15579 matches found
QIWI: Account takeover just through csrf in https://booking.qiwi.kz/profile
Hello Team: after register by any account, we can found that we can change email in profile to another one, by just using a GET request https://booking.qiwi.kz/ajaxconfirmcontact?type=emailconfirmed&[email protected]&iframePopupMode=1 but without verification, attacker can steal account...
h1-ctf: Wholesome Hacky Holidays: A Writeup
Flag 1 Warm-up: flag48104912-28b0-494a-9995-a203d1e261e7 Checking the robots.txt the flag can be found. Also a path is revealed: /s3cr3t-ar3a Flag 2 It's right in front of you: flagb7ebcb75-9100-4f91-8454-cfb9574459f7 With the previously found path /s3cr3t-ar3a, the flag was hidden in plain sight...
U.S. Dept Of Defense: ███████mill is vulnerable to cross site request forgery that leads to full account take over.
Summary: The form within the "My Account" page in ███████mil fails to verify the CSRF token used when an user makes changes such as changing the password and other details. For example, an attacker can change the user's email address, full name, phone number, etc. In this way the attacker can gai...
h1-ctf: Hacky Holidays CTF Writeup
Intro: 12 days of challenges - some more challenging than others! This holiday CTF had all 12 challenges hosted on the website https://hackyholidays.h1ctf.com/ F1129112 Challenge 1: I started by significantly overthinking all of the early challenges in this competition. When this CTF started the...
Stripo Inc: Stored XSS in the banner block description
Steps To Reproduce: - Create a new template and add a banner block F1128944 - Add a description to the banner block description: " - Malicious code executed F1128945 Proof Of Concept: F1128942 Impact With this vulnerability, an attacker can for example steal users cookies or redirect users on...
h1-ctf: Complete destruction of the Grinch server
Hackyholidays flag 1 First flag is just a matter of reading /robots.txt file: User-agent: Disallow: /s3cr3t-ar3a Flag: flag48104912-28b0-494a-9995-a203d1e261e7 flag 2 Visiting /s3cr3t-ar3a and opening it with developer tools gets the second flag: flagb7ebcb75-9100-4f91-8454-cfb9574459f7 It is...
WHO COVID-19 Mobile App: Error Page Text Injection (no compromise)
Hi team! I want to report a context spoofing or text injection at http://hack.whocoronavirus.org/ 404 page Vulnerability Description : The http://hack.whocoronavirus.org/ scope allows users to inject any content on the 404 not found webpage Vulnerable Location :...
h1-ctf: Invading Grinch Network and Saving Christmas
How we saved Christmas As usual with H1 CTF challenges we are provided with a target URL. In our case it is the following: https://hackyholidays.h1ctf.com/ We started by visiting the URL and see what is going on. All we could see is a page with an image with a warning message. F1125722 We quickly...
Mail.ru: DOM based XSS via postMessage at store.my.games
mailru.core.js as used by GMR/store.my.games application was vulnerable to XSS via PostMessage handler...
h1-ctf: Writeup Hackyholiday CTF
Hi there, Find my writeup on attached : F1128138 Thanks adam for making the CTF, Really PAIN for my head! Impact Hackerone Hoodie ? 😍😍...
h1-ctf: Hackyholidays CTF writeup
Writeup for the hackyholidays CTF This CTF consisted of 12 challenges released daily in the 12 days leading up to christmas. The goal was to stop the Grinch from ruining christmas by slowly destroying the apps that he used to terrorize Santa and his elfs. The challenges were: 1. Robots.txt 2. DOM...
h1-ctf: h1 hacky holidays CTF solution
Simple script to print all the flags. Full solution to follow want to spend more time writing this, but am racing to be first 10 submissions: echo "Flag 1 -- robots.txt" curl https://hackyholidays.h1ctf.com/robots.txt 2/dev/null | grep flag echo "" echo "Flag 2 -- js descrambed --...
h1-ctf: Flags for hackyholidays CTF
Hi, Here are all the flags: 1. robots.txt: flag48104912-28b0-494a-9995-a203d1e261e7 2. s3cr3t-ar3a: flagb7ebcb75-9100-4f91-8454-cfb9574459f7 3. people-rater: flagb705fb11-fb55-442f-847f-0931be82ed9a 4. swag-shop: flag972e7072-b1b6-4bf7-b825-a912d3fd38d6 5. secure-login:...
TikTok: Multiple bugs leads to RCE on TikTok for Android
A series of WebView vulnerabilities were found including XSS which could have potentially led an attacker to achieve remote code execution. We thank @dphoeniixx for reporting this to our team and verifying the resolution!...
h1-ctf: Solution for hackyholiday
Summary: Since there is a reward for the first 10 submissions, I'll start by providing the flags: flag48104912-28b0-494a-9995-a203d1e261e7 flagb7ebcb75-9100-4f91-8454-cfb9574459f7 flagb705fb11-fb55-442f-847f-0931be82ed9a flag972e7072-b1b6-4bf7-b825-a912d3fd38d6...
h1-ctf: [CTF] I've DDoSed Grinch Network
Hello! Here are all 12 flags for HackyHolidays CTF: 1. flag48104912-28b0-494a-9995-a203d1e261e7 2. flagb7ebcb75-9100-4f91-8454-cfb9574459f7 3. flagb705fb11-fb55-442f-847f-0931be82ed9a 4. flag972e7072-b1b6-4bf7-b825-a912d3fd38d6 5. flag2e6f9bf8-fdbd-483b-8c18-bdf371b2b004 6...
h1-ctf: Stopping Grinch to ruin XMas!
Hello, Gonna just submit flags first then will send my write up later tomorrow. flag1: flag48104912-28b0-494a-9995-a203d1e261e7 https://hackyholidays.h1ctf.com/robots.txt recon revealing hidden endpoint flag2: flagb7ebcb75-9100-4f91-8454-cfb9574459f7 https://hackyholidays.h1ctf.com/s3cr3t-ar3a...
h1-ctf: ctf walkthrough
Hi, finally managed to solve all challenges, this was my first h1ctf, some challenges were pretty nice, some others had some frustrating guessing parts, but overall it was fun. Here goes day1 to day12 walkthroughs: Day 1 we have only one asset in scope hackyholidays.h1ctf.com the main page at...
GitHub Security Lab: Java: QL Query Detector for JHipster Generated CVE-2019-16303
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: 3,880 Pull Requests Generated to fix JHipster RNG Vulnerability CVE-2019-16303
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CPP: CWE-191 into experimental this reveals a dangerous comparison
This bug was reported directly to GitHub Security Lab...
Reddit: Weak rate limit could lead to ATO due to weak password protection mechanisms
Summary: Although the server sends a message when attempting to brute force the login endpoint, if you enter the right credentials the server will ignore that error and will give access to the account. When the server sends this error, it should not give access until the 3400+ seconds ends...
U.S. Dept Of Defense: Reflected XSS on https://█████████/
Vulnerable Website URL or Application: javascript https://███████/███████=%22%3E%3Csvg/onload=alert%22nagli%22%3E Description of Security Issue: please limit to one site/app per submission Reflected XSS due to no input validation ██████████ Steps needed to reproduce bug: Navigate to javascript...
Zego: Firebase Database Takeover in Zego Sense Android app
Hello Team, Summary: publicly available Firebase Database api-project-615509201590.firebaseio.com Platform Affected: android com.zegocover.zego Steps To Reproduce: in res/values/strings.xml https://api-project-615509201590.firebaseio.com POC: Go to...
Myndr: No Rate Limit On dashboard.myndr.net/auth
Summary: hello team, I tested a little bit the website and went to registration page where you will give 7 digits to complete your switch serial, i didn't want to go further with brute forcing because it's forbidden how ever i gave a try with a small range of tries and have no message for limitti...
FetLife: Google API key leaked to Public
Hi team, I found a bunch of endpoints that is leaking you Google Api key. I tested the key and found it is vulnerable to Geocode Api. List of vulnerable endpoints https://ass0.fetlife.com https://ass2.fetlife.com https://app.fetlife.com https://ass1.fetlife.com https://ass3.fetlife.com...
Shopify: Informations disclosure - Access to some checkout informations
It came to my attention that using the CheckoutStatus query on https://arrive-server.shopifycloud.com/graphql it is possible to access some checkout details, specifically the query can be called with an ID value ranging from 1 up to 48908. Unfortunately, as I could not figure out how to create a...
Mail.ru: XSS on ub.icq.net
Not blind SSRF on ub.icq.net via url parameter value makes internal port scanning possible...
WHO COVID-19 Mobile App: Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify Users
Summary: Note: I noticed that that the team has fixed issues like an XSS that's caused only from a header value typically OOS since it's not directly exploitable https://github.com/WorldHealthOrganization/app/pull/855, so in the spirit of this I'm also reporting another "good-to-fix" issue. On th...
Acronis: Stored XSS in Acronis Cyber Protect Console
Dear Acronis Security Team, Summary There is a possibility of storing an XSS on the https://mc-beta-cloud.acronis.com/ui/ console. Steps To Reproduce add details for how we can reproduce the issue 1. Login to the console with the given account 2. Go to "Protection" under "PLANS" 3. Click on "Crea...
WHO COVID-19 Mobile App: DMARC and SPF records
If you are encountering this error of No DMARC Record found, this means that your domain does not have a published DMARC record. DMARC Records are published via DNS as a textTXT record. They will let receiving servers know what they should do with non-aligned email received from your domain...
Acronis: HTTP Request Smuggling on https://consumer.acronis.com
Summary The website https://consumer.acronis.com is vulnerable to HTTP Request Smuggling which can be abused by an attacker to redirect all the users to a malicious website. A redirect can be forced by changing the Host request header using the path /sf but the website will redirect you to...
Acronis: HTTP Request Smuggling on https://promosandbox.acronis.com
Summary The website https://promosandbox.acronis.com is vulnerable to HTTP Request Smuggling which can be abused by an attacker to redirect all the users to a malicious website. A redirect can be forced by changing the Host request header using the path /sf but the website will redirect you to...
U.S. Dept Of Defense: Sensitive Information Leaking Through DoD Owned Website https://www.█████.mil
Summary: While checking for some vulnerabilities in dod website I came across this sensitive document which contains sensitive details such as personal mail ids, names, phone numbers, client IP, and address. Description: The above website is leaking information such as - personal mail ids, names,...
U.S. General Services Administration: Unauthorized access to employee panel with default credentials.
Summary: Hello, When hunting for your web application. I have managed to go https://cars.fas.gsa.gov/cars/cars and get displayed with a form. I have already tried to login to Cars and without success. However i've noticed the loginChk function and change the value of the form hence bypassing it a...
U.S. Dept Of Defense: [CVE-2018-7600] Remote Code Execution due to outdated Drupal server on www.█████████
Summary Due to an outdated Drupal version, remote code execution is possible on www.█████ via CVE-2018-7600. Description Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple...
Rocket.Chat: Unauthenticated clients can modify Livechat Business Hours
The Meteor method "livechat:saveOfficeHours" allowed unauthenticated clients to modify the global Livechat Business Hours by directly updating the database model...
Rocket.Chat: Unread Messages can leak Message IDs
The Meteor Method "unreadMessages" could leak existing Message IDs to unauthorized clients when called with a regular expression. The vulnerability was present in Rocket.Chat versions 3.9.3 and develop...
Concrete CMS: Phar Deserialization Vulnerability via Logging Settings
Vulnerability Description: The vulnerable code is located within the concrete/controllers/singlepage/dashboard/system/environment/logging.php script. Specifically, into the Logging::updatelogging method: public function updatelogging $config = $this-app-make'config'; $request = $this-request; if...
Uber: Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees
A Business employee with the user role was able to escalate their privilege to admin using a crafted request to the https://business.uber.com/rpc?rpc=updateEmployees endpoint, as long as the employeeUuid is known...
TikTok: External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processing
A local file disclosure vulnerability was found which an attacker could have used to upload a payload file via the TikTok website and potentially exfiltrate arbitrary local system files. We thank @ach for reporting this to our team and confirming the resolution. Summary: FFmpeg is a free and...
U.S. Dept Of Defense: Misconfigured AWS S3 bucket leaks senstive data such of admin, Prdouction,beta, localhost and many more directories....
Description: It has been observed that the amazon s3 bucket which i believe belongs to DoD as it contains data related to Dod prod,admin,localhost documents and all is misconfigured as a result any unauthenticated users can access it without any restrictions Step-by-step Reproduction Instructions...
Rocket.Chat: Pinning leaks message content
The message content could be improperly pinned, allowing the content to be leaked to an unauthorized client. Validation was lacking in the pinMessage method, which allowed arbitrary messages to be pinned regardless of the user's access. This permitted messages from private channels to be exposed ...
U.S. Dept Of Defense: Reflected XSS on ███████
Summary Reflected XSS on ████████. Description During my explorations I found █████████/search/node, which provides a basic search functionality. If we search something, the value is reflected and not properly sanitized. For example if we search ██████████/search/node/chron0x we can see in the...
U.S. Dept Of Defense: Unauthorized access to PII leads to MASS account Takeover
Hi, I hope you doing well I found a critical endpoint which disclosed the personal information which can use to takeover any account present on https://██████████ Steps: 1. Visit the link https://www.████████/███████ you will get my details, including first name and last name, mobile number and...
Khan Academy: Access to alerta.khanacademy.org leak sensitive data
Hi , I found to access https://alerta.khanacademy.org/ using signup bypass.That leak access to sensitive data of khanacademy.org Step To Reproduce: 1. Go to https://alerta.khanacademy.org//signup 2. Inspect Q and remove ng-hide F1121291 3. You got Signup Form. Signup account using...
Mail.ru: Partner's manager can aсccess statistics of all drivers [city-mobil.ru/taxiserv]
User with partner's manager role was able to obtain statistics for drivers of different partner company...
Nextcloud: Acting under any different user via DB-stored credentials
The issue is related to all Nextcloud versions. It is not patched yet. All versions 18-20 seems to be vulnerable. The issue came up in the following environment: - nextcloud docker image 20.0.2 and 20.0.3 - LDAP authentication - external SMB shares via DB stored credentials The problem came up...