U.S. Dept Of Defense: File upload vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that may have allowed an attacker to bypass tests for malicious files when uploading content. @korprit was able to demonstrate this vulnerability by altering the file sufficiently to defeat signature based analysis. Thanks @korprit!...

U.S. Dept Of Defense: Information disclosure on a DoD website

A Department of Defense website was misconfigured to disclose potentially sensitive system and user information. @mr47 was able to demonstrate this vulnerability by requesting specific web files. Thanks @mr47!...

Legal Robot: S3 ACL misconfiguration

Summary: Legal Robot's s3 bucket legalrobot.com is misconfigured. The ACL allows me to access and copy all files. This means that I could go through and copy all the media files on the s3 bucket. I did not attempt to delete any files as I did not want to go too far and affect your operations. Ste...

U.S. Dept Of Defense: Violation of secure design principles on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about a user. @spam404 was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability! Passwords stored in cleartext...

U.S. Dept Of Defense: Arbitrary Script Injection (Mail) in a DoD Website

A DoD website was misconfigured in a manner that could have allowed an attacker to inject malicious code into automated emails sent by the server. @ahsantahir was able to demonstrate this vulnerability by posting a specially formatted webform. Thanks @ahsantahir!...

U.S. Dept Of Defense: Arbitary file download vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application or system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!...

U.S. Dept Of Defense: Information disclosure on a DoD website

A Department of Defense website was misconfigured to disclose potentially sensitive system and user information. @r0p3 was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @r0p3!...

U.S. Dept Of Defense: DNS Misconfiguration

Multiple reporters identified a DNS configuration issue in the defense.gov domain that could allow same-site scripting. Thanks to @myst404 for first reporting this, and to @atik-rahman and others for also reporting it...

U.S. Dept Of Defense: Information disclosure vulnerability in a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about user sessions. @r0p3 was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Information leakage on a Department of Defense website

A Department of Defense website was misconfigured to disclose potentially sensitive system and user information. korprit was able to demonstrate this vulnerability by requesting a particular webpage and logfile. Thanks korprit!...

U.S. Dept Of Defense: RCE on a Department of Defense website

A misconfigured webserver hosted by the Department of Defense allowed the execution of local shell commands. dawgyg was able to demonstrate this vulnerability by crafting a particularly formatted URL. Thanks dawgyg!...

Boozt Fashion AB: Cookie Misconfiguration

Hello, Great Day, I just want to Inform You that i Founded an Misconfiguration in your Website with android app. Steps to Reproduce ==================== 1.Login in to your Website https://www.boozt.com/login 2.Login with same account on android 3.Change Password ion Website 4.As You See That pass...

Shopify: Misconfiguration in Two Factor Authorisation

Hey There seems to be a weird misconfiguration which leads to bypass of two factor authorisation Scenario 1. Let's assume you have setup Two Factor Authorisation with Google Authenticator 2. You now activate Google Apps from Login services at https://shop-1.myshopify.com/admin/settings/account 3...

GitLab: Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com

Hi, Previously a blog post went out about Uber's Sendgrid issues: http://blog.pentestnepal.tech/post/149985438982/reading-ubers-internal-emails-uber-bug-bounty Also, a report from @uranium238 went out due to a similar issue with Slack that I know uses Mailgun: https://hackerone.com/reports/163938...

Broken CORS

Overview Affected versions of sails have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious...

Aternity version 9 vulnerable to cross-site scripting and remote code execution

Overview The Aternity webserver, version 9 and prior, is reportedly vulnerable to cross-site scripting XSS on several web pages, and remote code execution via inclusion of untrusted functionality by default due to improper authentication before execution. Description CWE-80: Improper Neutralizati...

The vulnerability of the Microsoft Office software package, which allows a hacker to bypass the ASLR protection mechanism

The vulnerability of the Click-to-Run package for Microsoft Office programs is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the ASLR protection mechanism by using a specially created application...

Zomato: CSRF in the "Add restaurant picture" function

Overview I found a CSRF vulnerability within the process responsible for adding photos for a restaurant which can lead to tricking victims into adding arbitrary photos to their restaurant's page. Details The CSRF vulnerability exists due to a misconfiguration on your part in which your X-CSRF-TOK...

Zomato: CORS Misconfiguration on www.zomato.com

The website at https://www.zomato.com tries to use Cross-Origin Resource Sharing CORS to allow cross-domain access from all subdomains of zomato.com. However, due to a flaw in the implementation, it actually allows cross-domain access from all domains ending in zomato.com including notzomato.com ...

Legal Robot: 2 vulns

the first report is concerning AWS S3 bucket Readable for authenticated aws users , the same as this report 163476 the bucket is sdk.amazonaws.com , i believe it's yours because i found it in a Head request to https://app.legalrobot.com/ : F115189 listing the bucket : 115190 i don't have any...