20626 matches found
takeyourjob.com Cross Site Scripting vulnerability OBB-1335404
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Visma Public: Bypassing Business ID/VAT # validation during registration to create accounts with duplicate Business ID/VAT #
The security researcher was able to bypass the Business ID/VAT validation that is required during registration. By doing this he was able to create accounts with duplicate Business ID/VAT...
Mail.ru: Path traversal lead to LFR via [CVE-2019-3394]
Path traversal lead to Local File Read via CVE-2019-3403 in confluence.plazius.ru...
Agoric: Stored XSS in agoric-sdk - malicious iframes, malicious svg
Summary: add summary of the vulnerability Steps To Reproduce: shell git clone https://github.com/Agoric/agoric-sdk.git cd agoric-sdk yarn config set "strict-ssl" false -g yarn config set "registry" "http://registry.npmjs.org/" -g yarn config set "cafile" "/etc/ssl/cert.pem" -g pipenv shell yarn...
GitLab: Adding everyone to the repo due to the lack of rate limit
Summary Since there is no rate limit in the inviting users to the repository section, it is possible to add all users on gitlab to a repository. Steps to reproduce Step-by-step guide to reproduce the issue, including: 1. Create a repository 2. go to the project members section 3. choose a random...
Mail.ru: read new emails from any inbox IOS APP in notification center
IDOR vulnerability in notification center API as used by Mail.ru Mail application for iOS allowed to request notifications for arbitrary e-mail address...
Mail.ru: Пользователь может просматривать, удалять и изменять данные любой компании перебирая domain_id [biz.mail.ru]
An IDOR vulnerability in biz.mail.ru allowed to partially manipulate billing data tax id, addresses of arbitrary company...
energyincentive.com.au Cross Site Scripting vulnerability OBB-1315829
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
thedeaddivision.com Cross Site Scripting vulnerability OBB-1313789
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
opus-series.com Cross Site Scripting vulnerability OBB-1313445
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Prototype Pollution in whitfin/dot-notes-js
Overview dot-notes is a Two way conversions between objects and dot/bracket notation. This package are vulnerable to Prototype Pollution via. the create function. Proof of Concept const dots = require'dot-notes'; dots.create, 'proto.polluted', true; console.logpolluted;...
Prototype Pollution in acstll/deep-get-set
Description deep-set-get is a Set and get values on objects via dot-notation strings. This package is vulnerable to prototype pollution. POC const deep = require'deep-get-set'; deep,'proto','polluted',true; console.logpolluted;...
susanin.com Cross Site Scripting vulnerability OBB-1312414
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Valve: Access to microtransaction sales data for lots of apps from 2014 to present at /valvefinance/sanity/
The Steamworks Product Data web site had an URL route with insufficient access controls, which would allow an authenticated partner to view data for games which they might not otherwise have permissions to view. After mitigation, an audit of accesses to this URL route showed no accesses by partie...
edoniaworld.com Cross Site Scripting vulnerability OBB-1305374
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Shopify: User sensitive information disclosure
1、open shopify指南 Applets 2、click 个人中心 3、click 编辑资料 微信图片20200905123248.png 4、https://api-wechat.shopify.cn/api/sp/customer/id 1.png 5、Modify the ID value to traverse the user information Impact User sensitive information disclosur...
Mail.ru: Account Takeover possibility via https://awards.donationalerts.com using login with twitch.tv
Authentication procedure with twitch.tv oAuth allowed account takeover on awards.donationalerts.com...
Mail.ru: [my.games, lootdog.io] XSS via MCS Bucket
Proxy pass for the path in my.games and lootdog.io domains was misconfigured to point to the root of public S3 storage, allowing to place static content in the domain path leading to XSS possibility...
loja.musicaemovimento.com.br Cross Site Scripting vulnerability OBB-1299801
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...