U.S. Dept Of Defense: CRXDE Lite/CRX is on ██████ exposed that leads to PII disclosure

hi team , i found that aem is running on ████████ and CRXDE Lite/CRX is exposed to unauthenticated user that can lead to information disclosure POC ==== 1-visit https://██████//██████████ 2-go to query and search for admin then execute 3-go to this endpoint to retrieve the information...

U.S. Dept Of Defense: IDOR leads to Leakage an ██████████ Login Information

Hi security team, According to my report 1092618, The VDP team agreed that █████████ and it's subdomains is in the scope of the DoD program I continue testing that domain . . Issue Description: There is an IDOR in██████.███████ that connected with ████████.███████ highly protected encryption chat...

U.S. Dept Of Defense: █████████ IDOR leads to disclosure of PHI/PII

Summary: ████ is designed in a way where there is a vulnerable endpoint that allows a non-medical user to view the ██████████ records of people who are not ████████s of the sponsor. Description: I am currently an Active Duty Airman and this vulnerability does require CAC authentication. When...

U.S. Dept Of Defense: Bypassed a fix to gain access to PII of more than 100 Officers

Summary: Hey team I hope this report finds you well and you're having a great day in these difficult times ; While doing my Recon I have found out that https://www.███/ is leaking PII of many Officers Severity according to me- Critical Step-by-step Reproduction Instructions 1. Go to...

U.S. Dept Of Defense: [hta3] Remote Code Execution on ████

Vulnerability description not provided...

U.S. Dept Of Defense: Stored XSS through name / last name on https://██████████/

Description: There is stored XSS Vulnerability on https://█████/██████ by rendering unsafe input being registered on the account name and last name. ███ Step-by-step Reproduction Instructions 1. Navigate to javascript...

U.S. Dept Of Defense: RCE in ██████ subdomain via CVE-2017-1000486

Summary: The application at ████████/ftn-Website/ uses primefaces 5.3 but not 5.3.8, making it vulnerable to unauthenticated RCE CVE-2017-1000486. Step-by-step Reproduction Instructions 1. Get the publicly available POC for this vulnerability here: https://github.com/pimps/CVE-2017-1000486 2...

U.S. Dept Of Defense: Sending trusted ████ and ██████████ emails through public API endpoint in ███████ site

Summary: A publicly accessible endpoint at PUT https://████████does not validate any of its four parameters: to, from, subject, text. This enables sending email to any address, with any content, with any from address, on a server that is in ██████whitelist. Such services include, but are not...

U.S. Dept Of Defense: Sensitive data exposure via https://███████/secure/QueryComponent!Default.jspa - CVE-2020-14179

Summary: Information Disclosure vulnerability in outdated Jira. Description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the...

U.S. Dept Of Defense: Reflected XSS on https://█████████/

Vulnerable Website URL or Application: javascript https://███████/███████=%22%3E%3Csvg/onload=alert%22nagli%22%3E Description of Security Issue: please limit to one site/app per submission Reflected XSS due to no input validation ██████████ Steps needed to reproduce bug: Navigate to javascript...

U.S. Dept Of Defense: [CVE-2018-7600] Remote Code Execution due to outdated Drupal server on www.█████████

Summary Due to an outdated Drupal version, remote code execution is possible on www.█████ via CVE-2018-7600. Description Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple...

U.S. Dept Of Defense: Full account takeover on https://████████.mil

Description The flow in application is to sign up and wait for an email containing a one-time password, as soon as you login using that password, it asks you to change it. I took that password change request and applied on any email changing their password and it worked Steps to produce: 1- Copy...

U.S. Dept Of Defense: Reflected XSS on ███

Summary Reflected XSS on █████████ for invalid paths. Description Requesting a non-existent path on █████, such as https://██████████/chron0x the site responds with No jsonpage404 is /chron0x versus /chron0x./chron0x does not exist. As it can be seen, the path is reflected. This can be exploited...

U.S. Dept Of Defense: PHP info page disclosure

Summary: phpinfo is a debug functionality that prints out detailed information on both the system and the PHP configuration. Step-by-step Reproduction Instructions 1.Go to https://███████phpinfo Impact An attacker can obtain information such as: •Exact PHP version. •Exact OS and its version...

U.S. Dept Of Defense: Sensitive data exposure via https://███/secure/QueryComponent!Default.jspa - CVE-2020-14179

Summary: Information Disclosure vulnerability in outdated Jira. Description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the...

U.S. Dept Of Defense: IDOR on https://██████ via POST UID enables database scraping

Summary: The UID parameter on █████████ in the ██████ ███████ system, with ███████, does not validate that the caller has permission to view information on the UID entered, thereby enabling personnel and student data extraction. Description: The user operations API endpoint for the ███ ██████████...

U.S. Dept Of Defense: Blind stored XSS due to insecure contact form at https://█████.mil leads to leakage of session token and

Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://███████.mil/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets. I was able to...

U.S. Dept Of Defense: Able to authenticate as administrator by navigating to https://█████/admin/

Summary: The endpoint at https://███████/admin/ authenticates the user to the administrator user. Step-by-step Reproduction Instructions 1. Navigate to https://███/ and youll notice you will need to log in. 2. Navigating to https://██████████/admin/ will show you admin malformed page, with the...

U.S. Dept Of Defense: Reflected XSS in https://███████ via hidden parameter "████████"

Hi everyone : I found a Reflected XSS on https://███████ via hidden parameter "████████" on the following authentication page : https://███████/██████████ Steps To Reproduce: - Use your favorite web browser - Go to :...

hamptonbaysfiredept.org Cross Site Scripting vulnerability OBB-1485743

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...