U.S. Dept Of Defense: DNS Misconfiguration

Multiple reporters identified a DNS configuration issue in the defense.gov domain that could allow same-site scripting. Thanks to @myst404 for first reporting this, and to @atik-rahman and others for also reporting it...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @r0p3 was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Information disclosure vulnerability in a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about user sessions. @r0p3 was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Information leakage on a Department of Defense website

A Department of Defense website was misconfigured to disclose potentially sensitive system and user information. korprit was able to demonstrate this vulnerability by requesting a particular webpage and logfile. Thanks korprit!...

U.S. Dept Of Defense: SQL Injection vulnerability on a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive financial information. korprit was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks korprit!...

U.S. Dept Of Defense: Insecure direct object reference vulnerability on a DoD website

A Department of Defense website was vulnerable to an insecure direct object reference vulnerability IDOR which may allow an attacker to modify web content or certain database parameters. @uranium238 was able to demonstrate this vulnerability by manipulating web objects in a particular way. Very...

U.S. Dept Of Defense: Stored cross site scripting (XSS) vulnerability on a DoD website

A stored cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ahsantahir was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: Out-of-date Version (Apache)

URL https://████████/ Identified Version 2.2.15 contains 4 important and 10 other vulnerabilities Latest Version 2.2.31 Vulnerability Database Result is based on 27.10.2016 vulnerability database content. Vulnerability Details Link identified you are using an out-of-date version of Apache. Impact...

U.S. Dept Of Defense: XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ramsexy was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ramsexy was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Unrestricted File Upload

A Navy system had a file upload tool accessible from the Internet. This would have permitted an attacker to upload malicious files and potentially execute code on the server. Thanks to @hogarth45 for reporting it...

U.S. Dept Of Defense: Cross-site scripting vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @r0p3 was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting XSS vulnerability was found on a Department of Defense. XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ juliocesar able to demonstrate this vulnerability b...

ntpd broadcast mode replay defense denial of service vulnerability

Network Time Protocol NTP is a protocol used to synchronize a computer's time to its server or clock source e.g., quartz clock, GPS, etc.. Synchronizing a computer's clock to UTC ensures that data interactions in a network can proceed smoothly.NTPD Network Time Protocol daemon is an operating...

U.S. Dept Of Defense: Reflected XSS on a Department of Defense website

A Department of Defense website was vulnerable to a reflected cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. juliocesar was able to demonstrate this vulnerability by craftin...

U.S. Dept Of Defense: RCE on a Department of Defense website

A misconfigured webserver hosted by the Department of Defense allowed the execution of local shell commands. dawgyg was able to demonstrate this vulnerability by crafting a particularly formatted URL. Thanks dawgyg!...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @korprit was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Reflected XSS on an Army website

A U.S. Army website was vulnerable to a cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. juliocesar was able to demonstrate this vulnerability by crafting a specially formatte...

U.S. Dept Of Defense: Information disclosure on a DoD website

A Department of Defense website was mis-configured in a manner that could have exposed personal account information. @tsug0d was as able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us! LDAP Injection...

U.S. Dept Of Defense: Unrestricted File Download / Path Traversal

A misconfigured USTRANSCOM website allowed arbitrary system files to be downloaded. ziot was able to demonstrate this vulnerability by downloading a file from a specially crafted URL. Thanks ziot!...