cube-store-ulm.de Cross Site Scripting vulnerability OBB-4019012

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

U.S. Dept Of Defense: IDOR Exposes PII of Tens of Thousands of Users and Supervisors

A vulnerability was discovered that exposed personally identifiable information PII of tens of thousands of users and supervisors. The vulnerability was found in a system that allowed users to submit a SAAR. By modifying a URL parameter, users could view other users' SAARs, which contained...

raimondoarchitects.com Improper Access Control vulnerability OBB-4018940

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

HackerOne: Ability to access policy and updates for unauthorized program

The vulnerability allowed an unauthorized user to access the policy and updates for a restricted program using an API key. The user was able to retrieve sensitive data from the unauthorized program, even though they were only granted access to one of the two programs in the organization...

Autodesk: Insecure Direct Object Reference (IDOR) Vulnerability in Autodesk User Profile

An Insecure Direct Object Reference IDOR vulnerability was discovered in the Autodesk User Profile. The vulnerability was found in the "id" parameter, which could have allowed an attacker to edit another user's profile...

observaciones-andromeda.es Cross Site Scripting vulnerability OBB-4018339

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Autodesk: Django Debug Mode Enabled - Information Disclosure on api.wwm-dev.autodesk.com

The domain api.wwm-dev.autodesk.com was discovered to have Django debug mode enabled, which led to information disclosure. The issue was fixed by Autodesk...

institut-pieta.ch Improper Access Control vulnerability OBB-4018230

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Top Echelon Software: Clickjacking in main domain https://topechelon.com/

The target website was vulnerable to Clickjacking, a web-based attack that tricked users into interacting with a hidden or disguised iframe. The vulnerability could have been exploited to manipulate user actions, potentially leading to unauthorized activities...

recella3d.com Cross Site Scripting vulnerability OBB-4018059

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

thefreedictionary.com Cross Site Scripting vulnerability OBB-4017737

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

awbw.amarriner.com Cross Site Scripting vulnerability OBB-4017729

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

U.S. Dept Of Defense: 2FA Bypass via Response Manipulation on Login Page

A vulnerability was discovered in the Two-Factor Authentication 2FA mechanism of the website. The vulnerability allowed bypassing the 2FA verification process by intercepting and manipulating the server's response. As a result, an attacker could gain unauthorized access to an account after...

Autodesk: IDOR Vulnerability Allowing Unauthorized Profile Picture Change

An IDOR vulnerability was found on the Autodesk User Profile, which allowed an attacker to edit another user's profile picture. The vulnerability was reported and has been fixed by Autodesk...

fitzcarraldo.it Improper Access Control vulnerability OBB-4017640

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

agencelasuite.com Cross Site Scripting vulnerability OBB-4017631

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

medicalresearch.nsw.gov.au Cross Site Scripting vulnerability OBB-4017046

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

curl: curl allows SSH connection even if host is not in known_hosts

Summary: Curl does not fail if the SSH host identity cannot be verified due to the host not being included in the .ssh/knownhosts file. This makes using curl to login into an previously unknown ssh host system vulnerable to meddler in the middle attacks. When using key based authentication it wil...

tuinhier.be Cross Site Scripting vulnerability OBB-4016954

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

MTN Group: SQLi | in URL paths

The vulnerability summary is as follows: A SQL injection vulnerability was discovered in the customerId parameter of the URL path. The vulnerability was demonstrated by adding a quote in the customerId parameter, which resulted in an error indicating that the application was vulnerable to SQL...