Khan Academy: OPEN URL REDIRECT through PNG files

An abuse of the imageurl parameter when saving a CS program was able to create an arbitrary external redirect. We now validate the parameter before using it. I have found a way through which an attacker can use png files to redirect to malicious domain...

psgacademy.ca XSS vulnerability

Vulnerable URL: http://www.psgacademy.ca/index.php?lang=en" Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 23:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2110829 VIP website status:| No Check...

onlineacademy.testo.com XSS vulnerability

Vulnerable URL: http://onlineacademy.testo.com/appc/contentmanager/page.php?ID=114496%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

academy.unify.com XSS vulnerability

Vulnerable URL: https://academy.unify.com/enweb/beschreibung1.jsp?Course=%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Saudi Softech 5.0.1 Cross Site Scripting / SQL Injection

Exploit Title : SAUDI SOFTECH MST - SQL Injection / Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.saudisoftech.com/ Category: Webapps Tested on: Win Date: 2016/06/05 Version : V.5.0.1 PoC: 1-1-Get SQL Injection Demo :...

ardentacademy.com XSS vulnerability

Vulnerable URL: http://ardentacademy.com/summer-2006/2006-math-olympiad-summer-camp-session-b-ii-album/?portalstatusmessage=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 08:39 GMT Vulnerabili...

usafa.edu XSS vulnerability

Vulnerable URL: http://www.usafa.edu/df/dfps/Programs/Assembly/index.cfm?catname=assembly%27%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 08:21 GMT Vulnerability type:| XSS Vulnerability status:|...

Answers for Word-Academy - Dynamic Code Loading, External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Answers for Word-Academy published at the 'play' market has multiple vulnerabilities...

Word Academy - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Word Academy published at the 'play' market has multiple vulnerabilities...

Khan Academy - BSD license, Customized SSL, GPL license vulnerabilities

HackApp vulnerability scanner discovered that application Khan Academy published at the 'play' market has multiple vulnerabilities...

shawacademy.com XSS vulnerability

Open Bug Bounty ID: OBB-142197 Description| Value ---|--- Affected Website:| shawacademy.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

academy.com XSS vulnerability

Vulnerable URL: http://www.academy.com/shop/browse/SearchDisplay?searchTerm=AcademyNewArrivals Details: Description| Value ---|--- Patched:| Yes, at 28.12.2016 Latest check for patch:| 28.12.2016 12:56 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4610 Google...

Khan Academy: XSS vulnerability in "/coach/roster/" ( create your first class)

Hi Security Team , Today I found xss vulnerability in "/coach/roster/" create your first class steps : - Go to " Manage students " - click in " create your first class " - create your first class Title name === " - click "create class " Good Fix ,...

questacademy.org Open Redirect vulnerability

Vulnerable URL: http://www.questacademy.org/cfnews/forward.cfm?dest=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 11.04.2016 Latest check for patch:| 11.04.2016 18:33 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank|...

Khan Academy: Escaping the iframe via exceptions

You can throw an object with an html property to run arbitrary js Here is an example program that modifies a user's profile. I made the program as private as possible by saving it with nouser and drawing nothing in the hopes that it will be ignored, but if you want me to delete it, I will. The...

Khan Academy: Html injection on khanacademy

There's an HTML Injection Vulnerability exists in khanacademy . Affected parameters "linkSuccess=" Steps to reproduce: 1. first open your account on khanacademy. 2.enter the link in the url box. http://khanacademy.org/settings/account?linkSuccess= 3.set any text after "=" eg...

zenithacademy.edu.in XSS vulnerability

Vulnerable URL: http://zenithacademy.edu.in/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= Derp Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 14:02 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

stcatherinesacademy.org XSS vulnerability

Vulnerable URL: http://www.stcatherinesacademy.org/about/video.aspx!prettyPhoto/0,%3Cimg%20src=x%20onerror=alert%28/XSSPOSED/%29%3E/ Details: Description| Value ---|--- Patched:| Yes, at 06.08.2015 Latest check for patch:| 06.08.2015 05:39 GMT Vulnerability type:| XSS Vulnerability status:|...

Naval Academy Cadets Win NSA Hacking Contest

Midshipmen from the United States Naval Academy in have won the National Security Agency’s Cyber Defense Exercise CDX for the third time. Between April 13 and 17, the CDX pits the U.S. Naval, Air Force, Coast Guard, Merchant Marine and Military Academy and the Royal Military College of Canada...

Cisco Network Academy Cross Site Scripting

Exploit Title: Script Cisco Network Academy - Stored XSS vulnerability Date: 017/03/2015 Author: kabanni [email protected] Product web page: www.cisco.com Tested on: Windows 8.1 OSVDB-ID: 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 1 0 0 .-" "-. 1 1 / HaChkerzDz ...