insuranceadvice.com XSS vulnerability

Open Bug Bounty ID: OBB-670851 Description| Value ---|--- Affected Website:| insuranceadvice.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

meetav.com XSS vulnerability

Open Bug Bounty ID: OBB-669390 Description| Value ---|--- Affected Website:| meetav.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

dash.trck.me XSS vulnerability

Open Bug Bounty ID: OBB-655855 Description| Value ---|--- Affected Website:| dash.trck.me Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

paintedcabernet.com XSS vulnerability

Open Bug Bounty ID: OBB-653968 Description| Value ---|--- Affected Website:| paintedcabernet.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-14474

views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup...

CVE-2018-14474

CVE-2018-14474 affects Orange Forum 1.4.0, with an open redirect in views/auth.go triggered by the next parameter to /login or /signup. The vulnerability allows an attacker to redirect users to a malicious site, potentially enabling phishing or credential theft. Several connected sources (e.g., N...

PT-2018-12543

Name of the Vulnerable Software and Affected Versions Orange Forum version 1.4.0 Description The issue in Orange Forum allows Open Redirection via the next parameter to "/login" or "/signup" API endpoints. This can be exploited by manipulating the next parameter. Recommendations For Orange Forum...

rixtkuiper.com XSS vulnerability

Open Bug Bounty ID: OBB-644306 Description| Value ---|--- Affected Website:| rixtkuiper.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

vedantu.com XSS vulnerability

Open Bug Bounty ID: OBB-641895 Description| Value ---|--- Affected Website:| vedantu.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cloudflare: Private API key leakage due to lack of access control

The lack of access control on the https://mobilesdk.cloudflare.com/api/v1/ api allows for a remote attacker to access and steal a logged in user's private data. This can be done due to the lack of origin protection. An attacker can embed the config URI...

resbook.com XSS vulnerability

Open Bug Bounty ID: OBB-639068 Description| Value ---|--- Affected Website:| resbook.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Liberapay: Liberapay Non Verified Account Takeover with signup feature

Hi, So i saw a strange behaviour of your web on signup feature when that can be escalated to Account Takeover but for limited timeline, Issue: When a New user signup for an account on https://en.liberapay.com/ he have to enter his email address only and it doesn't say anything about sending a...

GSA Bounty: Multiple Bugs in api.data.gov/signup endpoint leads to send custom messages to Anyone

Hey there, while signing for new api key, i have found two bugs that is unusual and make anyone to send crafted or customised email to someone. Bug 1: - low 1. Go to https://api.data.gov/signup/ 2. Enter first and last name , then enter email id and get api key. Bug: You can use the same email id...

musclecarmag.com.au XSS vulnerability

Open Bug Bounty ID: OBB-608975 Description| Value ---|--- Affected Website:| musclecarmag.com.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

blogmn.net XSS vulnerability

Open Bug Bounty ID: OBB-602800 Description| Value ---|--- Affected Website:| blogmn.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

travel-solutions.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-600085 Description| Value ---|--- Affected Website:| travel-solutions.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

hermitageart.com XSS vulnerability

Open Bug Bounty ID: OBB-598465 Description| Value ---|--- Affected Website:| hermitageart.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

mdundo.com XSS vulnerability

Open Bug Bounty ID: OBB-591711 Description| Value ---|--- Affected Website:| mdundo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Honeypot strategy is no longer effectively preventing spam account signup

panel:title=Fix From 3.9.5 onwards we have turned off the honeypot in favour of using captcha anyone affected by this issue just needs to switch the CAPTCHA on...

Honeypot strategy is no longer effectively preventing spam account signup

panel:title=Fix From 3.9.5 onwards we have turned off the honeypot in favour of using captcha anyone affected by this issue just needs to switch the CAPTCHA on...