HackerOne: information disclosure of another company bug on video.

An information disclosure vulnerability was discovered in a company's system and reported on a bug bounty platform. The vulnerability allowed access to sensitive information about the company and its subdomain. The vulnerability was disclosed publicly, potentially causing harm to the affected...

LFI in module invoice-print and print

The parameter page and invoiceType is not properly sanitize leads to Local file inclusion POC : http://demo.bumsys.org/invoice-print/?invoiceType=../../theme/rui/print&msg=; POC : http://demo.bumsys.org/print/?page=../../theme/rui/invoice-print&msg=;...

dmbshop.it Cross Site Scripting vulnerability OBB-3203094

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

LY Corporation: Reflected XSS on https://travel.line.me

A reflected cross-site scripting vulnerability was identified in the search feature of the travel platform at https://travel.line.me. JavaScript code in the search parameters was reflected back to the user...

goodday.work Cross Site Scripting vulnerability OBB-3199797

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

marfinitecanela.com.br Cross Site Scripting vulnerability OBB-3197311

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

taufkirchen.more-rubin1.de Cross Site Scripting vulnerability OBB-3196615

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

klinickalogopedie.cz Cross Site Scripting vulnerability OBB-3195679

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

styriarte.com Cross Site Scripting vulnerability OBB-3194146

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

stored HTML-Injection in the Comments Part

i was able to detect a stored HTML Injection by answering available questions. Lets see : ------------ AHMED HASSAN STORED HTML INJECTION 1 will now answer a question Comment sent lets see the stored HTML Injection As you can see the stored HTML Injection is working. Thanks for watching...

spscommerce.com Cross Site Scripting vulnerability OBB-3193834

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

innova-travel.cz Cross Site Scripting vulnerability OBB-3192660

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

j-hotel.net Cross Site Scripting vulnerability OBB-3192637

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kh-freiburg.de Cross Site Scripting vulnerability OBB-3192186

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

U.S. Department of State: LDAP anonymous access enabled at certrep.pki.state.gov:389

LDAP anonymous access was enabled on the subdomain certrep.pki.state.gov, allowing unauthorized access to the LDAP server...

courses.icpme.us Cross Site Scripting vulnerability OBB-3185855

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

akultalkies.com Cross Site Scripting vulnerability OBB-3185565

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

holidayhome.pl Cross Site Scripting vulnerability OBB-3182654

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

LinkedIn: Attacker can unpin posts from companies he's not part of.

Vulnerability description not provided...

GET based CSRF on delete user functionality

Description The /account/delete functionality is vulnerable to CSRF. In this way, an attacker can trick the victim to delete his own account just clicking on the link. Steps to reproduce - Login with a user - Now go here: https://app.wallabag.it/account/delete - The account is now deleted without...