yellowpages.dk XSS vulnerability

Open Bug Bounty ID: OBB-701883 Description| Value ---|--- Affected Website:| yellowpages.dk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

OLX: blog.praca.olx.pl database credentials exposure

Hi, I found that the site blog.praca.olx.pl is exposing the content of wp-config.php file in plaintext due that a misconfiguration in the file-manager plugin. The information can be accessed here: http://blog.praca.olx.pl/wp-content/uploads/file-manager/log.txt The credentials are stored in the...

ok.ru: Отсутствие CSRF ключа на функции Закрытый Профиль.

"Friends only" account mode could be toggled on and off with a CSRF attack. Настройка Закрытый профиль могла быть включена или выключена через CSRF...

subitoriparo.com XSS vulnerability

Open Bug Bounty ID: OBB-701230 Description| Value ---|--- Affected Website:| subitoriparo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

npochannel.org XSS vulnerability

Open Bug Bounty ID: OBB-701177 Description| Value ---|--- Affected Website:| npochannel.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

guggizunft.ch XSS vulnerability

Open Bug Bounty ID: OBB-700918 Description| Value ---|--- Affected Website:| guggizunft.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

U.S. Dept Of Defense: SQL Injection in Login Page: https://█████/█████████/login.php

Summary: I believe I've discovered an error based SQL injection in the login page for https://████/██████/login.php. Description: When browsing to the webpage https://█████/██████/login.php and entering certain control characters into the "Username" field, and SQL error Oracle is produced. Impact...

fancybingo.com XSS vulnerability

Open Bug Bounty ID: OBB-699999 Description| Value ---|--- Affected Website:| fancybingo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

numai-cele-bune.ro XSS vulnerability

Open Bug Bounty ID: OBB-699781 Description| Value ---|--- Affected Website:| numai-cele-bune.ro Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...

25stanley.com XSS vulnerability

Open Bug Bounty ID: OBB-699455 Description| Value ---|--- Affected Website:| 25stanley.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

fashionservicenetwork.com XSS vulnerability

Open Bug Bounty ID: OBB-699450 Description| Value ---|--- Affected Website:| fashionservicenetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score...

ionsecurednetworks.com XSS vulnerability

Open Bug Bounty ID: OBB-699331 Description| Value ---|--- Affected Website:| ionsecurednetworks.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

imobiliarecora.ro XSS vulnerability

Open Bug Bounty ID: OBB-699307 Description| Value ---|--- Affected Website:| imobiliarecora.ro Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidde...

alpine56492.rssing.com XSS vulnerability

Open Bug Bounty ID: OBB-699145 Description| Value ---|--- Affected Website:| alpine56492.rssing.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

civicresearchinstitute.com XSS vulnerability

Open Bug Bounty ID: OBB-699050 Description| Value ---|--- Affected Website:| civicresearchinstitute.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

Mail.ru: [o2.mail.ru] nginx alias traversal

Invalid nginx configuration allowed limited path traversal in o2.mail.ru...

GitLab: EXIF metadata not stripped from JPG group logos

Summary: When uploading JPEG images as group logos on Gitlab, the EXIF metadata is not removed or changed in any way. Description: When setting up a group on Gitlab, you can upload a logo, and if you upload a JPEG with EXIF metadata on it, it isn't stripped. This can lead to disclosure of locatio...

QIWI: https://teamplay.qiwi.com/ накрутка баллов => финансовые убытки для компании

Накрутка баллов в teamplay.qiwi.com...

bucksmethod.com XSS vulnerability

Open Bug Bounty ID: OBB-698528 Description| Value ---|--- Affected Website:| bucksmethod.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Starbucks: Starbucks China Android app cloud storage service leaks a credential.

k3mlol found a credential encoded in the Starbucks China mobile application for Android phones, which provided access to a cloud-hosted service that was used to upload information for customer service requests. This credential allowed for read/write access. The credential has since been disabled,...