A week in security (June 24 – June 30)

Last week on Malwarebytes Labs: TEMU sued for being "dangerous malware" by Arkansas Attorney General Driving licences and other official documents leaked by authentication service used by Uber, TikTok, X, and more "Poseidon" Mac stealer distributed via Google ads Federal Reserve "breached" data m...

arkansasrazorbacks.com Cross Site Scripting vulnerability OBB-3931337

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

arkansasrazorbacks.com Cross Site Scripting vulnerability OBB-3861438

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

arkansasrazorbacks.com Improper Access Control vulnerability OBB-3819031

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

arkansasprogressivemedicine.net Cross Site Scripting vulnerability OBB-3275389

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

agp.arkansasgravestones.org Cross Site Scripting vulnerability OBB-3269827

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

roster.healthy.arkansas.gov Cross Site Scripting vulnerability OBB-3246727

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

arkansasgravestones.org Improper Access Control vulnerability OBB-3198059

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

aclb2.arkansas.gov Cross Site Scripting vulnerability OBB-2152674

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

All Vulnerabilities for acoop.arkansas.gov Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| acoop.arkansas.gov ---|--- Open Bug...

aclb2.arkansas.gov Cross Site Scripting vulnerability OBB-2150771

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

arkansashealthjobs.com Cross Site Scripting vulnerability OBB-1412632

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

arkansashealthjobs.com Cross Site Scripting vulnerability OBB-1401899

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

arkansas.schoolspring.com XSS vulnerability

Open Bug Bounty ID: OBB-552451 Description| Value ---|--- Affected Website:| arkansas.schoolspring.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

local.arkansas.gov XSS vulnerability

Vulnerable URL: http://local.arkansas.gov/local.php?agency=1"...

fort-smith-arkansas.yourlocalnews.us XSS vulnerability

Vulnerable URL: http://fort-smith-arkansas.yourlocalnews.us/YLkOZ/OTlRZ/ZUXeZ/index.php?zfcategory=The%20Times%20Record=/%27%22--!%3E%20%3Cimg%20src=x%20onerror=alert%22OPENBUGBOUNTY%22%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Public...

arkansas.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-146818 Description| Value ---|--- Affected Website:| arkansas.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet Vulnerabl...

arkansas.gov XSS vulnerability

Vulnerable URL: http://www.arkansas.gov/search?q=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 16:30 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 29050 Google...

waltoncollege.uark.edu XSS vulnerability

Vulnerable URL: http://waltoncollege.uark.edu/images/slideshow.asp?pic=8=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

helena-arkansas.com XSS vulnerability

Open Bug Bounty ID: OBB-72972 Description| Value ---|--- Affected Website:| helena-arkansas.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Chea...