U.S. Dept Of Defense: Remote code execution (RCE) in multiple DoD websites

A remote code execution RCE vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. Thank you @joaomatosf for notifying us of this vulnerability!...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @eugui was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @eugui !...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @sp1d3rs was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Reflected XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @twicedi was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @albinowax was able to demonstrate this vulnerability by crafting specially formatted URLs. Thank you!...

U.S. Dept Of Defense: Remote Command Execution on a DoD website

A remote command execution RCE vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. @wrench, and other researchers were able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks to @wrench, and other...

U.S. Dept Of Defense: Blind SQLi vulnerability in a DoD Website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive financial information. @sp1d3rs was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you! I was able to demonstrate a possibility to administrator accou...

U.S. Dept Of Defense: Remote Code Execution (RCE) in a DoD website

A remote code execution RCE vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. @0daystolive and @dly were able to demonstrate this vulnerability by developing a custom script that caused the webserver to execute a benign...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @guruprasadmullangi was able to demonstrate this vulnerability by crafting ...

U.S. Dept Of Defense: Potentially sensitive information disclosure on a DoD website

A DoD website was misconfigured in a manner that could have potentially disclosed sensitive information. @scraps was able to demonstrate this vulnerability by searching for certain file types. Thanks @scraps!...

U.S. Dept Of Defense: Content-Injection/XSS ████

Summary: Hi, It is possible to inject content and vulnerable to reflected Cross Site Scripting. Affected domain: https://██████████ Used browser: Mozilla. Impact One of the most common XSS attack vectors is to hijack legitimate user accounts by stealing their session cookies. This allows attacker...

U.S. Dept Of Defense: Remote command execution (RCE) vulnerability on a DoD website

A remote command execution RCE vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. @japp1 was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @japp1!...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @vagmour was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks to @vagmour for discovering this...

U.S. Dept Of Defense: Critical information disclosure at https://█████████

Summary: There is a critical information disclosure at https://████████/rserver/rdPage.aspx?rdReport=dbDashboard&rdShowModes= Description: As you can see in the video the https://████████/rserver/rdPage.aspx?rdReport=dbDashboard&rdShowModes= loads a page with a debug this page functions enabled,...

U.S. Dept Of Defense: Reflected XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @mantis was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: HTML Injection on ████

Summary: HTML Injection vulnerabilities on █████████ Air Base Site. Description: Search value are output without being escaped. HTML Injection via Category parameter...

U.S. Dept Of Defense: Misconfigured user account settings on DoD website

A Department of Defense website was misconfigured in a manner that may have allowed a malicious user to reset, or steal login credentials of legitimate users. @mantis was able to demonstrate this vulnerability by testing the user account application of the website. Thanks @mantis!...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A misconfigured Department of Defense webserver improperly disclosed application information. @joshualaurencio was able to demonstrate this vulnerability by crafting specially formatted URLs...

U.S. Dept Of Defense: Local file inclusion vulnerability on a DoD website

A misconfigured Department of Defense website may have allowed unauthorized users to remotely download local files, potentially revealing sensitive system or user information. @fransrosen was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Blind SQLi in a DoD Website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive financial information. @akaki was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you!...