arqaparecida.org.br Cross Site Scripting vulnerability OBB-4047368

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

zstack-cloud.com Cross Site Scripting vulnerability OBB-4047366

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

unexist.blog Cross Site Scripting vulnerability OBB-4047365

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

audubonofkansas.org Cross Site Scripting vulnerability OBB-4047331

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

cooltv.ch Cross Site Scripting vulnerability OBB-4047310

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

pixiv: Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.net

A vulnerability was discovered in the messaging system of Pixiv.net. The vulnerability allowed any user to bypass the inbox privacy settings and send messages to another user who had disabled their inbox. The vulnerability was triggered by manipulating the id parameter in the message-sending POST...

hawk-gps.street-directory.com.au Cross Site Scripting vulnerability OBB-4047065

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

curl: Path Traversal Vulnerability in curl via Unsanitized IPFS_PATH Environment Variable

A path traversal vulnerability exists in curl versions with IPFS support 7.81.0+. The IPFSPATH environment variable is not properly sanitized, allowing attackers to read arbitrary files by manipulating directory traversal sequences e.g., ../../../../etc. This flaw enables leakage of sensitive dat...

Khan Academy: Leaked reused password for a few Khan Academy users

A large number of Khan Academy user credentials, including emails and passwords, were exposed through a Telegram bot. The exact source of the leaked data is unknown, but the volume of exposed information was substantial...

rrscientific.com Open Redirect vulnerability OBB-4046996

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

driveyourlearning.org Cross Site Scripting vulnerability OBB-4046995

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

lifestyle.brando.com Cross Site Scripting vulnerability OBB-4046994

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Lichess: Open Redirect Vulnerability in OAuth Flow Leading to Potential Phishing Attack

Summary: An open redirect vulnerability exists in the OAuth flow on lichess4545.com. By manipulating the redirecturi parameter during the OAuth authorization process with Lichess, an attacker can redirect users to an arbitrary external domain e.g., example.com after login. This could be exploited...

norseprojects.com Cross Site Scripting vulnerability OBB-4046985

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

indiaflora-ces.iisc.ac.in Cross Site Scripting vulnerability OBB-4046981

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

greenhavenpublishing.com Cross Site Scripting vulnerability OBB-4046964

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

greenevers-nc.apexportapottyrental.com Cross Site Scripting vulnerability OBB-4046963

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WakaTime: user api key leaked

The user's API key was found exposed in an older URL while testing the WakaTime tool. The API key successfully authenticated requests to a restricted endpoint, indicating that it was valid and granted access to protected resources...

RubyGems: `/names.nsf` and all `/names*` files route to public API on rubygems.org

During the security assessment of the application hosted at https://rubygems.org/names.nsf, it was discovered that a sensitive file "names.nsf", is publicly accessible without proper authentication and it is supposed to be protected by authentication mechanisms to ensure that unauthorized users d...

gewefa.de Cross Site Scripting vulnerability OBB-4046684

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...