Lucene search

K
openbugbountyDevl00pOBB:1337450
HistorySep 15, 2020 - 5:34 a.m.

kobe-face.jp Cross Site Scripting vulnerability OBB-1337450

2020-09-1505:34:00
devl00p
www.openbugbounty.org
5

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: kobe-face.jp
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: devl00p
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAWZElEQVR4nO2df0wT5x/HT6xQa0HEUlHrV2AGCXEOHSO4qSG4qCHEVKaOOaboCDKGqEQdMsMYGlRE44gS4pjBhTj/MMQQQpwhxnSOMcSmdoxVggS72jGtrGDFDir3/ePJntzunnt6LVTAfV5/kD7X58fn+TzP3Yfnubt3p7AsywAAAACAD/AbbwMAAACAVxaIMQAAAICvgBgDAAAA+AqIMQAAAICvgBgDAAAA+AqIMQAAAICvmBAxJiIi4u7du2LJ/xoTqvsTyhhPmdTGTzrA2wCR8Y8xv/zyy8jIyBtvvEFM/teYUN2fUMZ4yqQ2ftIB3gbEcBNjHjx4EBgYSPyqv7//2LFjYknp1NfXb9iwgZektOupnR6xb9++6dOnX7x4cfRV8ZBoIc8bvm6Ont9TY8ZqFMakrbHypEd4dBZ4566//vprx44doaGh8+fP/+yzz4aHhz2tgWjDgwcPZs2a5XU93p22QmNGYwOXp0+f7tmzZ+HChdOnT1+8ePGJEydevHhBb3oKhwULFhw6dAj5ltspbrapU6dGREQcOXIE1ez1BfCVx/t1jN1uLy0tFUtKhxhjvLZqNDx58qSioqKlpSU9PX3MK1+4cKHNZnObbby6TzRvHMdi9IyL8V6fBdLJyMgYGhoyGAw3btxobm4uKiryaXMSmWhTZefOnWaz+fr162azubKy8tq1a3q9nl5EqVQ6nU6n0zk4ONjY2Hjz5s2SkhJGcGrgbA6H4+rVqw0NDWjEX8LQT1ZYKj09PUqlUspXlJwUrFZrcHDw0NAQL+lpbd617otKRgPPG6Nh9H3xwpiX6UB6W2PoSY/wyANeuGtwcFCj0TgcDpRsbW1dtGiRZyb+G4vFsnz5cvQhPj7eu0q8Pm159PT0BAcHe10cMzg4KJPJ7Ha7R03zLL9161Z0dLSUbDExMcSvAISkdcxXX30VERExe/bsjz76qL+/n2GY/v7+8PBwh8MxZcqUixcvcpOnT58ODAw8efLknDlzZs2atX379ufPn4vVXF9fv3bt2mnTphGTiF9//XX27Nk//PADSj579mzXrl2hoaELFiz48ssvuUvgEydOCBv9+++/P/7448DAwIULF37xxRdiS+YnT55we3T79u0VK1ZMnz49NDR08+bNDx8+RNlevHhx6NChOXPmzJgxY/PmzU+ePJHYBFpxo79izsHdR9mOHTsWGho6d+7cb775RqwVlPPUqVMRERGzZs368MMP0QBRHEipR2xoxLxBh1iK1xDeHqF0hOhzhHBmjtKTxKERTjlitbyTgjf0YoNO7IJYkenTp//+++8zZsxA2bq6uubNm8d13YwZM95///0nT54cOHAgNDR09uzZO3bsePbsmdgYzZ8//86dO+jDzz//jA5+//339JHlZeCdtsTTUOy0ffjw4bp16wIDAxcvXnzp0iV08Ny5c+vWrcP1f/7559u3b3drFTZsZGSEYRiZTEbMQ5lOXORyudPpZNxtacrlcpfLJTb0ACNlr8zhcBgMhubm5tbWVqvVWlBQwDDMzJkzTSYTWjamp6dzkxs3bnQ4HK2trW1tbW1tbXq9vqysTKxytxtl/f39qampx48fX7VqFTqSl5dntVr1ev21a9fq6+srKyuxnW3/wG20pKRkcHDQaDReu3ZNp9NVVVURLZk9eza3R3q9Pisrq7e3t729XaPR5ObmomxlZWVNTU1NTU2dnZ3z5s3r6OiQ3gS2U8w53O47HA6TydTe3l5TU7Ny5UpKKw6Hw2g0ogEym82FhYV0B0q0lmuMmDfoeFpKrCNEnzMiM3OUniQODXHKCavlnRS8rhFrpnTB7Ul07969/fv3l5eX43pu3bplMBisVmt0dLTNZjMajS0tLT09PdiToQKIA5GRkbFmzRoUe3jcvn17zZo1GRkZ3IM8bxNPQ7HTNjc3NygoqKOjo7GxEccYrVar0+mePn2K609NTaVYxTNsxowZycnJaWlpP/74ozC+ik0nLv39/cXFxcnJycS2MI8fPz58+LBWq6UMPeB+r4xhmIGBAZRsbm6OjIzEXxH3ylARs9mMjtfV1cXFxaHPZrM5PDwcF3E4HEqlsq+vT5jEtSUnJ+fk5OAiLpdLqVR2d3ejZH19fUJCAr1RlUqF9xYMBgNlQ0BstdvV1RUWFoY+q9VqvV7PyyClCVQ5xU5e9xmGwZ6htMIboFu3bqEBEnMgpR5u33lDI+YNYh+JX+FSwmmDtkfEOsKK+JwyM0fjSeHQEKccsVoxD4jVTD+5xOYJwmKxREZGXr58GWfGW0O3bt3y8/MbHBzE1eL9NIsAloTD4SgtLQ0JCdmyZUtnZyc62NnZuWXLlpCQkNLSUuw9orcl+hAdl8vl3Px4rywhIeHKlSvYpej+h9AqMcMGBgYKCgqioqJkMtmiRYuKi4tdLhf6ijKdVP/g7++/detWVBt3TLnZQkJC5HJ5dna20+lkYa9MHM/ux3A3TCkxRi6X4+MdHR1qtRp9drlcVqsVf1VXV5eUlERMotoKCwv9/PwuXLiA81itVn9/f5zs7OzEVy5io319fdypExISgo6rOBA7q9fr33333Xnz5qFSqNd2u10mk+HJihBrguhJinOE3ZfSCuWSTXSgxHp4Q0P0htCHvEqIpegGC48TfU7JPxpPEoeGOOXELihiMYZYM/3kEpsniISEhIqKCreuECal09fXp9VqZTIZSspkMq1WK7zJwfO2dB+i47z82NTjx49nZGSwLHv27NktW7aIWUUxDOF0OpubmxMSEg4fPsxSp5NCoUBxt6amJiwsDAdpXozB2axWK7ceiDFikLcsfcTUqVPnzp2Lk/SNssHBwbq6usuXL+fm5qamps6cOdOLFp1Op5+fX1tbG96c9fPzYxjGYDDQC2q12szMzKqqKrlcbrFY1q9fz+2FlCY8hf5kjhetEB0osR6eMURvjMaHnsLzOZ0x9+RE448//jAajT/99JOnBYWbY48fPybmvH//flFRkU6nQ89WMQxTUlJSXl6ek5NTUlLy2muv4Zw+eqIsNTUV7UA2NDTgrTmhVRTDEAEBAStWrKioqEhPTz9y5Ag6SJxOfn5+8+fPZxhm+/bt5eXl1dXVu3fvpmQDpEIPQd6tYxjOevnq1au8ZT7C5XKpVCq8fOYle3p6ZDJZR0cHy7IpKSm5ubk4m5S9Mm6jSqVSuDSmd/bRo0fcf5QMBgPutVqtNhgMvIJSmiDulWE7hd0X/k9EbIWyLCA6UEo9PGMo3qBUIlZqYGDAz8+PuydGX8ewIj4Xyz8aT4oNDXGvzKN1DLFm+slFOYlcLhe2h14PLylxryw7O1upVObn59tsNu5xm822d+9epVKZnZ2NLeF5W7oPWcFe2dWrV7mWL1mypKmpKTg4GM0WMauIhnF381iW1el03K1Xt9Pp8uXLGo1GuAkm/TlbAON9jHE4HDKZDG+M4iSaZ5s2bbJYLO3t7bGxscXFxbgGNGwsy+p0uiVLluDjvCS3XZPJJJfLjUYjSmZmZm7YsMFsNre3ty9fvhztGFAazc7OTkhIaG9vt1qtZWVlJSUlUjqrVqsrKyvtdntnZ6dWq8W9Li0tjY+PNxqNFoslNzdXp9NRmsCdZf8dY4R2UrqPIbYiZeuJ50C39fCMoXiDx8DAgEwmM5lMaA9BrFR8fHxmZmZvb29nZ+fKlSvdxhiiz8Xyj8aTYlNIOOXELijckwKPvljNbmOM2EnEkqYWsR5hUgrp6ek9PT1i3/b09KSnp6PPQm9L9yE6rtVqufm5phYVFS1dujQlJUWKVVzDTCaTWq0+f/681Wq12+3IyNLSUpRNynRiWTYmJqaqqoqVHGN410MA432MYVm2uLhYoVDU1NRwk6dOnVIqlcePH1er1cHBwdu2bSPubO7fv7+wsBBXxUvy2s3Ly1u9ejX67HA4srKyVCqVRqPBt/JQ/rKyMmGjTqdz7969Go1GoVAkJydz/wGkdFan08XFxcnl8rCwsPz8fNxrl8t18OBBlUoll8u1Wi36l4rYBHGdh/4KnUPvPqUjEm9vcB3oth6eMRRvCCkoKMBTQqxUV1dXUlKSUqmMiYmpqKhwG2OIPhfLP0pPEuetcMpRrjXcs4Brg7Bmt5sERGNYUhTxxf0YKRC9TTwNiacty7IWi2Xt2rVKpTIqKqq8vJxrKtqMxZcXj2hsbExMTAwKClIoFEuXLj1//jz+Ssp0Ylm2trY2PDyc99IPfbHCux4CCDcxxgskrhmjoqJaWlrEkq8e3Bgj/HZCdX9CGeMpXhvvu70OL2qeLBsvPp0qDodDLpcTH24EJhEv9Z4/l3v37lGS/zUmVPcnlDGeMqmNn3T41NvXr19fuXLlWCmYAePFhHui5u7du5988gnv4GSXDR8eHm5ubtZoNG5zRkRE3Llz54MPPvjzzz8lVj7ZnQMAQvr7+9FTy+NtCDBaJlyMycjICA8P5x55BWTDs7KycnNz3UrmoZ6++eab/v7++/fvl1LzK+AcABCC7+iMtyHAqBnDfTfvNpGRXin6bLPZ/Pz8uM/MsCx79OhR7qO3o7QQ31Ts6+tLT08PCQmZN2/ewYMHkX4iejCGy/r161nxrvGOd3d3b9iwITg4WK1WZ2Zm4vfCJHoG91Sv14u9Sy9WRIyampro6Gi5XB4dHY0f5iEi0UhPZ9HNmzdjY2MVCkVCQgJ+ts07iO41mUzr168PCgpSq9U7d+70SAkRAABfM/7rGK4mtsPhUCgUAQEB3Aw+eslr586dIyMjRqOxqalJp9NhG5T/aHcj6uvrpdeZkpISHR1tMplaWlpsNltOTg467qmwf0hIiMPhkNIi3Tlff/314cOHy8vLLRZLVVVVRUUFfg3Na5BbTCZTcHAw9hIlf1paWnFxMXoHc+fOnaNpmuje5ORkjUZjMpn0er3T6czOzh5NEwAAjDFjGK+8W8fQHw0cW5F2vI5xOp1c9W+3At1SjgvfOtRoNNJt4/ZUoifdOkej0Vy/fh0n9Xq9QqHgvZ6G8Wj4pD8Rq1Kp0Lt+DQ0NS5culVi/EKJ7nU7nmTNn8BudRqPRI58DAOBr3K9jiJLaUsTehQrqQkV0t5rYXNnwjRs3njx5Eh2/e/duQEAA1kLftWvXgQMHiKrdRPFwp9M5MjLi7++PknK5fHBwEH0eGRnZs2fPnDlz5syZs2/fPqFQP08qHxMaGhoVFXXu3DmGYZ4/f15VVYXEMBiOPDhFV5z4uwY8KJrqt2/fXrVqVWBg4Pz58997773ffvutv7/fYrEkJibi/MuWLbt58ya2hydNz4UuR+/WMC45OTnJycmffvppYWEh9r8XTRDdGxAQsGfPHuTb4eHh2trapKQkSiUAALxs3EahsLCwpKSktrY27sGqqqoLFy7Y7fbe3t69e/dqtVpW8I9wYWFhWlpad3d3R0dHYmLi2bNn0d2Obdu29fb2Xrt2zWQysSyLNbGJr7YlJyfX1taiz9XV1WvXrkWfjx49KpPJkO4sy7KRkZE3btwoLS2Ni4tDb/Dm5eWhN3jRi8Rms7mrq2vJkiX4v++4uLi9e/cODQ0NDAykpKRs2rSJ/ed+TGFh4aNHj1D+8vJybtfsdntUVBR+pUt4PyYoKEgul8tksujoaLxiwNmIFgp7KvRDa2trUlIS7yYNt4hara6uru7r6+vu7j59+nR3d7fFYuEKDnIhDgRvQckwDNdvvPfMeesY4iRBlJWVKZVKhULBlUOlN6ESQHcvy7J1dXUymSwxMZF3Mw8AgPHFfYwRk9TGiMm2CxXUe0iK6JS9Mp7CvNVqVSgU6CISHx+fn5+/detWVCooKGhoaEio2k0RD+/o6IiNjfX391coFAzDoD0lp9PJfafs6tWrPOl7nlS+8HX65cuXt7a2Xr9+XaPRVFdX87IRdcWFPeVWK0VTva+vTyaT8S6vdG0ltwPBULXleTFGbJJUV1cvXbq0t7c3MTERPT3R1dWFVYfFmhCT1RJzL8uyg4ODSDIE6X8AADBBkHo/hiep7Va2naigTrzqUWIMT2GeZdnY2NgbN2709vZqNBq73a5Wq10uV3V1dWpqKlG1myIejrDb7adPnyaqdrIsazKZuOFTKJXPNXhoaEihUOBHpy5duoSrRdnEdMWFPeVWK0VTnWXZtLS02NjY/Pz88vLymzdvsixLX8e4HQi6tjzxfoxQdx3HVKvVqlKpSktLW1paYmNjpTTBg+JeTGNjI/rlYAAAJgiSniu7f/8+Eo/DktparXb16tU6nc5gMDQ2NgqLYAV1g8FgMBiMRqNbKXghwoemkpOTm5qaGhoaUlJSZs6cGRsbq9Ppmpqa8C/WeSQCzzCMQqE4c+ZMUVGRWAb0u60MRyq/oKBA+HvGDMP09fUNDQ29/vrrKBkbG2uxWITZiBZSHg8rKSnR6XQ5OTn379+nFPnuu+/QomFoaCg/P3/37t1oB3J4eJhb6s6dO5Rf3h0Nwkny+PHjvr6+ZcuWMQwzd+7cmpqaoqKisrIyfJtKDOLPNRLdOzw8fPv2bVwwMjLSarX6oncAAHiJ2ygklNQWk23n/XcsVFD3aB3Dkw1HNDc3x8fHb9iwobGxkWXZysrKvLy8sLAwtNcvVO2mi4ezLHv+/Hnuf75NTU3ov2xEXV0d3isjSuXzeiSXy7u6unBZJGDO/nuvTKgrLuwpr1q3muo88CNtGo2mqakJH29vb0fPlUkZCIb6Aw28dQxRdx05n7t1lpWVxTBMe3s7vQmxvTKhe9HzgXjTr76+nvI7pwAAvHzcxxiipDZRtp0n7S5UUCde2ria2GazGe+fCBXmcdNqtRrde7BYLEFBQTgqEFW7KeLhLpcrMjKyvr4eH7Hb7SqVqqioyGaz6fX6JUuW4N8OIErl87qcm5ublJTU3d2t1+ujoqKwAiv3nr/QQmFPu7q6hDtRFE31jo6O9evX37hxw2azmc3mzMxMpIh+/vx5jUbT0NBgs9l0Ol1MTMzRo0dZacGeoWrL82KMmO56Tk7O22+/3d7ebrPZampqVCpVWFgY+kVCt00IIbo3JSUlLS3NYrEYDIaYmJjKykp6JQAAvEy8fD9GTLadK+0uVFAXuwuNNbGdTif+z1eoMI/YunUregYMERcXh7MRVbsp4uHffvutcPu+ra1t5cqVSqUyMjKyrKwMHaRI5fO6nJubq1ar//e//6EH0njFiRYKe3rlyhX6qyS8IkNDQ8XFxVFRUf7+/mq1Oj09vbe3F32F3/OPiooS+3Ve4UG6tjwr+f0Yp9NZUFAQHh4ul8uXL19eW1vb3d2tUCh0Op3bJoi1Cd376NGjtLS04OBgjUaDIigAABOHsdf2HyV5eXnoVvakVpjnQX+9kddTp9MZHh7OfWjKbZEx5yVoy08W+XoAAEbDuGn7i1FeXo6eDvjviLTzehoQEFBbW/vOO+9ILwIAADAxGX+9Mh7Tpk176623xtuKsUS6sD+GHmAAAAAmCxNuHfPqkZWVVV9fX11dPd6GAAAAvGymsCJq7QAAAAAwSibcXhkAAADwygAxBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAXwExBgAAAPAVEGMAAAAAX/F/jx3/XJixOWkAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAP60lEQVR4nO2dbUxbZRvHz7rKWijvtGOsCCyEwbLg5hDBMCRTl1kJIZO9ZFY3I0GzMESiC+Jb3eZgzJnIFlzINIwvGj80hCyGLESXisQgYx0UVgqZUKAwVpBCYQULfT4cn/Ocp+fc9zmnUFrc9ft0Wu5z3f/7uq/D3Z6Xfze4XC4CAAAAALyAyNcCAAAAgH8tsMYAAAAA3gLWGAAAAMBbwBoDAAAAeAtYYwAAAABvAWsMAAAA4C1gjQF8QEJCwt27d32t4h/8SoxQ1rV44HEA1hhgrenu7l5eXn7qqad8LYQg/EyMUNa1eOAxgXuN2cBGcHDwGohbS2w2W2Vlpa9V/MN7770nlUqvX79Of5OucGhoyCdTwLNffDKbmpry8vLWUg+msVAxa5l5zr5WMZP8EXSkrCRdvipyYJVxceFwOBwOh9FoDAsLI7dNJpNMJuPccX0xODjoJ4OyWq0ikUiv1zudTvr7dIU+VOtwODjb4OWlp6ffvHlzVcQIzQNTvFAxa5l5zr5WMZP8EZSBFaaLT7EBfo6YcxHatGkTQRASiYTaDggI8PbK9zhjt9sDAwP99gQIWQMeMzY2ZjKZcnJyVkmOMNzE+1bMClnX4nmywmID/AHPr8d8/fXXCQkJkZGRr7/+us1mo95fWFh46623goOD4+LiPvvss6WlJfpe5Pffixcvbt68OTw8/Pjx448ePSL/9Mcff2RmZkqlUrlcfujQodHRUbJxZWWlXC7fsmXLt99+y9qMCnvp0qWEhISgoKAjR45MTk5+8MEHcrk8MjLyzTffnJubw8iz2Wzx8fF2u33Dhg3kGSpmM1YxbuPiI4DO3Nzc22+/LZfLY2NjP//886WlpcnJSTclJEyFqCnA559K9d69e4ODg7du3frqq6/eu3ePIIilpaUPP/xw8+bNQUFBhw4dmpycZA6ZfvoCNZWsUimampr279//xBNPoPKJyjyZ2/Dw8Ndee41ebxQ9PT2RkZG//vorPg6rGFRdcYKpRqrN0NBQeHg48f9F4jYQZvKp3VEHGj6TrGWAOfqYpUi1p0dGTS4mMmoI+F2YaWQtWsD/8XCNsdvter2+ra2tvb3dYrGUl5dTfzpz5sz8/HxXV1dzc7NOp7t69Spz3/b29o6Ojo6Ojs7OzurqavL9zs7OoqKi8fFxg8GgVCqLi4vJxkaj0WAw1NfXZ2VloZpRklpbW/V6vcViSU5OtlqtXV1dv//+++DgYEVFBUZeaGio0WiUyWQOh0OtVqOaMcUwc8IpgE5JSYnFYuns7Gxubm5qaqqtrY2MjHRTQsJUiJoCzvwTBJGbm3vixAmz2dza2pqVlUV+Sa2urm5paWlpaTGZTDExMb29vXyGzJxKplQ69EsIrMFRme/q6iIHazabmcm02WwHDx6sqqrau3cv/zzQxaDqCo/QvVADYU0+gT3Q8JlEDR919DFLkTUyZnJRkTFDQO3CCmvRAusAnufUBgcHw8LCqG2CIGZmZsiXbW1t27Zto1pGRUXZ7XZyW6/Xp6enu8UhCMJsNpMvtVptWloas7uBgYHo6Giy8dTUFEoV2YwKOz09Tb7f2toqEonm5+cphYmJiXh5bieOmc3wYvgLoHA6nTKZ7P79++TLpqamjIwMphJ6F/TrMagpwOff5XJNTU2JxWLmmW6FQtHZ2ckcFH3ITA2sU4kagt1ul8lkZEBUPlGZpwbb2tpKDZbqSKVSnTx5kjMOXRVdjBtUXTHBXGCgVyO9DXXsYAbCTD6zPX2WOTPJWgaoKcOUIjMyawZQkTFD4PxXQO8IVbSA/8N9PYYVmUxGfY2NiYmZmpoit//66y+r1RofH0++XF5eFovdu5BIJLGxseR2cnKy2Wwmt+/cuXP69One3t7FxcXl5eXl5WWyI/I8AwVrM7JlaGgoua1UKkNCQqRSKaXQarXylIdpxhTjlhNOAXQmJiYWFxcTEhKoVJBHHU9Yp4DPAMPDwwsKCjIyMvbt2xcTE5OWlvb888/bbLapqanU1FRmL5gho6YSxc2bN9PT06mAzOCYzFODVSqVVL2RfPTRR83NzdeuXeOMgxGDqiu5XE7t8vDhQ7cgqL1QsA4ElXwCfaDhM4kZPuuUYUoRXwB0UMWAGgJmFyasRctHFeBzPFxjUDgcDpFI1NHRQdW0SMT3dFx+fn5hYeHVq1clEsnIyMiBAwdW0mwl8libLS4u8u/IV/Ac4Pfff3/79m2DwWCxWMrKyp577rlz584RBLFx40avyuO819aDzM/Pz2u12h9++KG4uPjgwYPkMs8njpsYVF3p9XpM7yupRjcEJR+fyZUchn4Ls2gvX77sa1EAN6u8xmzZsiUwMHBqamr37t2oNg6HY3h4mPz8YjKZnnzySYIgHj58aLFYPvnkE7IN81M/Cc9mK5GHajY0NCSoL04UCkVAQMCff/5Jfn40Go3UB0+P4TlAgiD27NmzZ88egiBUKlVubu7ly5cjIiLu3r0r6H421qlEsbS0dOPGjU8//VSofnzmRSKRVqtNSUlpaGj4+OOPyf87nHHcxGDqauvWraiuUXtFRETMz8/Pzs6Sn99HRkYw+gmCCA0NFZR8zkxiyoB1ylalFAUVg2e7MItWqEhg7Vn9TzdqtfrkyZM9PT1jY2MXL148e/Yss01ZWdno6GhPT49Go8nNzSUIQi6XR0REfPPNNzabrb+/X6PRsAbn2cwDeVFRUQ6Ho7+/n/8oVsjGjRuPHj1aWlo6PDxMpuLYsWOY9m4KUXAqv3fv3ssvv/zLL79MTk4ODw9fuXJl165dBEGUlpYWFRV1d3ePjo6eOnWKukELD3MqUVLb2tqio6OpEzIe63dDIpGkpKQQBPHll19eu3atu7ubTxw3MfzrKiIiwuFw9PX1LS0tofYKDg5OS0srKyt78OBBf38//So3CkHJ55NJzPCZUyaoFN0md2FhAROZE567oIoWWAfwvG7jds2f9ZImicPhKC0tVSqVgYGBKpWKupBI37eqqkqhUISFhb3xxhvUhXGdTpeWliaRSKKjo8vKysLCwlivLjKbcUqiv8TI02g0gYGB9fX1rM3wT5PxF0DHbrcXFRVFRUUplUqNRkM+dInpiFKI6Q6ff5fLtbi4qNFokpKSAgICFAqFWq0eHx93uVxOp/P06dNRUVESiSQ/P99qtTKVMJ8DZZ1Kt2SSvP/++xUVFaiMUXBmHlOKJSUl2dnZfOK4iXEh6oqV8vJyamiovQYGBvbt2yeTyXbs2FFTU8NZpczkY9rzySRrGWCmTFApMusQFZlz7lD147YvqmgB/2eDy+VayyVtaGho586ds7Oza9kp4A2ETuX27dsbGhqeffZZr6riiV+JEYrH4r139HkQGf4VPCas8vUYAEDR19fnawn/w6/ECGVdiwceN9b93SYAAACA3wJrDAAAAOAtVnON4ePFHRcXt5IzsKguPLAB98DM//r16ykpKVKpNCUlxSf3Tc7Ozr777rtxcXFSqXT79u0XLlyg+0qRbYSOCxWTE3IqPXD7B892X7HCo291I3tPDOBfrOL9A2tge87HZ2WFoVDU1dUplcobN25YrdZbt24lJiaeOXNGUI8rp6CgID8/32g0TkxMtLS05OTktLe3k3+ibDaEjgsTkyceuP2DKQgAPCas5n1la3CjCKqLNbitJTY29rvvvnvppZfIl3fu3MnKypqYmAgKCuLf6Up49OhRSEiI1WqlHGtYETQunjFXDtxEBACPJxznyo4cOfLFF19QLzMzM7/66itW33I3MDbmGNdxPjb+BEFcuHAB5QdOgbe4Z1qUs3qb09uPjIzQf6tj9+7dt27dQilHRWP1J+dpWk56YbEarFFnn/j8SAHPmITX3P6pXTBFMjY29sorrwQHByckJFy6dImnZRYAAP4Gxxpz+PDhxsZGcntsbEyv1+/fv59naJSNOcZ1nI+Nv91u7/gvGD9wvLU706Ic5W1OaZNIJOQPjVA888wz5JcYpnJUNFZ/cp6m5UFBQSqV6ujRo7/99hvrr9GwjgufB3zMNXD7RxVJcXFxQEDAwMBAS0tLQ0MD62ABAFgH4E+lzc/Ph4SEkP7btbW1eXl5PB+6xtiYY1zHOW38MRbibhchOC3u6bugvM1ZGzPjuClHRWP1JxdkWj4zM1NeXp6UlCQWixMTE1mfx+b8kQKeMV1ec/unPxzOWiROp1MikVAJ1Gq1mKfuAQDwZziewZRKpSqVqrGx8dSpU1qt9sSJE/xXL1Ybc4zrOE8bfz5+4Dw9/Ck4bfbFYrHT6cSMlK4cFY3VnxxjWs50lSfPU1VWVi4sLHR2dpaVlTmdToyjF588oGKujds/a5FMTEwsLy/TE4gPAgCA38L9nP/hw4evXLmiVqvb29u1Wq3bT3cIRZDruMfG6avubU6e5/n777/pp8tu374t9N8fqz85yrQc4yq/adOmzMzMmpoatVqNWWME5YE1prfd/gEA+HfDvcaoVKrCwsKGhoYXX3yR/MgpyLfcDf7m8yjjdD5+4Px7IeH0Ng8NDVUqlTqd7oUXXiDf6enpyc7OnpiYEBqN1Z+c9U2mq/zc3Bz9NjaHw4H5dsUzD6iYQg3nqd2FGrwzUSgUIpFoaGgoLi6OIAij0ehBEAAA/AI+J9SOHTsWEhLy448/ki/T09MLCwvHx8dNJlNWVhZ1rnxmZkYsFhuNRqfTibls884772RkZJAf26urq8mnTFgveCgUitra2unpaZPJlJ+fTzoxEwRRUFAwMjJiMBh27dql0Wjcusb0Qsdut4vFYpPJRL4sLCzMy8szm80Gg+Hpp5+uqalxa09/Pkan0+3YsePcuXMo5azRent7Dxw48PPPP1utVrPZXFhYmJuby/om6ywYjUaFQlFXV2exWKanp3U63c6dO8+fP++mwW1c+DxgYrpcrvPnz6enp3d1dY2MjBQXF+t0Ok4nZtbZcVPlZtZLD0UVCfnUzuDgoMFgSE1NhesxALBO4bXGNDY2ymQyynmb1bechLI9F2o+z9PGn2xWXV3N9AOnO66jenGD7j/P6m3uRn19fXJyskQiSUpKohYhVuWs0Vj9yQWZlv/00085OTkhISGBgYGpqal1dXWsGvA/UsAzpstrbv981pjx8fHc3FyZTBYfH19VVQVrDACsU9ba2x/4F+OlBy37+vqys7MfPHiwumEBAFgDwBMT8Hf0ev22bdt8rQIAAE+A348B/JGzZ8/GxMTk5eXdv3+/oqIC89v1AAD4M/A9BvBHcnJyamtrlUqlWq0uKSk5fvy4rxUBAOAJcD0GAAAA8BbwPQYAAADwFrDGAAAAAN4C1hgAAADAW8AaAwAAAHgLWGMAAAAAbwFrDAAAAOAtYI0BAAAAvAWsMQAAAIC3gDUGAAAA8BawxgAAAADeAtYYAAAAwFvAGgMAAAB4C1hjAAAAAG8BawwAAADgLWCNAQAAALzFfwA97jUrYlcNFwAAAABJRU5ErkJggg==)

Screenshot: kobe-face.jp  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 15 September, 2020 05:34 GMT
Vulnerability Verified: 15 September, 2020 05:43 GMT
Website Operator Notified: 15 September, 2020 05:43 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 15 September, 2020 05:43 GMT
Vulnerability Fixed: 18 September, 2020 06:32 GMT