bca.brooksacademy.org XSS vulnerability

Vulnerable URL: http://bca.brooksacademy.org/apps/news/shownews.jsp?RECID=457235=0=News Post Andre Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinated...

Towards a Safer Internet for All: Winners of New Brunswick Video Contest Announced

Today more than ever, society needs to come together to work towards a better and safer future for all our children. This doesn’t just mean members of the public: companies can and should play a key role in helping to support worthy causes. Global citizenship and cyber security are two issues tha...

artacademy.edu XSS vulnerability

Vulnerable URL: http://www.artacademy.edu/faculty/rseeman/svcore/full.html?bg=xss"=..%2Fgallery.xml Details: Description| Value ---|--- Patched:| No Latest check for patch:| 11.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2680738 VIP website status:| No...

arbitrationacademy.org XSS vulnerability

Open Bug Bounty ID: OBB-292730 Description| Value ---|--- Affected Website:| arbitrationacademy.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

academy.unify.com XSS vulnerability

Vulnerable URL: http://academy.unify.com/enweb/certificationLevels.jsp?area=Sales="=certItems=certItem7 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 17.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...

Khan Academy: Weak Bithdate Validation Implemented on Sign Up

The Birthdate Field on the KhanAcademy's Sign Up page for new users has the year range from 2017 to 1897. F210177 However, while signing up for a new account, I was able to set the year to 1033 by manipulating the data being sent to the server and the account was successfully created. I can also...

Promoting Online Safety in Canada: Trend Micro Launches Video Contest for Local Kids

At Trend Micro we always strive to be a responsible corporate citizen. Right from the beginning the company has devoted significant time and resources to a variety of projects: from house building in the Philippines, to our Give and Match programs around the world designed to support vital...

Khan Academy: XSS through document projects

Hello, I'm Ethan Luis McDonough @elmt2 on Khan Academy, and I found a way to inject scripts into document projects. Since KA document projects output HTML, I can edit the PUT request that updates projects https://www.khanacademy.org/api/internal/scratchpads/ID and inject JavaScript code inside an...

prosseracademy.org XSS vulnerability

Vulnerable URL: https://www.prosseracademy.org/m/album/?dir=departments/234714=/m/pages/index.jsp%3FuRECID=234714%26type=d=%22%3Etrolo%3Ci%3Etralala%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.08.2017 Vulnerability...

resoluteacademy.org XSS vulnerability

Vulnerable URL: https://www.resoluteacademy.org/apps/album/index.jsp?dir=/%27%22--!%3E%20%3Cimg%20src=x%20onerror=alert%22openbugbounty%22%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 05.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Ale...

kennedyacademy.org XSS vulnerability

Vulnerable URL: https://kennedyacademy.org/m/album/?dir=departments/101936=/m/pages/index.jsp%3FuRECID=101936%26type=d=%22%3Etrolo%3Ci%3Etralala%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 01.08.2017 Vulnerability type...

Roche Academy - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Roche Academy published at the 'play' market has multiple vulnerabilities...

Khan Academy: Rate Limitation Vulnerability (DDos)

Rate limiting on account confirmation emails and forgot password...

Khan Academy: No Security check at changing password and at adding mobile number which leads to account takeover and spam

Description I have noticed that there is no security check at changing password. If someone gets a logged in account for 5 seconds, they are extremely likely to change the password of the account with the knowledge of the victim. also, while adding a mobile number / changing a mobile number, ther...

prosseracademy.org XSS vulnerability

Vulnerable URL: https://www.prosseracademy.org/m/album/?dir=departments/234714=/m/pages/index.jsp%3FuRECID=234714%26type=d=--%3E%22%3E%3C/a%3E%3C/script%3E%3C/title%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerabilit...

kennedyacademy.org XSS vulnerability

Vulnerable URL: https://kennedyacademy.org/m/album/?dir=departments/101936=/m/pages/index.jsp%3FuRECID=101936%26type=d=--%3E%22%3E%3C/a%3E%3C/script%3E%3C/title%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability...

resoluteacademy.org XSS vulnerability

Vulnerable URL: https://www.resoluteacademy.org/apps/album/index.jsp?dir=--%3E%22%3E%3C/a%3E%3C/script%3E%3C/title%3E%3Csvg/onload=alert/XSSPOSED/%3E--%3E%22%3E%3C/a%3E%3C/script%3E%3C/title%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch...

So you want to expose Go on the Internet

I was asked to contribute a post to the excellent Gopher Academy advent series. I took the occasion to write down what I learned deploying a Go service on the Cloudflare edge. The result is a catalogue of what you need to know before you drop NGINX from in front of your Go server. The net/http pa...

Arbitrary Password Reset Vulnerability in ZTE E Academy APP

ZTE E Academy APP is a professional skills learning software. There is an arbitrary password reset vulnerability in ZTE E Academy APP IOS version and Android version. By using a cell phone number to retrieve the password when the SMS verification code is returned directly to the response, you onl...

academy.unify.com XSS vulnerability

Vulnerable URL: http://academy.unify.com/enweb/certificationLevels.jsp?area=Sales=%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E=certItems=certItem7 Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 13:00 GMT Vulnerability type:| XSS...