Critical Flaws in Khan Academy Opened Door to Account Takeovers

Two critical cross-site request forgery CSRF flaws in educational non-profit Khan Academy’s website may have affected some users by allowing account takeover. Khan Academy, a non-profit learning organization, produces short lessons in the form of videos that can be accessed online. The two critic...

Khan Academy: Users can make accounts with a fake email address.

A valid email address is not required to create a Khan Academy account. We do not consider this a security vulnerability...

CVE-2019-9844

simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...

CVE-2019-9844

simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...

CB Customer Spotlight: Q&A with ALLETE’s Jeff Rotenberger

For five years now, Jeff Rotenberger has served as a cybersecurity analyst for ALLETE, an energy and utilities company providing for the Upper Midwest. Rotenberger and his team have been working with Carbon Black CB APIs and CB Response to greatly reduce time spent on security remediation. Read o...

simple-markdown cross-site scripting vulnerability

simple-markdown is a simple, extensible Markdown-like parser . A cross-site scripting vulnerability exists in simple-markdown.js in Khan Academy simple-markdown versions prior to 0.4.4. The vulnerability can be exploited to conduct cross-site scripting attacks via the data: or vbscript: URI...

CVE-2019-9844

simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI...

CVE-2019-9844

CVE-2019-9844 affects the Node package simple-markdown (Khan Academy’s simple-markdown) up to version 0.4.3. The vulnerability is a Cross‑Site Scripting (XSS) flaw caused by insufficient input sanitization in links, enabling execution of malicious JavaScript via data: or VBScript: URIs. The issue...

Khan Academy: EMAIL SPOOFING

Hey KHANACADEMY, I have found Email Spoofing type of Vulnerability in your Website. Attacker can use your E-Mail to send emails to others. Email spoofing is the creation of email messages with a forged sender address. Because the core email protocols do not have any mechanism for authentication, ...

Khan Academy: Subdomain takeover on healthyhackathon.khanacademy.org and hackweek.khanacademy.org

Summary : healthyhackathon.khanacademy.org can be took over, since it points to a bucket in S3 but that bucket does not exists. I know this domain is used to host information of healthyhackathon which is held by khanacademy, but you will not be able to do this anymore if someone is going to claim...

musicacademy.org XSS vulnerability

Open Bug Bounty ID: OBB-716409 Description| Value ---|--- Affected Website:| musicacademy.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

brooksacademy.org XSS vulnerability

Open Bug Bounty ID: OBB-715521 Description| Value ---|--- Affected Website:| brooksacademy.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidde...

unionparkacademy.org XSS vulnerability

Open Bug Bounty ID: OBB-715358 Description| Value ---|--- Affected Website:| unionparkacademy.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

pinecrestacademynorth.com XSS vulnerability

Open Bug Bounty ID: OBB-715238 Description| Value ---|--- Affected Website:| pinecrestacademynorth.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score...

excelsiorlanguageacademy.com XSS vulnerability

Open Bug Bounty ID: OBB-715163 Description| Value ---|--- Affected Website:| excelsiorlanguageacademy.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

excelsior-academy.org XSS vulnerability

Open Bug Bounty ID: OBB-715112 Description| Value ---|--- Affected Website:| excelsior-academy.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

keywestacademy.org XSS vulnerability

Open Bug Bounty ID: OBB-715106 Description| Value ---|--- Affected Website:| keywestacademy.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...

hs.cumberlandacademy.com XSS vulnerability

Open Bug Bounty ID: OBB-715061 Description| Value ---|--- Affected Website:| hs.cumberlandacademy.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:...

digitalmediaacademy.org XSS vulnerability

Open Bug Bounty ID: OBB-708536 Description| Value ---|--- Affected Website:| digitalmediaacademy.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

wholekidsacademy.com XSS vulnerability

Open Bug Bounty ID: OBB-705705 Description| Value ---|--- Affected Website:| wholekidsacademy.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...