20626 matches found
Mail.ru: NPM_API_KEY Leak
Sensitive application configuration data related to samokat.ru was leaked on github.com...
jbiomed.org Cross Site Scripting vulnerability OBB-1238741
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
projectsmart.co.uk Cross Site Scripting vulnerability OBB-1238487
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
proilim.ru Cross Site Scripting vulnerability OBB-1236702
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Mail.ru: cross site scripting bypass session
Reflected XSS in cloud.mail.ru via cookie value...
IBM: CVE-2020-3452 Cisco ASA / Firepower Read-Only Path Traversal Vulnerability - https://esccvc.de.ibm.com
A vulnerability in the interface of Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense FTD was reported to IBM, analyzed and have been remediated. Thank you to Khaled 0xelkomy...
lemlist: CVE-2019-19935 - DOM based XSS in the froala editor
Summary: A stored XSS flow exist in the froala editor used in the web application. This can be trigger by using the code view of the editor Steps To Reproduce: 1. Start a new campaign 2. fill all the fieds and choose blank email template for the message 3. Switch to code editor view and inject "...
Mail.ru: Information Disclosure on qa-delivery-srv.plazius.ru
Performance metrics were available at qa-delivery-srv.plazius.ru...
careerbliss.com Cross Site Scripting vulnerability OBB-1235710
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
HackerOne: Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS.
@spongebhav identified a vulnerability that let a victim believe their program membership wasn't shown on their profile, when in reality, it was. This could be used to identify system users of a program when the program blocked this...
Mail.ru: [performancemarketing.geekbrains.ru] Tilda Subdomain Takeover
Unused subdomain of geekbrains.ru was delegated to tilda.cc and unclaimed...
christopherbogush.com Cross Site Scripting vulnerability OBB-1231936
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
konditorei-buchmann.ch Cross Site Scripting vulnerability OBB-1229173
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
pef.upr.si Cross Site Scripting vulnerability OBB-1229154
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Mail.ru: Bypass OTP on contact back request at https://driver.city-mobil.ru/
It was possible to bypass phone verification for support call back request...
BugPoC: Improper use of "path" parameter can be used to trick testers into leaking their Front-End PoC
Summary: In https://bugpoc.com/testers/front-end, the populateFromFragment function incorrectly assigns hash parameter path to the subdomain element, allowing the "Test" functionality of the Front-End PoC Generator to open a popup on any domain instead of the expected web.bugpoc.ninja. It can be...
MTN Group: [play.mtn.co.za] Application level DoS via xmlrpc.php
Description Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DOS/SSRF. The website play.mtn.co.za has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. hackeron...
laperchediffusion.fr Cross Site Scripting vulnerability OBB-1227458
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
MTN Group: xss on [developers.mtn.com]
xss on history.pushState'', '', '/' F908897 Impact POC F908895 F908896...
U.S. Dept Of Defense: Blind Stored XSS on the internal host - █████████████
The vulnerability was a blind stored XSS on an internal host. The payload was triggered from the endpoint https://███████████████/NSSI/controlcenterV2/index.htm?directlink&courses/classes/findstudent&&&&&&&& and was found in the Referer header. The vulnerable URL was not accessible from outside t...