis: Cross Site Scripting (Reflected) on https://www.acronis.cz/

Summary You can post javascript and html code in form fields steps : 1-go to vulnerability link : https://www.acronis.cz/poptavka-acronis/ 2- enter this javascript code "alert1; in form field for xss and enter Test for html injection. Impact Impact 1- Cookie stealing 2- Pishing attacks 3- URL...

OpenMage: Sharing products with Mail allows phishing attacks due to misconfiguration.

Hello Team. I found a part that could cause a phishing attack. Incorrect configuration in the part of sharing products with mail causes this. 1. Go to https://demo.openmage.org/sendfriend/product/send/id/430/catid/20/ 2. The Sender email address should normally be an email address provided by you...

Shopify: [h1-2102] Information disclosure - ShopifyPlus add user displays existing Shopify ID fullname

I am not sure if this by design but it came to my attention that the Add users functionality located at https://shopify.plus/id/users/invite allow a Shopify Plus user with the User management access to retrieve any existing Shopify ID full name. Steps to reproduce 1. Log in into ShopifyPlus 1. Go...