U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information. Thank you @sp1d3rs for notifying us of this! It was a trivial Full Path Disclosure issue, but still worth reporting...

U.S. Dept Of Defense: Exposed Access Control Data Backup Files on DoD Website

A Department of Defense website was mis-configured to expose access control data backup files, and potentially the personal information of its users. Thanks for notifying us of this, @mazen160!...

U.S. Dept Of Defense: HTML Injection/Load Images vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that may have allowed a malicious user to inject remote content into a website. @jonbottarini was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @jonbottarini!...

U.S. Dept Of Defense: SQL injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @shakaa1 was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @shakaa1!...

U.S. Dept Of Defense: Password reset vulnerability on a DoD website

A password reset vulnerability was found on a DoD website, which could have allowed a malicious user to identify legitimate users and arbitrarily reset their passwords. @sp1d3rs was able to demonstrate this vulnerability by accessing a DoD webpage. Thanks @sp1d3rs!...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @eugui was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @mthirup was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @korprit was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @korprit was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @swissky was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @korprit was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @korprit!...

U.S. Dept Of Defense: Attackers can control which security questions they are presented (████████)

Summary: When clicking on the forgot password link on ██████, the questions used to verify identify can be arbitrarily selected by an attacker. Description: When clicking on the forgot password link on ██████████, the questions used to verify identify can be arbitrarily selected by an attacker...

U.S. Dept Of Defense: Cross-site request forgery (CSRF) vulnerability on a DoD website

A cross-site request forgery vulnerability was found on a Department of Defense website which could trick a web user into posting or changing confidential information, or redirecting sensitive information to the malicious user. @korprit was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: DOM Based XSS on an Army website

A U.S. Army website was vulnerable to a DOM based cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. juliocesar was able to demonstrate this vulnerability by crafting a speciall...

U.S. Dept Of Defense: Reflected cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ahsantahir was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: File upload vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that may have allowed an attacker to bypass tests for malicious files when uploading content. @korprit was able to demonstrate this vulnerability by altering the file sufficiently to defeat signature based analysis. Thanks @korprit!...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @juliocesar was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: Time Based SQL Injection vulnerability on a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive financial information. @psychomantis was able to demonstrate this vulnerability by crafting specially formatted URLs. Thank you! The service being used didn't properly sanitize id...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @mthirup was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks to @mthirup for discovering this...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @juliocesar was able to demonstrate this vulnerability by crafting a...