uploadmagnet.com XSS vulnerability

Open Bug Bounty ID: OBB-693168 Description| Value ---|--- Affected Website:| uploadmagnet.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

infoabi.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-693116 Description| Value ---|--- Affected Website:| infoabi.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| hidden until disclosu...

Mail.ru: Reference to external uncontrolled resource in terrhq.ru

Domain name esrv3.wartune-fra.ext.terrhq.ru was erroneously pointing to external resource outside of organizational control. terrhq.ru domain belongs to mail.ru but is not currently used to host any resources...

Ruby on Rails: XSS by MathML at Active Storage

In Active Storage, formats treated as binary have been confirmed, It does not contain application/mathml+xml. https://github.com/rails/rails/commit/d40284b1a44773b03d78ca67a888b94fd330d1b1 In Marcel::MimeType.for, if content-type can not be determined with magic byte, since it is determined using...

sl.thetimenow.com XSS vulnerability

Open Bug Bounty ID: OBB-689235 Description| Value ---|--- Affected Website:| sl.thetimenow.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidde...

Chaturbate: Missing Rate Limitation at /photo_videos/photoset/create

Hello,I discovered that one is able to create an unlimited number of albums Via /photovideos/photoset/create/ Steps To Reproduce: 1.Login And Go to http://fr.chaturbate.co /photovideos/photoset/create/ 2.Fill the form 3.Enable a proxy interception tool e.g Burp Suite 4.Click Save 5.Send the POST...

nuggetmarket.com XSS vulnerability

Open Bug Bounty ID: OBB-688757 Description| Value ---|--- Affected Website:| nuggetmarket.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

atlanticcity.edgemedianetwork.com XSS vulnerability

Open Bug Bounty ID: OBB-688700 Description| Value ---|--- Affected Website:| atlanticcity.edgemedianetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6...

Mail.ru: [screenshot.mail.ru] CRLF Injection

CRLF injection in screenshot.mail.ru allowed to manipulate response headers...

surveymonkey.ru XSS vulnerability

Open Bug Bounty ID: OBB-687263 Description| Value ---|--- Affected Website:| surveymonkey.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

humax.com.co XSS vulnerability

Open Bug Bounty ID: OBB-687046 Description| Value ---|--- Affected Website:| humax.com.co Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...

portalkryminalny.pl XSS vulnerability

Open Bug Bounty ID: OBB-686892 Description| Value ---|--- Affected Website:| portalkryminalny.pl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

PayPal: [PayPal Android] Remote theft of user session using push_notification_webview deeplink

A deeplink feature built into the PayPal Android application failed to validate the requested endpoint. A specifically crafted request from a website or separate app on the device could call the deeplink and direct traffic to any destination. While the impact was limited by compensating controls,...

Mail.ru: ******.*****.my.com open proxy

A proxy host in my.com domain related to partner service located in external network was misconfigured as an open proxy...

classifieds.chicagotribune.com XSS vulnerability

Open Bug Bounty ID: OBB-685787 Description| Value ---|--- Affected Website:| classifieds.chicagotribune.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

Rockstar Games: Found CSRF Vulnerability in https://support.rockstargames.com/

In this report, the researcher found a CSRF vulnerability that potentially allowed an attacker to spam false support requests. This issue was resolved in a site update...

3tres3.com.pt XSS vulnerability

Open Bug Bounty ID: OBB-685623 Description| Value ---|--- Affected Website:| 3tres3.com.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Starbucks: China - president-starbucks.com.cn DNS configuration reported as takeover

k3mlol discovered that president-starbucks.com.cn was displaying Chinese gambling content, reporting it as a takeover. It was ultimately determined to be a released resource, no longer owned by Starbucks. This report was awarded a bounty in error; Future reports against this domain would not...

HackerOne: Improper UUID validation results in bypass of #419896

This was found while evaluating the vulnerability and patch identified in 419896. I determined the deployed patch to be effective. However, I noticed tracer values could be sent which didn't conform to the UUID specification as characters outside of the a-f and 0-9 ranges could be used. For...

civictechnologies.com XSS vulnerability

Open Bug Bounty ID: OBB-685414 Description| Value ---|--- Affected Website:| civictechnologies.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...