U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @eugui was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @mthirup was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Misconfigured password reset vulnerability on a DoD website

A Department of Defense website was mis-configured such that the password reset function could be bypassed to change a user's password. @mthirup was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @mthirup!...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @korprit was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @korprit was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Server-side include injection vulnerability in a DoD website

A Department of Defense website was vulnerable to a Server-Side Include Injection attack which could have allowed an attacker to inject code into HTML pages or, under some circumstances, perform remote code execution. @jutsuce was as able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @swissky was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @korprit was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @korprit!...

U.S. Dept Of Defense: Attackers can control which security questions they are presented (████████)

Summary: When clicking on the forgot password link on ██████, the questions used to verify identify can be arbitrarily selected by an attacker. Description: When clicking on the forgot password link on ██████████, the questions used to verify identify can be arbitrarily selected by an attacker...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @korprit was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @korprit!...

U.S. Dept Of Defense: HTML injection vulnerability on a DoD website

An HTML injection vulnerability was found on a Department of Defense website which may have been used to trick a web user into viewing modified web content, potentially revealing a user's web session information, or other sensitive information. @kunalkhubchandani was able to demonstrate this...

U.S. Dept Of Defense: Cross-site request forgery (CSRF) vulnerability on a DoD website

A cross-site request forgery vulnerability was found on a Department of Defense website which could trick a web user into posting or changing confidential information, or redirecting sensitive information to the malicious user. @korprit was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: Server side information disclosure on a DoD website

A misconfigured Department of Defense webserver improperly disclosed application information. @sulemanmalik03 was able to demonstrate this vulnerability by crafting specially formatted URLs...

U.S. Dept Of Defense: Cross-site request forgery vulnerability on a DoD website

A cross-site request forgery vulnerability was found on a Department of Defense website which could trick a web user into posting or changing confidential information, or redirecting sensitive information to the malicious user. @korprit was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: DOM Based XSS on an Army website

A U.S. Army website was vulnerable to a DOM based cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. juliocesar was able to demonstrate this vulnerability by crafting a speciall...

U.S. Dept Of Defense: Reflected cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ahsantahir was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: File upload vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that may have allowed an attacker to bypass tests for malicious files when uploading content. @korprit was able to demonstrate this vulnerability by altering the file sufficiently to defeat signature based analysis. Thanks @korprit!...

CVE-2016-9209

A vulnerability in TCP processing in Cisco FirePOWER system software could allow an unauthenticated, remote attacker to download files that would normally be blocked. Affected Products: The following Cisco products are vulnerable: Adaptive Security Appliance ASA 5500-X Series with FirePOWER...

MS16-155: Description of the Security Only Update for the .NET Framework 4.6.2 for Windows 7 and Windows Server 2008 R2: December 13, 2016

MS16-155: Description of the Security Only Update for the .NET Framework 4.6.2 for Windows 7 and Windows Server 2008 R2: December 13, 2016 View products that this article applies to. Summary This update resolves vulnerabilities in the Microsoft .NET Framework. A security vulnerability exists in t...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @juliocesar was able to demonstrate this vulnerability by crafting a...