compoundsearch.com XSS vulnerability

Open Bug Bounty ID: OBB-557428 Description| Value ---|--- Affected Website:| compoundsearch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

gr.investing.com XSS vulnerability

Open Bug Bounty ID: OBB-556894 Description| Value ---|--- Affected Website:| gr.investing.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

profactum.com XSS vulnerability

Open Bug Bounty ID: OBB-556122 Description| Value ---|--- Affected Website:| profactum.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure based...

mrs.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-554745 Description| Value ---|--- Affected Website:| mrs.org.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure based on...

HackerOne: Information Disclosure which violate program privacy

Summary: please refer to the following report: https://hackerone.com/reports/311289 It was noticed that TTS changed the summary and set the domain to example.gov as not to reveal to the public. But at the bottom of the page, "britta changed the scope from https://ci.fr.cloud.gov to None."...

quan.coderschool.cn XSS vulnerability

Open Bug Bounty ID: OBB-554250 Description| Value ---|--- Affected Website:| quan.coderschool.cn Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

emeraldgrouppublishing.com XSS vulnerability

Open Bug Bounty ID: OBB-554204 Description| Value ---|--- Affected Website:| emeraldgrouppublishing.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

kensawada.com XSS vulnerability

Open Bug Bounty ID: OBB-553473 Description| Value ---|--- Affected Website:| kensawada.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Mail.ru: IDOR on mcs.mail.ru

CSRF tokens were static, CSRF token for arbitrary user's account can be obtained. No direct security implications were found, since token is transmitted in request headers and can not be sent crossite, but using static tokens was considered as a bad security practice. mcs.mail.ru was not in bug...

Mail.ru: [mobs.mail.ru] nginx path traversal via misconfigured alias

Domain, site, application -- mobs.mail.ru Steps to reproduce -- http://mobs.mail.ru/media../mobs/settings.py Actual results -- py ... SECRETKEY = '████████████' ... DISTIMOPRIVATEKEY = '████████████' ... PoC, exploit code, screenshots, video, references, additional resources --...

gresik.cz XSS vulnerability

Open Bug Bounty ID: OBB-552041 Description| Value ---|--- Affected Website:| gresik.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

WePay: Reflected XSS in the IE 11 / Edge (latest versions) on the stage-go.wepay.com

Description Hello. I discovered Reflected XSS on the stage-go.wepay.com. Browsers & OS tested The XSS checked in the latest IE 11 and Edge on Windows 7. Not checked on Windows 10. POC IE 11 or Edge...

correctsearch.com XSS vulnerability

Open Bug Bounty ID: OBB-551044 Description| Value ---|--- Affected Website:| correctsearch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Urban Dictionary: See details of a unpublished word by guessing the word ID

https://www.urbandictionary.com/remove.form.php?reconsider%5Bdefidtoremove%5D=$id$ Example Word : https://www.urbandictionary.com/remove.form.php?reconsider%5Bdefidtoremove%5D=12504202 Impact Its is minor information disclosure in which any one see details of an unpublished word...

Node.js third-party modules: Prototype pollution attack (merge-recursive)

As discussed in 309391, here's the separate report for each of the library. This one is the information for the merge-recursive library. Module: merge-recursive Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control...

Node.js third-party modules: Prototype pollution attack (deep-extend)

As discussed in 309391, here's the separate report for each of the library. This one is the information for the deep-extend library. Module: deep-extend Summary: Utilities function in all the listed modules can be tricked into modifying the prototype of "Object" when the attacker control part of...

GSA Bounty: CI for [example.gov] can be logged in and accessible

When anyone searched a public search engine for inurl:example.gov where example.gov was one of the URLs in the TTS Bug Bounty scope, the search results included a CI/CD build results URL. When anyone visited that build results page, they were faced with a login page, but if they clicked "log in",...

roberto-romero.com XSS vulnerability

Open Bug Bounty ID: OBB-550492 Description| Value ---|--- Affected Website:| roberto-romero.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Mail.ru: Хранимая XSS ( API )

Stored XSS via saved signature in Mail.Ru Mail mail compose functionality...

charteroak.org XSS vulnerability

Open Bug Bounty ID: OBB-550346 Description| Value ---|--- Affected Website:| charteroak.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...