Mail.ru: Stored XSS in api.icq.net

Crossite scripting in api.icq.net domain. icq.net is considered as a sandbox domain, it does not use HTTP authentication or cookies, but XSS could be used to facilitate phishing attack...

aiace.nl XSS vulnerability

Open Bug Bounty ID: OBB-628225 Description| Value ---|--- Affected Website:| aiace.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

surigids.com XSS vulnerability

Open Bug Bounty ID: OBB-627980 Description| Value ---|--- Affected Website:| surigids.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Liberapay: A single user can subscribe a community multiple times

There is no proper validation while subscribing for a community. A user can subscribe a single community multiple times. Steps to recreate: Step 1: Open any community Step 2: Click on subscribe button Step 3: Capture the POST request and submit it multiple times Step 4: Check the subscription cou...

Mail.ru: XSS https://health.mail.ru/my/ через внешнее имя аккаунта

Здравствуйте. Раньше репортил багу связанную с ником в одноклассниках так вот нашел еще одно место. На мобильной версии https://health.mail.ru/my/ в никнейме мы можем видеть self-stored xss. F305597 Так выглядит имя: F305599 Impact XSS...

Node.js third-party modules: Arbitrary File Write Through Archive Extraction

I would like to report arbitrary file write vulnerability in adm-zip module It allows attackers to write arbitrary files when a malicious archive is extracted. More info here: https://snyk.io/research/zip-slip-vulnerability https://github.com/snyk/zip-slip-vulnerabilityaffected-libraries Module...

servedby.flashtalking.com XSS vulnerability

Open Bug Bounty ID: OBB-627416 Description| Value ---|--- Affected Website:| servedby.flashtalking.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Liberapay: REGISTRATION USING FAKE EMAIL ACCOUNT

Go to page https://liberapay.com/sign-up 2. Input email address I tried to register with some email address [email protected] [email protected] [email protected] [email protected] [email protected] 3. Select the currency you want to use 4. click "GO" button 5. Will automatically enter into account without going through the process of verification email...

Open-Xchange: [SSRF] PDF documentconverterws

Hi. Previous report 260576 Example: F305199 /ppt/slides/rels/slide1.xml.rels: xml Result: F305196 Impact Scan network Read any file file:///home/example/test.odf...

Liberapay: csrf token did not changed after login/logout many times

hello team, your csrf token did not expired and after login and logout many times , i found that your csrf token is generated same as last one. Impact if an attacker found an xss on your domain and you fixed it but attacker still has csrf token of user, attacker can use it to perform any action...

vietnam.masta.fr XSS vulnerability

Open Bug Bounty ID: OBB-625653 Description| Value ---|--- Affected Website:| vietnam.masta.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

GSA Bounty: Multiple Bugs in api.data.gov/signup endpoint leads to send custom messages to Anyone

Hey there, while signing for new api key, i have found two bugs that is unusual and make anyone to send crafted or customised email to someone. Bug 1: - low 1. Go to https://api.data.gov/signup/ 2. Enter first and last name , then enter email id and get api key. Bug: You can use the same email id...

zipy.co.il XSS vulnerability

Open Bug Bounty ID: OBB-624724 Description| Value ---|--- Affected Website:| zipy.co.il Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Node.js third-party modules: [serve] Server Directory Traversal

I would like to report a Server Directory Traversal vulnerability in serve. It allows reading local files on the target server. Module module name: serve version: 7.0.1 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...

erygi42lxye3x93s11zt8kf1-wpengine.netdna-ssl.com XSS vulnerability

Open Bug Bounty ID: OBB-622797 Description| Value ---|--- Affected Website:| erygi42lxye3x93s11zt8kf1-wpengine.netdna-ssl.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79...

Valve: Deleting other people's comments on ModeratorMessages

Due to a missing permissions check, anyone could delete a comment on a community moderator message knowing the unique comment GID and the SteamID of the message receiver. The endpoint has been corrected to verify the correct permissions. You were able to delete others people's comments on moderat...

trophylakesacademy.org XSS vulnerability

Open Bug Bounty ID: OBB-622394 Description| Value ---|--- Affected Website:| trophylakesacademy.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

maeva.com XSS vulnerability

Open Bug Bounty ID: OBB-622219 Description| Value ---|--- Affected Website:| maeva.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

laplanche.fr XSS vulnerability

Open Bug Bounty ID: OBB-622119 Description| Value ---|--- Affected Website:| laplanche.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...

viellesegure.fr XSS vulnerability

Open Bug Bounty ID: OBB-621680 Description| Value ---|--- Affected Website:| viellesegure.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...