U.S. Dept Of Defense: RXSS - https://███/

Hello All I Found RXSS in your OWN Website Steps:- Add Payload XSS To /████?view= Example:- https://████/█████████?view=%3Cscript%3Ealert%22xElkomy%22%3C/script%3E Payloads:- Any payloads XSS Fix:- Filter input on arrival Encode data on output Use appropriate response headers Content Security...

U.S. Dept Of Defense: No Rate Limiting on https://██████/██████████/accounts/password/reset/ endpoint leads to Denial of Service

Summary: No-Rate Limit on Password reset endpoint results mail-spam functionality to be abused. Additionally, the password-reset link remain the same after each request. Description: Malicious user could Spear-target █████████ user mail and Spam it for as many requests as he would like. Possible...

U.S. Dept Of Defense: CSRF - Close Account

Target Url ████/services/user/closeAccount Summary: Hello, I found a Cross Site Request Forgery bug in the target endpoint on the POST request /█████/services/user/closeAccount which is critical because it can delete authenticated user account whenever he navigates to the attacker website or link...

U.S. Dept Of Defense: Unrestricted file upload leads to stored xss on https://████████/

Summary: When the user want to upload a "certificate", the web app doesn't check the content-type of the file. A user can upload any kind of file binary,html,... Step-by-step Reproduction Instructions 1. Create an account at https://██████/████████/app/registration/basic-info 2. When you are...

U.S. Dept Of Defense: PulseSSL VPN Site with Compromised Creds @ ████

Dear US DoD, Back in 2019, I had reported that a pulseSSL VPN server owned by US DoD can be compromised by a publicly available exploit. The report is████████. As a result, the userid and passwd db was also compromised. I found that at least 1 userid and password combination from that compromised...

U.S. Dept Of Defense: Stored XSS via 64(?) vulnerable fields in ███ leads to credential theft/account takeover

Summary: A user is able to complete a ████████ worksheets via https://██████████. This form allows a user to store multiple XSS payloads within, which will in turn allow the attacker to run malicious code in context of the legal personnel who view the request. Impact The attacker can have multipl...

U.S. Dept Of Defense: Remote Code Execution via Insecure Deserialization in Telerik UI

Hello, I found an outdated version of Telerik Web UI v2016.2.607.40 at the following URL: https://███/Telerik.Web.UI.WebResource.axd?type=rau. This means that we can achieve full RCE by chaining two different CVEs: CVE-2017-11317, which allows us to upload arbitrary files on the server, and...

U.S. Dept Of Defense: Apache solr RCE via velocity template

Hi team, While doing some recon i stumbled upon an IP address http://██████/ The IP took me to a Login Page at ████=https%3A%2F%2F██████████████████ as of the URL suggest this system belongs to US gov. Doing a Port scan reveals that POST ██████████ is Open, A lot of doors open if Solr is exposed...

U.S. Dept Of Defense: Knowledge Base Articles are Globally Modifiable via ██████

Summary: A user is able to create an account on ██████████ and modify or create any knowledge base articles. This includes articles that have been created by the ██████████ as a canned response to help users with frequently asked questions. Description: Knowledge base articles are used within the...

U.S. Dept Of Defense: Unrestricted File Upload to ███████SubmitRequest/Index.cfm?fwa=wizardform

Summary: An attacker is able to upload files of any type to ███SubmitRequest/Index.cfm?fwa=wizardform as long as they are less than 5 MB. Description: The █████ ████ Request System allows a user to submit requests to the ██████████ ███ for event support. An attacker can exploit this request form ...

U.S. Dept Of Defense: Sensitive Information Leaking Through Navy Website. [█████]

Summary: While performing recon work on websites owned by DoD i came up with a Navy website which is leaking sensitive information. Description: The website is leaking information such as- first name and last name, email address, phone number, location, rank, and other information of trainees in ...

U.S. Dept Of Defense: PII Leak via https://████████

Summary: An attacker can create an account on https://████ and gain access to a wealth of PII for practically every member that is registered on the website. This includes e-mail addresses, physical addresses, telephone numbers, and other information about a vast majority of the US Air Force, as...

U.S. Dept Of Defense: Username&password is Disclosure in readme file in [https://█████████]

Summary: Username&password is Disclosure for login into dashboard in readme file in https://███ Description: open this and u will see the username and password in the file Impact Disclosure Sensitive Information "username&password"...

U.S. Dept Of Defense: phpinfo() disclosure info

hi security team i found subdoamins avalibale file phpinfo PoC:- https://█████████/phpinfo.php Impact An attacker can obtain information such as: •Exact PHP version. •Exact OS and its version. •Details of the PHP configuration. •Internal IP addresses. •Server environment variables. •Loaded PHP...

U.S. Dept Of Defense: [█████████] Administrative access to Oracle WebLogic Server using default credentials

Hello. I discovered an Oracle WebLogic Server and because of weak credentials managed to login as administrator, which led to complete server takeover...

U.S. Dept Of Defense: Domian Takeover in [███████]

Summary: subscription of ████ is expired so any attacker can takeover it Impact phishing attacks if any attacker takeovr the domain...

U.S. Dept Of Defense: CSRF - Delete Account (Urgent)

Target Url https://██████████/███/██████/█████████ Summary: Hello, I found a Cross Site Request Forgery bug in the target endpoint on the GET request ████ which is critical because it can delete authenticated user account whenever he navigates to the attacker website or link. Step-by-step...

U.S. Dept Of Defense: Reflected XSS - in Email Input

Target Url https://█████ Summary: Hello, I found a reflected xss injection in the email input when updating user profile. Seems Email input is not sanitized and the special characters are not encoded. xss payload used " Step-by-step Reproduction Instructions 1. Navigate to the target url...

U.S. Dept Of Defense: Reflected cross-site scripting vulnerability on a DoD website

Hello there ! I'd like to report a 'XSS' vulnerability on a DoD website https://███/unit/███ , Here in the search engine of the website please enter the following payloads alertdocument.domain & you can even use this payload to steal cookies alertdocument.cookie and hit enter and just scroll you'...

U.S. Dept Of Defense: Blind SQL Injection

Bug is : Blind Sql injection SQL injection is a vulnerability that allows an attacker to alter back-end SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement and doesn't properly filter out...