HubSpot Jinjava Information Disclosure Vulnerability

HubSpot Jinjava is a U.S. HubSpotn individual developers of a software application . Provides a Java-based template template engine , based on Django template syntax , suitable for rendering jinja templates . A security vulnerability exists in Jinjava. The vulnerability stems from allowing access...

hubspot.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1054477 Security Researcher tbm Helped patch 2172 vulnerabilities Received 6 Coordinated Disclosure badges Received 6 recommendations , a holder of 6 badges for responsible and coordinated disclosure, found a security vulnerability affecting hubspot.com website and its...

catholicfinanciallife-1.sites.hubspot.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-951200 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

cloudtp-1.sites.hubspot.com Open Redirect vulnerability

Security Researcher Gh05tPT Helped patch 6836 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting cloudtp-1.sites.hubspot.com website and its users...

brandwise.sites.hubspot.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-951179 Security Researcher Gh05tPT Helped patch 6899 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting brandwise.sites.hubspot.c...

appnique.sites.hubspot.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-951115 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

com.hubspot.mesos.rx.java.example:mesos-rxjava-example-framework (=0.1.0), com.hubspot.mesos.rx.java:mesos-rxjava-protobuf-client (=0.1.0) +4 more potentially affected by CVE-2018-11793 via org.apache.mesos:mesos (=1.6.1)

org.apache.mesos:mesos MAVEN version =1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mesos:mesos and may be impacted: - com.hubspot.mesos.rx.java.example:mesos-rxjava-example-framework =0.1.0 -...

au.com.skytix:mesos-scheduler-client (>=1.0.11 <=1.0.15), au.com.skytix:velocity-scheduler (>=1.0.34 <=1.0.40) +44 more potentially affected by CVE-2018-11793 via org.apache.mesos:mesos (>=0.9.0-incubating <=1.4.2)

org.apache.mesos:mesos MAVEN version =0.9.0-incubating, =1.0.11, =1.0.34, =2.1.7, =2.1.7, =2.2.0, =2.2.0, =0.0.3, =2.1.2, =2.1.2, =0.18.0, =0.1.3, =0.1.3, =0.18.0, =0.18.0, =1.5.0 and more Source cves: CVE-2018-11793 Source advisory: OSV:GHSA-P2XQ-VCM7-XJJ6...

designers.hubspot.com XSS vulnerability

Open Bug Bounty ID: OBB-611412 Description| Value ---|--- Affected Website:| designers.hubspot.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Roblox: Subdomain Takeover to Authentication bypass

Vulnerability Type: ----------- Subdomain Takeover Description: ----------- Due to unclaimed or expired Hubspot instance an attacker is able to claim and serve content from devrel.roblox.com and perform different kind of attacks which i shared in impact section. Affected Area: -----------...

HubSpot: Reflected XSS and Server Side Template Injection in all HubSpot CMSes

Really I don't know why BugCrowd team closed my submission as N/A F337815 They mentioned that Not in Scope ?! So I reported it again in another submission But this Time I messaged the Security Company Directly and triaged and Fixed in 2 Days . Full Poc : I was found in this path /hcms/cta so this...

Inflection: Unsubscribe Any User

Researcher reported that HubSpot's "unsubscribe" feature allows any user to unsubscribe from marketing emails without having to confirm their email address. Inflection does not consider this a vulnerability, as we want to make it as easy as possible for users to stop receiving marketing emails th...

hubspot.com XSS vulnerability

Vulnerable URL: https://www.hubspot.com/products/get-started?utmcampaign=hp01id=hphero" Details: Description| Value ---|--- Patched:| Yes, at 20.01.2017 Latest check for patch:| 20.01.2017 21:10 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 534 VIP website...

Drupal Hubspot CTA module cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Hubspot CTA is one of the modules that displays the Hubspot CTA button by creating a Bean block. A cross-site scripting vulnerability exists in the Drupal Hubspot CTA module that can be...

Hubspot CTA - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-012 - Unsupported

This module enables you to embed a Hubspot CTA buttons widget in a Bean block. The module allows configuration of a CTA ID and Account ID while adding a bean block for a CTA button, but doesn't sufficiently sanitise these parameters, allowing a potential cross-site scripting attack. This...

Greenhouse.io: Subdomain Takeover using blog.greenhouse.io pointing to Hubspot

Hi, Your subdomain blog.greenhouse.io is pointing to the service called Hubspot. However, your account at Hubspot has expired or has been cancelled. This basically means that anyone can claim your subdomain pointing to Hubspot and create their own site at this URL. This is EXTREMELY dangerous as...

SaaS Marketing platform Hubspot export vulnerability

Hubspot is a widely used SaaS marketing platform to email all your customers, collect data about them and attract new customers. It's is common practice to keep customer lists in Hubspot to send newsletters or other email communication. Hubspot has hardcoded roles that grant users access to vario...

Unfixed XSS vulnerability at blog.hubspot.com

Security researcher xylitol, has submitted on 07/10/2008 a cross-site-scripting XSS vulnerability affecting blog.hubspot.com, which at the time of submission ranked 139239 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/11/2008. It is...