U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @psychomantis!...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @vagmour was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks to @vagmour for discovering this...

U.S. Dept Of Defense: Critical information disclosure at https://█████████

Summary: There is a critical information disclosure at https://████████/rserver/rdPage.aspx?rdReport=dbDashboard&rdShowModes= Description: As you can see in the video the https://████████/rserver/rdPage.aspx?rdReport=dbDashboard&rdShowModes= loads a page with a debug this page functions enabled,...

SAP ERP Defence Forces and Public Security Remote Authentication Bypass Vulnerability

SAP ERP is a set of integrated enterprise resource planning system based on customer/server structure and open system from SAP, Germany. The system supports custom reports, standardized processes and automated execution of business processes. An authentication bypass vulnerability exists in SAP E...

SAP ERP Defence Forces and Public Security Remote Authentication Bypass Vulnerability

SAP ERP is a set of integrated enterprise resource planning system based on customer/server structure and open system from SAP, Germany. The system supports custom reports, standardized processes and automated execution of business processes. An authentication bypass vulnerability exists in SAP E...

U.S. Dept Of Defense: Privilege Escalation on a DoD Website

A Department of Defense website was exposed to a privilege escalation vulnerability, which could have allowed remote administrator access to the website. Thanks to @vagmour for discovering this vulnerability!...

U.S. Dept Of Defense: Reflected XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @mantis was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: HTML Injection on ████

Summary: HTML Injection vulnerabilities on █████████ Air Base Site. Description: Search value are output without being escaped. HTML Injection via Category parameter...

U.S. Dept Of Defense: Misconfigured user account settings on DoD website

A Department of Defense website was misconfigured in a manner that may have allowed a malicious user to reset, or steal login credentials of legitimate users. @mantis was able to demonstrate this vulnerability by testing the user account application of the website. Thanks @mantis!...

SA139 : November 2016 NTP Security Vulnerabilities

SUMMARY Symantec Network Protection products using affected versions of the NTP reference implementation from ntp.org are susceptible to multiple vulnerabilities. A remote attacker can modify the targets system time, prevent the target from synchronizing its time, cause denial of service through...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @hassaan was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @hassaan!...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A misconfigured Department of Defense webserver improperly disclosed application information. @joshualaurencio was able to demonstrate this vulnerability by crafting specially formatted URLs...

U.S. Dept Of Defense: Local file inclusion vulnerability on a DoD website

A misconfigured Department of Defense website may have allowed unauthorized users to remotely download local files, potentially revealing sensitive system or user information. @fransrosen was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Blind SQLi in a DoD Website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive financial information. @akaki was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you!...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information. Thank you @sp1d3rs for notifying us of this! It was a trivial Full Path Disclosure issue, but still worth reporting...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information. Thank you @sp1d3rs for notifying us of this! It was a trivial Full Path Disclosure issue, but still worth reporting...

U.S. Dept Of Defense: Exposed Access Control Data Backup Files on DoD Website

A Department of Defense website was mis-configured to expose access control data backup files, and potentially the personal information of its users. Thanks for notifying us of this, @mazen160!...

U.S. Dept Of Defense: HTML Injection/Load Images vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that may have allowed a malicious user to inject remote content into a website. @jonbottarini was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @jonbottarini!...

U.S. Dept Of Defense: SQL injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @shakaa1 was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @shakaa1!...

U.S. Dept Of Defense: Password reset vulnerability on a DoD website

A password reset vulnerability was found on a DoD website, which could have allowed a malicious user to identify legitimate users and arbitrarily reset their passwords. @sp1d3rs was able to demonstrate this vulnerability by accessing a DoD webpage. Thanks @sp1d3rs!...