CVE-2018-15678

An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...

Cross site scripting

An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...

CVE-2018-15678

An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...

CVE-2018-1000193

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and canno...

CVE-2018-1000193

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and canno...

thewallis.org XSS vulnerability

Open Bug Bounty ID: OBB-599031 Description| Value ---|--- Affected Website:| thewallis.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

polartank.com XSS vulnerability

Open Bug Bounty ID: OBB-568952 Description| Value ---|--- Affected Website:| polartank.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

pinnacleworldwide.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-565013 Description| Value ---|--- Affected Website:| pinnacleworldwide.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

HP Printing Security Advisory - KRACK Attacks Potential Vulnerabilities

Potential Security Impact KRACK Attacks VULNERABILITY SUMMARY On October 16, security researchers publicly announced vulnerabilities in the WiFi WPA2 standard. See the References section below for links to additional resources describing the KRACK Attacks WPA2 potential vulnerabilities in detail...

Legal Robot: Wrong password validation message

Hello, Your password validation message seems to be contradicting with the server side validation of password field during new account sign up at https://app.legalrobot.com/sign-in. When you start typing in password field, it says Passwords must be more than 8 characters but when you type more th...

Khan Academy: Weak Bithdate Validation Implemented on Sign Up

The Birthdate Field on the KhanAcademy's Sign Up page for new users has the year range from 2017 to 1897. F210177 However, while signing up for a new account, I was able to set the year to 1033 by manipulating the data being sent to the server and the account was successfully created. I can also...

Legal Robot: Lack of input validation in e-mail & user name, job title, company name field

Hi, During sign up input validation didn't deploy properly on e-mail & name field. I've tested inputing following e-mail during sign up: hacker%@gmail.com Your system send email to verification the account though the e-mail address is invalid as gmail doesn't allow user to sign up using special...

Botnet Tweeting, Spamming Porn Shut Down

An adult-themed botnet was found by researchers and dismantled by Twitter last month. The Twitter-based botnet consisted of 86,262 bot accounts, and over the past six months blasted out 8.6 million tweets that attempted to lure males to pornographic, dating, hookup and cheating-spouse websites...

gcdcimmigrationrecords.galvestoncountytx.gov XSS vulnerability

Vulnerable URL: http://gcdcimmigrationrecords.galvestoncountytx.gov/signup.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 08.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

Nextcloud: help.nextcloud Email Address/Username enumeration

Hello nextcloud, i have another findings, i found that email address enumeration and or username enumeration is possible in signup/registration and forgot password under https://help.nextcloud.com/ , email/username enumeration can be use in any malicious intent by a malicious minded user. - For...

APITest.IO: Clickjacking: X-Frame-Options header missing

same as this report https://hackerone.com/reports/7492 vulnerable :- sign in ,sign up ,and main domain poc attached...

New Relic: Unsafe HTML in reset password email and Account verification in email is missing in Sign up

Issue :1 did not receive password reset email, although it looks like newrelic delivered it to gmail. On inspection I can see that the email contains unescaped user input name that might be interfering with delivery. Issue 2 : Account verification in email is missing in Sign up...

You Can Now Use Messenger App without a Facebook Account

Don't have Facebook account but want to use its Messenger service? Then go for it because Mark Zuckerberg wants even the people who hate Facebook to use the social network's separate Messenger service. So, you no longer need an active Facebook account to make use of the Messenger service, all you...

Shopify: XSS in experts.shopify.com

Hi, XSS vulnerability in experts.shopify.com, Steps to verify: 1. Go to https://experts.shopify.com 2. Sign up for an expert. Please do note that you must create a new account if you already have, do not use existing account or an account that did not yet apply for an expert then you will ask to...

CVE-2014-7078

CVE-2014-7078 : The Payoneer Sign Up (aka com.wPayoneerSignUp) Android app, version 0.1, does not verify X.509 certificates from SSL servers. This weakness allows man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information via a crafted certificate. The provided sourc...