gatineau1771.rssing.com XSS vulnerability

Open Bug Bounty ID: OBB-680366 Description| Value ---|--- Affected Website:| gatineau1771.rssing.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Upserve : Reflected xss on theacademy.upserve.com

Vulnerabilty Reflected xss in https://theacademy.upserve.com. STEPS TO REPRODUCE 1. Go to https://theacademy.upserve.com/playlists/all-videos/. 2. Click on any video to watch from the playlist and capture the request in burp. 3. you have to capture the request to...

PayPal: IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/users

PayPal Business Accounts allow account owners to create multiple secondary users with specific privileges assigned to their employees. This submission identified a method that made it possible for a Business Account owner to assign secondary users from other accounts. The new secondary user would...

nordicautoel.se XSS vulnerability

Open Bug Bounty ID: OBB-679988 Description| Value ---|--- Affected Website:| nordicautoel.se Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Dropbox: [www.dropboxforum.com] - reflected XSS in search

There was a reflected XSS in the search feature for www.dropboxforum.com...

Chaturbate: No rate limit in affiliate statsapi endpoint

Brute force at affiliate statsapi Steps To Reproduce: 1. The affiliate stats api link is vulnerable to brute force https:// chaturbate.com/affiliates/apistats/?username=hackeronetestchat&token=vulnerable I've used my profile and and my token to check brute force The correct token returned with 20...

Chaturbate: [chatws25.stream.highwebmedia.com] - Reflected XSS in c parameter

Hi Team, Found that chatws25.stream.highwebmedia.com is vulnerable to reflected XSS in c parameter, we can verify it with following URL, it is also a Cloudflare filter bypass: https://chatws25.stream.highwebmedia.com/ws/007/tgpraolp/htmlfile?c=███...

lagenese.com XSS vulnerability

Open Bug Bounty ID: OBB-679706 Description| Value ---|--- Affected Website:| lagenese.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

8x8: CRLF injection agentcrm.8x8.com

The agent application was vulnerable to a response splitting attack when parsing line feed characters in a given URL...

8x8: Stored Cross Site Scripting.

Hellow team I got Stored based XSS on your web :D Here Is Step : 1. Go to https://www.easycontactnow.com/ 2. Click "Try For Free" Sign Up 3. It will told you "Enter your details to get started". So Enter your full name like : "alert1 Then put all the other details. 4. Then Confirm your id and...

8x8: Hardcoded credentials in Android App

The mobile applications contained a URL that included credentials to a third party bug capture API. Access was restricted to pushing bug information...

8x8: XSS (Cross site scripting) on https://apimgr.8x8.com

The domain apimgr.8x8.com hosted an outdated version of WSO2 Data Analytics Server...

Grammarly: Permissive CORS policy trusting arbitrary extensions origin

@foobar7 identified that misconfigurations in CORS and CSRF handling allowed malicious browser extensions, which have permission to interact with grammarly.com domain, to impersonate the user. The vulnerability was resolved with improved CSRF/CORS handling...

krakensreach.com XSS vulnerability

Open Bug Bounty ID: OBB-678658 Description| Value ---|--- Affected Website:| krakensreach.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Node.js third-party modules: [http-live-simulator] Path traversal vulnerability

Module module name: http-live-simulator version: 1.0.6 npm page: https://www.npmjs.com/package/http-live-simulator Description this vulnerability is a bypass for the one found in this report in version 1.0.5 Steps To Reproduce: 1- Install the module : npm install -g http-live-simulator 2- Run the...

Hyperledger: Brute Force of fabric-ca server admin account

fabric-ca server - Default configuration maxenrollments value -1enable outside enrollment - Listening 0.0.0.0:7054easily discoved and can be reached - No limit to wrong password try Above conditions result in brute force to CA server admin account Impact Attack gain a high-level permissioned...

ExpressionEngine: Persistent XSS via malicious license file

@unbaiat discovered that the display of the license file information was not properly sanitized leaving it vulnerable to XSS. @unbaiat gave a detailed report with step-by-step instructions for replicating, enabling a speedy resolution to the issue...

namasteplaza.com XSS vulnerability

Open Bug Bounty ID: OBB-677416 Description| Value ---|--- Affected Website:| namasteplaza.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

firmen-suchportal.de XSS vulnerability

Open Bug Bounty ID: OBB-677055 Description| Value ---|--- Affected Website:| firmen-suchportal.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

HackerOne: Missing Certificate Authority Authorization rule

Certificate Authority Authorization supported by LetsEncrypt and other CAs allows a domain owner to specify which Certificate Authorities should be allowed to issue certificates for the domain. All CAA-compliant certificate authorities should refuse to issue a certificate unless they are the CA o...