Topcoder: Blind stored XSS due to insecure contact form at https://www.topcoder.com leads to leakage of session token and other PII

Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://www.topcoder.com/contact-us/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets...

U.S. Dept Of Defense: PII/PHI data available on web https://████████Portals/22/Documents/Meetings

Summary: https://███Portals/22/Documents/Meetings contains many internal documents which likely were reviewed on meeting/meetings preparations which should not be available for public but searchable via google/bing. Documents include: resumes, bio data form, emails including history of medical...

U.S. Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs

A well-organized Nigerian crime ring is exploiting the COVID-19 crisis by committing large-scale fraud against multiple state unemployment insurance programs, with potential losses in the hundreds of millions of dollars, according to a new alert issued by the U.S. Secret Service. A memo seen by...

U.S. Dept Of Defense: SSN is exposed on slides, previous critical report was not fixed in an appropriate way

Summary: SSN is exposed on slides, previous critical report was not fixed in an appropriate way Description: 1. SSN is exposed on a screenshot. Slide 13th. SSN is covered by an olive/green rectangle which is moveable. The image itself was not updated. ██████wp-content/uploads/2018/12/████████ 2...

teamster.app GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1158126 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

U.S. Dept Of Defense: Support incident can be opened for any user via /███████ and PII leak via █████████ field

Summary: A malicious user can open an incident for any user via the ████/████████ page. This would allow the attacker to trick the victim into taking actions such as clicking a link or opening a file that has been attached to the incident. Impact A victim could be tricked into visiting a link,...

play.google.com GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1157845 Security Researcher moonbaba Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting play.google.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the I...

www1.oab.org.br GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1157778 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

blocs.xarxanet.org GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1154831 Security Researcher a13h1 Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges Received 5 recommendations , found a security vulnerability affecting blocs.xarxanet.org website and its users. Following coordinated and responsible vulnerability...

Zomato: Page has a link to google drive which has logos and a few customer phone recordings

Description: Go to ███████ Refer to the screenshot below ██████ As you can see in the above image, there is is link to access zomato logos.This redirected me to a google drive page which not only had logos but also customer care recordings where sensitive information like Customer mobile...

sberbank-uploads.chatbot.ba GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1146386 Security Researcher dubstard Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting sberbank-uploads.chatbot.ba website and its users. Following coordinated and responsible vulnerability disclosure...

Lollipopz - Data Exfiltration Utility For Testing Detection Capabilities

Data exfiltration utility used for testing detection capabilities of security products. Obviously for legal purposes only. Exfiltration How-To /etc/shadow - HTTP GET requests Server ./lollipopz-cli.py -m lollipopz.methods.http.paramcipher.GETServer -lp 80 -o output.log Client $ ./lollipopz-cli.py...

Quick wins with Adobe Experience Manager

Introduction Adobe Experience Manager AEM, is a comprehensive content management solution for building websites, mobile apps and forms. And it makes it easy to manage your marketing content and assets. If you've ever looked into AEM you may have heard of Mikhail Egorov @0ang3el. He has done some...

cknuckles.com GDPR PII Exposure vulnerability

Open Bug Bounty ID: OBB-1119636 Security Researcher MrBug Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting cknuckles.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO...

U.S. Dept Of Defense: Improper Access Controls Allow PII Leak via ████

Summary: Dashboards in ██████████ allow a user to add widgets and obtain large amounts of information to include PII and diagnostic information. Additionally, a user is able to make changes to certain catalogs via these widgets. Description: Impact An adversary can gain access to PII to include...

U.S. Dept Of Defense: PII Leak via https://████████

Summary: An attacker can create an account on https://████ and gain access to a wealth of PII for practically every member that is registered on the website. This includes e-mail addresses, physical addresses, telephone numbers, and other information about a vast majority of the US Air Force, as...

Booked < 2.2.6 - Broken Authentication to Export Users Data in CSV

The plugin allows users to Book Appointment by providing their PII such as Email, Name, Phone Number and Personal Message. The vulnerability allows anyone to Dump all records of users and their appointment details in CSV as an unauthenticated user. The user also gets registered as a WP User after...

Ultimate Membership Pro < 8.6.2 - Multiple CSRF Issues via AJAX Calls, Insufficient Filename Entropy

Version 8.6.1 attempted fo fix multiple critical issues mainly lack of authorisation checks, allowing low privileges users to call the admin functions of the plugin, leading to PII disclosure and login bypasses. However, the fixes were not sufficient: - An indeedIsAdmin check was added to all AJA...

Ultimate Membership Pro < 8.6.2 - Multiple CSRF Issues via AJAX Calls, Insufficient Filename Entropy

Version 8.6.1 attempted fo fix multiple critical issues mainly lack of authorisation checks, allowing low privileges users to call the admin functions of the plugin, leading to PII disclosure and login bypasses. However, the fixes were not sufficient: - An indeedIsAdmin check was added to all AJA...

U.S. Dept Of Defense: [Critical] Insufficient Access Control On Registration Page of Webapps Website Allows Privilege Escalation to Administrator

Summary: Hello. Due to insufficient access controls and poor implementation of the registration at https://████████/████/login.cfm it was possible to register while privilege escalating to an administrator. Description: It was possible to tamper with the registration request at...