Glassdoor: Reflected XSS at https://www.glassdoor.com/ via the 'numSuggestions' parameter

Hi there, I have found the xss vulnerability at: https://www.glassdoor.com/ via parameter: numSuggestions Summary: Affected Parameter: numSuggestions Browsers tested: Firefox, Chrome, Edge latest version Steps To Reproduce: Go to:...

Open-Xchange: Some build dependencies are downloaded over an insecure channel (without subsequent integrity checks)

The script phase of pdns's .travis.yml file runs a script named ./build-scripts/travis.sh. The main path of execution of this script downloads two dependencies libsodiumdev and libsodium13 via wget over an insecure channel i.e. using http rather than https. Further evidence of this can be found i...

Automattic: Permanent DoS at https://happy.tools/ when inviting a user

Hi Team, At Happy Tools, I found an exception to the exclusion of denial of service. The web app allows creating an account/login into an account either using Gmail or WordPress. The vulnerability lies in the fact that after registration, a user can change their email without verification. Steps ...

GitLab: Exposure of a valid Gitlab-Workhorse JWT leading to various bad things

Summary Using the State Uploading API we could potentially do a bad thing: - Bypass Gitlab::Workhorse.verifyapirequest! This was due to the fact that Workhorse clean the URL before passing it to Rails, this is elaborated in 923027. and State Api read request.body to append it as a file!...

Automattic: [intensedebate.com] XSS Reflected POST-Based on update/tumblr2/{$id}

Summary: Hello, I have found an XSS Reflected POST-Based on https://www.intensedebate.com/update/tumblr2/$id. The parameter $POST'txtCode' is reflected and is not sanitized. To trigger the XSS an attacker need to create a site and invite the victim in their own site and give then full permissions...

Automattic: [intensedebate.com] XSS Reflected POST-Based

Summary: Hello, i have found a XSS Reflected POST-Based in https://www.intensedebate.com/ajax.php. Vulnerables URL : POST /https://www.intensedebate.com/ajax.php Vulnerables Parameters: $POST'txt'; Payload azertyuiop Steps to reproduce 1. Open the xss.html and will you see a javascript pop-up You...

Khan Academy: Login page vulnerable to bruteforce attacks via rate limiting bypass

SUMMARY This report consists of two vulnerabilities. 1st vulnerability: I found out that there is a rate limiting in place after 25 failed attempts. Now that is good, but when i use other email address to bruteforce, The rate limit didnt preserve to the new email. This may looks like a minor issu...

Khan Academy: Password authentication when changing information bypass. Bypass of report #721341

SUMMARY When reading the disclosed reports of your program, i see this one report 721341 . The reporter reported a lack of password confirmation when linking accounts. A fix was applied, adding password confirmation when linking account to other services. But i found a way to bypass this, The...

curl: CVE-2020-8284: trusting FTP PASV responses

Summary: The issue here arises from the fact that curl by default has the option CURLOPTFTPSKIPPASVIP disabled by default. As a result, an attacker controlling the URL used by curl, can perform port scanning on behalf of the server where curl is running. This can be achieved by setting up a custo...

Automattic: Email Verification bypass on signup

Summary: This bug is related to wordpress.com. There is feature in wordpress.com which allow users to invite people. We have to enter email address to invite that particular person but the invite link and invite key is also available to the person who invited. This allow attackers to create the...

HackerOne: Second-order SOQL injection through email and campaign name parameter in Salesforce lead submission

The HackerOne directory contains profiles of bug bounty and vulnerability disclosure programs that aren't managed on HackerOne. These profiles can be claimed by the organization that manages it. As part of this flow, they will need to enter an email address to confirm that affiliation with the...

Nextcloud: Clickjacking URLS

Hey Team While performing security testing of your websites i have found the vulnerability called Clickjacking. Many URLS are in scope and vulnerable to Clickjacking. The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The...

Automattic: Stored XSS in Intense Debate comment system

Hi Team, Summary: The Intense Debate comment system is vulnerable to stored xss by users , this would allow for atacking admins/users on the blog , Platforms Affected: Intense Debate comment system Steps To Reproduce: 1. Go to intensedebate.com/moderate/-ID- 2. Go to comments allow images in...

Mail.ru: DOM XSS on https://biz.mail.ru/domains/goto/mail/ via parameter pollution

DOM based XSS in biz.mail.ru...

Internet Bug Bounty: Some build dependencies are downloaded over an insecure channel (without subsequent integrity checks)

Summary: Build jobs mingw64 | openssl-1.1.1d and mingw32 | openssl-1.0.2u download dependencies from build.openvpn.net and www.oberhumer.comover an insecure channel http, not https and do not check their integrity in any way. This opens the door to person-in-the-middle attacks, whereby an attacke...

ImpressCMS: Other misconfiguration on Slack Server

Other misconfiguration on Slack Server...

Automattic: Sql injection on docs.atavist.com

hello dear team I have found SQL injection on docs.atavist.com url:http://docs.atavist.com/readerapi/stories.php?limit=10&offset=20&organizationid=88822&search=0&sort= parameters: injectable search=0 Parameter: search GET Type: AND/OR time-based blind Title: MySQL = 5.0.12 AND time-based blind...

Mail.ru: XSS account.mail.ru

XSS in account.mail.ru via cookie value...

8x8 Bounty: Any meeting chat history can be read and modified by an arbitrary user

A vulnerability existed where a JaaS user could read & modify the chat history of an 8x8 Meet conference. It was limited by the fact that the meeting UUID was required to be known. The fix was promptly deployed to production. A vulnerability in an API accessible through the jaas.8x8.vc white-labe...

U.S. General Services Administration: CRLF INJECTION

Vulnerable url - https://www.epay.fas.gsa.gov/%0D%0ASet-Cookie:crlfinjection=crlfinjection Impact an attacker can set new header...

Omise: assets/vendor.js file exposing sentry.io token and DNS and application id .

Information Disclosure in javascript file...

Automattic: XSS in Email Input [intensedebate.com]

Summary: I found an XSS in Email input. This input is not sanitized like other inputs allowing user to execute xss payloads. Platforms Affected: https://www.intensedebate.com/edit-user-account Steps To Reproduce: 1. Navigate to your account. 2. In email address, add the below payload next to your...

Bumble: Race Condition on "Get free Badoo Premium" which allows to get more days of free premium for Free.

Summary: On Badoo when a user wants to delete his account it prompts for a Free 3 days premium or the user can proceed to delete his account. But when user choose to get free 3 day premium he can click Get free Badoo Premium and can enjoy free premium for three days, Here i found a race condition...

Mail.ru: Exposed Git Repo at https://mini-app.delivery-club.ru

Leaking sensitive application data in configuration files at mini-app.delivery-club.ru...

Judge.me : HTML injection in review content

Hi Judge Security Team, I found a HTML Injection in review parameter at the https://judgeme-pentest.myshopify.com/products/pentest and at the judge.me Steps 1. Go to https://judgeme-pentest.myshopify.com/products/pentest 2. Click on "Write Review" 3. fill in the fields normally. F1083621 4. Now, ...

Kubernetes: Kubelet follows symlinks as root in /var/log from the /logs server endpoint

Summary: Privilege escalation from a pod, to root read permissions on the entire filesytem of the node, by creating symlinks inside /var/log. The kubelet is simply serving a fileserver at /var/log: kubernetes\pkg\kubelet\kubelet.go:1371 golang if kl.logServer == nil kl.logServer =...

U.S. Dept Of Defense: Blind stored XSS due to insecure contact form at https://█████.mil leads to leakage of session token and

Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://███████.mil/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets. I was able to...

ImpressCMS: Slack server disclose h1 private issue report

Summary ======= Upon browsing the https://www.impresscms.org/, one of the post include the public Slack Channel however the devel channel exposed some of the private h1 reports. Checking ImpressCMS hacktivity the issues that get resolved/reported are private which helps me to verify that the team...

U.S. Dept Of Defense: Able to authenticate as administrator by navigating to https://█████/admin/

Summary: The endpoint at https://███████/admin/ authenticates the user to the administrator user. Step-by-step Reproduction Instructions 1. Navigate to https://███/ and youll notice you will need to log in. 2. Navigating to https://██████████/admin/ will show you admin malformed page, with the...

VK.com: Получение стикеров

Race condition при получении стикеров...

Informatica: Blind SQL injection at tsftp.informatica.com

The parameter refreshtoken sent to the REST path /api/v1/token is vulnerable to blind SQL injection. Compare the response time of these 2 requests: $ time curl -X POST "https://tsftp.informatica.com/api/v1/token" -H "accept: application/json" -H "Content-Type: application/x-www-form-urlencoded" -...

HackerOne: Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne users

HackerOne has a number of ways for hackers to submit security vulnerabilities to a program, two of which are through an embedded submission form and through security@ email forwarding. These two features can be exploited to update a report draft created through security@ email forwarding that doe...

Mail.ru: HTML injection in an email [delivery.city-mobil.ru]

It was possible to inject spoofed HTML content into delivery.city-mobil.ru registration e-mail message via forged user name...

HackerOne: Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos

@nagli found a misconfiguration in an interstitial page that could lead to a link to be indexed by a 3rd party. This could have exposed links to proof of concepts that HackerOne users had posted on hackerone.com. This affected a specific set of customers, which HackerOne worked together with to...

Mail.ru: Database read through file attachment [content://]

Local malicious application selected as a file picker by user could obtain access to ICQ for Android local database by returning a content URI...

Bumble: Possible (we need to wait for some time) takeover of subdomain badootech.badoo.com which is pointing to Medium servers

Description: Hello, team! Recently I found a new subdomain pushed; it's https://badootech.badoo.com/. The site's content contains a Medium icon with the text "Oops! We couldn’t find that page. Sorry about that.", DNS records are: badootech.badoo.com. 21399 IN A 52.1.173.203 badootech.badoo.com...

Mail.ru: SDC bypass cloud.mail.ru for every /api/v3/* endpoint.

SDCS cookie was not properly checked for few cloud.mail.ru endpoints, allowing to bypass SDC secure domain cookies protection for privilege separation between projects...

Shopify: XSS stored in the Shopify Email app

step: 1、install app Shopify Email F1076928 2、Click General under Settings 3、Change phone number to 1234567" F1076939 4、Open shopify email app and create an email 5、Show phone number F1076940 6、watch the vedio poc for more information Impact store xss...

GoCD: XSS In https://docs.gocd.org/current/

Searches on docs.gocd.org were subject to a client-side XSS issue...

Mail.ru: Django Debug=True Leaks admin email addresss and serval system information

Domain, site, application weblate.ucs.ru Steps to reproduce For getting all Url Patterns 1.Open https://weblate.ucs.ru / 2.now after / enter any random string 3.It will open 404 page which contains all the Url Patterns of Website For getting all debug info 1.Open https://weblate.ucs.ru 2. Now go ...

U.S. Dept Of Defense: Reflected Xss in [██████]

Description: Reflected XSS in █████████ due to unsanitized single quote '. Impact An attacker could execute arbitrary javascript, and perform malicious actions ! Step-by-step Reproduction Instructions 1. Used payload: simo%27onfocus=%27confirmdocument.domain%27name=%27simo%27simo 2. Visit the url...

Node.js: DNS Max Responses for DOS

See Github my issue: https://github.com/nodejs/node/issues/36063 When i try to fetch the A Dns records of following domain: ticbrasil.com.br I dont get any response. I think thats the case because there are over 1300 responses. Version: v12.18.4, v14.15.0 Platform: 64-bit Windows 10 Pro &...

X (Formerly Twitter): Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking links

Summary: A chain of two open redirects on analytics.twitter.com and twitter.com, coupled with the use of an Ideographic Full Stop allows an attacker to defeat Twitter's approach to blocking links. Description: Twitter maintains a deny list of domain names and prevents users from tweeting direct o...

X (Formerly Twitter): Read-only application can publish/delete fleets

Summary: Twitter released Fleet yesterday. This feature is working with few APIs, and these APIs are missing permission checks. Description: In /fleets/v1/create of https://api.twitter.com, there is no check to whether if the application has permission to write to the account. /fleets/v1/delete h...

Kubernetes: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC

Report Submission Form I was asked by Kubernetes Product Security and H1 Employee @turtleshell to open a new report with the same details as report 995699. Summary: csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Kubernetes Version: 1.19 Component Version:...

Engel & Völkers Technology GmbH: CSS-Reflected

Summary: Cross Site Scripting reflected Steps To Reproduce: This POC is on how to redirect user to the malicious website to steal credentials or any sensitive information. 1.How the request has been intercepted F1074840 2.What was the ResponseRendered F1074843 or F1074850 3.Which tools are used: ...

Lyst: DOM XSS on http://talks.lystit.com

Description DOM XSS can be achieved via a postMessage due to an insecure postMessage handler being registered. POC 1. Visit https://gamer7112.com/lyst1.html 2. Click the link 3. View alert Vulnerable Code Located at http://talks.lystit.com/data-saloon-presentation/plugin/notes/notes.html javascri...

Rocket.Chat: CSS Injection in Message Avatar

The custom message avatars in the Meteor.method "sendMessage" can contain inline CSS that influences the resulting HTML element rendering. Escaping the input with "none;" allows further CSS to be applied to the elements inline styles, without requiring certain characters such as whitespace...

Rocket.Chat: User Impersonation through sendMessage options

The Meteor call "sendMessage" allowed clients to use custom avatar and alias parameters, which could be used to impersonate other chat room members. This vulnerability has been patched...

U.S. Dept Of Defense: https://██████ vulnerable to CVE-2020-3187 - Unauthenticated arbitrary file deletion in Cisco ASA/FTD

Hi @U.S. Dept Of Defense, I found a host which is running on the web services interface of Cisco ASA/FTD and it is vulnerable to CVE-2020-3187 - Unauthenticated arbitrary file deletion in Cisco ASA/FTD. An attacker could exploit this vulnerability by sending a crafted HTTP request containing...