20626 matches found
Weblate: Stored XSS @ /engage/<project_slug>
Description The vulnerability concerns a Stored XSS, while it is currently to the best of my knowledge not exploitable due to limitations stated below. I thought that the issue is worth reporting anyway. Steps to reproduce 1. Change a project's name or create one to the following payload:...
Mail.ru: Make user buy items via clickjacking possibility
Clickjacking attack could allow to force user to buy some item on lootdog.io...
Mail.ru: astrumnival.com subdomain
Hostname in astrumnival.com domain was unintentionally delegated to external service. astrumnival.com domain is not currently in use...
futurerocklegends.com XSS vulnerability
Open Bug Bounty ID: OBB-713504 Description| Value ---|--- Affected Website:| futurerocklegends.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...
Mail.ru: Cross application scripting via account.mail.ru
Crossapplication scripting via User-Agent on push login confirmation functionality in mobile application in the context of account.mail.ru domain allowed session hijacking with minimal user interaction...
Mail.ru: [lootdog.io] User phone number disclosure
User phone could be self-disclosed on lootdog.io...
mrinkltd.com XSS vulnerability
Open Bug Bounty ID: OBB-712170 Description| Value ---|--- Affected Website:| mrinkltd.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...
light-nation.co.uk XSS vulnerability
Open Bug Bounty ID: OBB-712144 Description| Value ---|--- Affected Website:| light-nation.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...
VK.com: Просмотр новых фотографии со стены частной/закрытой группы или закрытого профиля.
Просмотр некоторых закрытых фотографий...
3max.co.jp XSS vulnerability
Open Bug Bounty ID: OBB-711103 Description| Value ---|--- Affected Website:| 3max.co.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...
secure.amscomputer.com XSS vulnerability
Open Bug Bounty ID: OBB-710967 Description| Value ---|--- Affected Website:| secure.amscomputer.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...
Liberapay: Publicly editable GitHub wikis
Hello team, While browsing https://github.com/liberapay I found that many of the repositories have their wikis publicly editable by any GitHub user. The following are some of the affected repositories: https://github.com/liberapay/cardregistration-js-kit/wiki...
logisticsit.com XSS vulnerability
Open Bug Bounty ID: OBB-709944 Description| Value ---|--- Affected Website:| logisticsit.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...
ticket01.pki.med.or.jp Open Redirect vulnerability
Open Bug Bounty ID: OBB-709632 Description| Value ---|--- Affected Website:| ticket01.pki.med.or.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| hidden unt...
agrotypos.gr XSS vulnerability
Open Bug Bounty ID: OBB-708570 Description| Value ---|--- Affected Website:| agrotypos.gr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...
Grab: Production secret key leak in config/secrets.yml
Summary: Production secret key leak in config/secrets.yml Description: In Github, http://engineering.grab.com/ secretkeybase is leaked which is present in the config/secrets.yml Steps To Reproduce: 1. Go to the below GitHub URL and we can verify that secretkeybase is present...
vvvvvv.industrialinfo.com Open Redirect vulnerability
Open Bug Bounty ID: OBB-707950 Description| Value ---|--- Affected Website:| vvvvvv.industrialinfo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| hidden...
samskledingactie.nl XSS vulnerability
Open Bug Bounty ID: OBB-707880 Description| Value ---|--- Affected Website:| samskledingactie.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...
QIWI: [p2p.qiwi.com] nginx alias traversal
Incorrect configuration of alias could allow an attacker to read file stored outside the target folder. https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md Пример: http GET /services/admin../html HTTP/1.1 Host: p2p.qiwi.com Можно запрашивать файлы выше, чем /services/admi...
bibliothek.edition-romiosini.de XSS vulnerability
Open Bug Bounty ID: OBB-707512 Description| Value ---|--- Affected Website:| bibliothek.edition-romiosini.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...