MTN Group: Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-10271]

Summary Hello. I was able to identify RCE vulnerability due to the outdated Oracle Weblogic instance on https://raebilling.mtn.co.za. Steps To Reproduce To reproduce, launch this request with BurpSuite This request to the https://raebilling.mtn.co.za/wls-wsat/CoordinatorPortType will trigger slee...

evolveo.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1109921 Security Researcher raviakp1004 Helped patch 774 vulnerabilities Received 4 Coordinated Disclosure badges Received 6 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting evolveo.com website and...

geoportal.de Open Redirect vulnerability

Open Bug Bounty ID: OBB-1109117 Security Researcher SkypLabs Helped patch 16 vulnerabilities Received 1 Coordinated Disclosure badges Received 2 recommendations , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting geoportal.de website and its...

bmomn.com Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8574 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting bmomn.com website and its users. Following coordinated and...

coincatmedia.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1106445 Security Researcher MrRain1996 Helped patch 994 vulnerabilities Received 4 Coordinated Disclosure badges Received 9 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting coincatmedia.com website...

CVE-2020-9431

In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations...

metall-holding.com.ua Cross Site Scripting vulnerability

Security Researcher kun-fly Helped patch 557 vulnerabilities Received 7 Coordinated Disclosure badges Received 40 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting metall-holding.com.ua website and its users. Following...

Forrester report for Rapid7: number juggling and an excellent overview of Vulnerability Management problems

I recently read Forrester's 20-page report "The Total Economic Impact Of Rapid7 InsightVM". It is about the Cost Savings And Business Benefits that Vulnerability Management solution can bring to the organizations. In short, I didn't like everything related to money. It seems like juggling with...

racc.be Cross Site Scripting vulnerability

Security Researcher KhanJanny Helped patch 2643 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting racc.be website and its users. Following coordinated and...

oteltaganrog.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1101021 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting oteltaganrog.ru website a...

bombaytalkies.co Cross Site Scripting vulnerability

Security Researcher g0bl1nsec Helped patch 3630 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting bombaytalkies.co website and its users. Following...

animalspiritnetwork.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1099027 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting animalspiritnetwork.com...

reddays.kr Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8610 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting reddays.kr website and its users. Following coordinated an...

eyeondesign.aiga.org Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1096409 Security Researcher kun-fly Helped patch 725 vulnerabilities Received 7 Coordinated Disclosure badges Received 43 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting eyeondesign.aiga.org websit...

trustmarkcorp.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1096323 Security Researcher error404 Helped patch 532 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting trustmarkcorp.com website...

provendum.ch Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1094990 Security Researcher metamorfosec Helped patch 1983 vulnerabilities Received 9 Coordinated Disclosure badges Received 32 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting provendum.ch website...

elwatania-co.com Cross Site Scripting vulnerability

Security Researcher ImPRINCE Helped patch 122 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting elwatania-co.com website and its users. Following coordinated and responsible...

swampland.com Cross Site Scripting vulnerability

Security Researcher Broly157 Helped patch 1569 vulnerabilities Received 7 Coordinated Disclosure badges Received 15 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting swampland.com website and its users. Following coordinate...

Open redirect

In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All...

CVE-2020-5239 Unspecified vulnerability in the fetchmail script in Mailu

In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All...