15267 matches found
BugPoC: Strict Transport Security Misconfiguration
Hello I have found security vulnerable The vulnerable URL: https://bugpoc.com/icons/bandage.svg Summary The table below shows the numbers of issues identified in different categories. Issues are classified according to severity as High, Medium, Low or Information. This reflects the likely impact ...
Mail.ru: Exposed Credentials May Leads to Tarantool Infrastructure Leak
Application configuration data related to Tarantool project was leaked on github.com...
TikTok: HTML Injection on Company Name on Email
By changing the company name to any HTML code on the TikTok Creator Marketplace, an attacker could potentially use this to send phishing emails to users containing injected HTML payload. We thank @gnux for reporting this to our team and confirming the resolution!...
Showmax: WordPress admin is accessible without HTTP authentication
The wordpress instance stories.showmax.com is a complementary system of the Showmax platform. We enforce 2FA for all user accounts that have access to the administration and that's why we decided not to require Basic Auth and/or IP whitelisting for it...
Nextcloud: Leaked of Profile Image from URL changing
Chaning the email address of url will show other's profile images. Impact Leakage of Users Profile Pictures if known email...
Semrush: Critically Sensitive Spring Boot Endpoints Exposed
Spring Boot includes a number of additional features to help you monitor and manage your application when you push it to production. Hacker found that actuator endpoints containing potentially sensitive data such as internal tokens and service data were left public. Semrush has a microservices...
Shopify: [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image
Hello Shopify, when testing Shopify Ping share image function, I discovered an Amazon S3 bucket which has public access which allows an attacker to view all the image of other merchant & users. Steps To Reproduce: 1. Install Shopify Ping on your phone then enable Shopify Chat for your store. 2. G...
Basecamp: Bypass of image rewriting / tracking blocker via srcset
CVSS ---- Medium 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N Description ----------- One of the security features of Hey is blocking of tracking pixels to preserve users privacy. As such, img tags and similar are rewritten by the app to point to gopher.hey.com. However, an attacker can bypas...
CS Money: Attacker can generate cancelled transctions in a user's transaction history using only Steam ID
Summary: The API endpoint /create-payment requires only the steam ID of the account to create the payment. When this endpoint is called using the cardpay flow, it returns a transaction ID on the Cardpay system. The attacker can access this transaction, and immediately cancel it or pay it ; , whic...
Lark Technologies: Privilege Escalation to All-staff group
A vulnerability was found where invited admins with only Company Info permissions were able to modify Staff group settings, including edit / access / delete all-staff, within the members and orgs tab. We thank @snapsec for reporting this to our team...
New Relic: Account takeover by using abandoned email id of victim which has already been changed to new by victim himself on one.newrelic.com
@ashmek identified an inconsistency with account mapping between New Relic One and the discussion forum. This resulted in a situation where a user who has changed their email address could have contents of their account displayed to a new user who had access to the original email address...
Mail.ru: "blog.skillfactory.ru" Vulnerable to Directory Traversal
CVE-2020-11738 on blog.skillfactory.ru...
Mail.ru: Improper Restriction of Excessive Authentication Attempts at https://top.mail.ru/edit? for site counter (Rate Limit bypass via IP Rotation)
Password at top.mail.ru counters was not sufficiently protected against bruteforce...
U.S. Dept Of Defense: System Error Reveals Sensitive SQL Call Data
Summary: If you attempt to login at https://███.mil/sso/LoginRequest.do using a very long username, the application will respond showing a stack trace information with sensitive SQL data call information. This reveals too much information about SQL calls to the database. Please see the attached P...
Basecamp: User can upload files even after closing his account
Summary: =========================== Hello @basecamp This is my first report on your program and I hope to end well : . I was testing https://app.hey.com/ and I my account has been closed, so I back to the requests history, and I tried to send these requests even my account closed. and I found th...
MariaDB: Named pipe connection inteception
With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between...
curl: Data race conditions reported by helgrind when performing parallel DNS queries in libcurl
While running binary built from curl git repo file "docs/examples/10-at-a-time.c" under valgrind specifically with the helgrind tool, reports race condition in getaddrinfo calls. Using the latest curl/libcurl from github repo. From the valgrind documentation "Helgrind is a Valgrind tool for...
pixiv: Bypass extension check leads to stored XSS at https://s2.booth.pm
In this report, a hacker identified a stored XSS in the header image upload function at https://manage.booth.pm/design/edit using Content-Type header manipulation. Upon file upload, the server failed to properly validate the provided Content-Type, accepting unintended values such as Content-Type:...
Basecamp: Lack of quarantine macOS attribute(com.apple.quarantine) leads multiple issues including RCE
Hi, basecamp team. HEY macOS client does not properly validate file uploads on its macOS inbox. That is because, by not setting the com.apple.quarantine attribute in the metadata of an executable file when it is uploaded, you allow the file to be executed on macOS without being checked by...
curl: Parallel upload hangs curl if upload file not found
Attempting to upload -T a not found file with parallel -Z flag present, will cause curl to get stuck and never terminate, potentially stalling scripts that make use of this particular flags. curl -T blabla-notexists -Z upload.example.com www.google.com www.cnn.com www.apple.com Same issue occurs ...
Stripo Inc: Memory Dump and Env Disclosure via Spring Boot Actuator
Memory Dump and Env Disclosure via Spring Boot Actuator Spring boot actuator files/endpoints can be accessed via path like stripo.email/██████/actuator/, including a 110 MB heapdump file, which expose source code, private keys and some internal data! The maximum severity of this asset is medium, ...
Acronis: Subdomains takeover of register.acronis.com, promo.acronis.com, info.acronis.com and promosandbox.acronis.com
Summary: The Subdomains https://register.acronis.com, https://promo.acronis.com, https://info.acronis.com and https://promosandbox.acronis.com are vulnerable to takeover due to unclaimed marketo CNAME records. Anyone is able to own these subdomains at the moment. This vulnerability is called...
U.S. Dept Of Defense: [████] SQL Injections on Referer Header exploitable via Time-Based method
Summary: SQL Injections on Referer Header exploitable via Time-Based method Description: https://owasp.org/www-community/attacks/SQLInjection Impact https://owasp.org/www-community/attacks/SQLInjection Step-by-step Reproduction Instructions First, vulnerable points:...
TikTok: Information Disclosure of Advertiser Account on TikTok Ads Portal
In the TikTok Ads portal, if both invited Ad Accounts are part of the same business group, an exposed endpoint could potentially be exploited to view email address, phone number, company, and name of the Ad Account owner. We thank @emanuelharijanto for reporting this to our team and confirming th...
phpBB: Server Side Request Forgery in 'Jabber settings' in Admin Control Panel
Overview The 'Jabber settings' panel inside the Administrator Control Panel can be used to access resources that would otherwise only be accessible by the host machine, including resources/services hosted on the localhost interface. This can be performed by setting the 'jabber server' parameter t...
Shopify: Ability to connect an external login service for unverified emails/accounts at accounts.shopify.com
Hi, Description I have found that it is possible to add external login service even if the email address is not verified. This allows someone to create an account with an email he does not own and create some kind of backdoor accounts that would allow him to get access to shops and more. In the...
Kubernetes: Development Application Credentials + Information Exposed
Issue Description When I browsed through all the JS files on prow.k8s.io I came across a link called /config which contains a configuration disclosure for the development files URL Vulnerabilities https://prow.k8s.io/config Proof On Concept javascript - continuous-integration/travis-ci kubespray:...
Valve: Add any depot to your app and access its contents without decryption key; via /apps/setcommonredists
The summary is: A parameter-validation error on an endpoint used to configure redistributable depots allowed external depots to be added to an existing app without the required decryption key...
Shopify: Customer's full name disclosure via Shopify Chat (by email lookup)
By making use of the Shopify Chat Application, it is possible to retrieve a customer First Name and Last Name by providing its email. Steps to reproduce 1. Having a shop with Shopify Chat installed, open up https://shop.myshopify.com/?chat in Incognito mode 1. Click on I need an update on my orde...
U.S. Dept Of Defense: CSRF to account takeover in https://█████/
Hi DoD team, I found a CSRF to account takeover in https://███████/ NOTE: Try to open the site in firefox because chrome sometimes is not allowing to open the site. Summary: There is no protection against CSRF in changing email which lead to CSRF to account takeover on https://██████/. Step-by-st...
Nextcloud: Potential DDoS when posting long data into workflow validation rules
A missing input validation in Nextcloud Server 20.0.1 allowed users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules...
Shopify: Staff Member can Get POS Access Without User Interaction
Hi, I found that it is possible for a staff member to grant themselves POS access without user interaction from admin. Steps to reproduce - Login as a staff member with Manage Locations permission only, in a shop that has POS channel up and running Could be Lite - Make sure your staff member...
Basecamp: a very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of service
Summary : ========= after trying to change my initial name to something long i found out that their are no limits to how long it can be , so i directly changed it to something very long F1050497 which caused my account to really slow down when accessing it and in the android app , it just keeps...
Shopify: Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation
It came to my attention that the Shopify Chat application allows a customer to retrieve its order status by only providing the order email and number. Noticing that it results in being provided the order status page link, I started playing a bit with both parameters and I found out that it is...
U.S. Dept Of Defense: Blind Stored XSS on https://█████████ after filling a request at https://█████
Description: When you submit a request at https://██████████, the content is being sent to the administrators of the application, and you will be presented with your request status at https://████ The Description field at the request status page is prone to stored xss and blind stored XSS...
Basecamp: Remote Code Execution in Basecamp Windows Electron App
The Windows application for Basecamp, allows a "Download" feature for images in your posts. Under certain restrictions, those files are downloaded and sometimes even automatically opened executed. The file will be executed if it's a download from an internal URL and the mimetype is text/calendar...
Mail.ru: This Github Repository Seems Leaking Samokat Django Project
Source code and application configuration data related to Samokat promo site was leaked on github.com...
Open-Xchange: Guard WKS lookup: Evil WKS server forces connections to last forever
Any logged-in user can cause denial of service against the AppSuite server by asking Guard to fetch keys from a badly-behaving WKS server. This WKS server's response never ends, tying up a java process and TLS connection forever. Any logged-in user can cause denial of service against the AppSuite...
Glassdoor: Reflected XSS at https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true via PATH
Summary: The endpoint https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true is vulnerable to reflected XSS. Injecting any input in path will be reflected back without any sanitisation. Affected URL or select Asset from In-Scope:...
Mail.ru: This Github Repository Seems Leaking Incoming Samokat Project
Source code and application configuration data related to Samokat was leaked on github.com...
U.S. Dept Of Defense: SQL Injection in www.██████████
Description: SQL Injection is a vulnerability which allows interference with the queries performed on a database, to obtain sensitive information which could be really useful to attackers. A web application database is often queried using user-requests parameters, which when are not properly...
X (Formerly Twitter): The Deleted Polls is Still Accessable after 30 Days
A vulnerability was found in Twitter that allowed users to access a deleted Poll beyond the 30-day limit set by Twitter. The Poll was not visible or accessible via the user interface, but it could still be accessed for an extended period of time. This could compromise the privacy of the user's...
Shopify: Bypass For #997350 your-store.myshopify.com preview link is leak on third party website Via Online Store
Hi Security Team, Description Full Description in 997350 The owner of that website can perform a security compromise by grabbing those links. Solution: The solution is very very SIMPLE. Just include the following HTML code in the following in code between tags of the html of the page: This will n...
U.S. Dept Of Defense: CSRF to Stored HTML injection at https://www.█████
Description: I have found out that on the https://www.███████ domain, you initiate POST request in order to look up for case studies, the parameter keyword on the request, allows the usage of bad characters such as Click here to win 1000$!" 3. Save the POST request and craft CSRF payload. HTML...
Rocket.Chat: Stored XSS in any message (leads to priv esc for all users and file leak + rce via electron app)
Persistent XSS flaw using nested markdown tags allows remote attacker to inject arbitrary JavaScript to message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app. Patched on 3.11, 3.10.5, 3.9.7, 3.8.8...
Mail.ru: Получение локального пути до файла [geekbrains.ru]
Verbose error output was enabled on lms-beta.geekbrains.ru...
U.S. Dept Of Defense: Reflected XSS www.█████ search form
Description: Reflected XSS vulnerabilities arise when the application accepts a malicious input script from a user and then this is executed in the victim's browser.Since the XSS is reflected, the attacker has to trick the victim into executing the payload, usually using another website. In this...
GitHub Security Lab: Java: CWE-749 Unsafe resource loading in Android WebView leaking to injection attacks
This bug was reported directly to GitHub Security Lab...
Informatica: Improper Sanitization leads to XSS Fire on admin panel
Summary Because the HTML is not sanitized when taking the input on https://accounts.informatica.com/registration.html, the input is vulnerable to XSS. When a payload such as " is put into the form under company it triggers a blind xss. When the payload successfully is loaded, it dumps information...
Yelp: X-Forward-For Header allows to bypass access restrictions
Summary: If the "X-Forward-For: 127.0.0.1" header is used, it allows to bypass restrictions of the web application and access endpoints that are restricted otherwise. This allows for example to access the "Business Owner App backend API". The responding server thinks, he is accessed by an interna...