U.S. Dept Of Defense: Reflected XSS in a Navy website

A cross-site scripting vulnerability was found on a Navy website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. juliocesar was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Remote code execution on an Army website

A webserver hosted by the U.S. Army allowed the execution of local shell commands. meals was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks meals!...

U.S. Dept Of Defense: Violation of secure design principles on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about a user. @spam404 was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability! Passwords stored in cleartext...

U.S. Dept Of Defense: XSS vulnerability on an Army website

A U.S. Army website was vulnerable to a cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. spam404 was able to demonstrate this vulnerability by crafting a specially formatted...

U.S. Dept Of Defense: Reflected XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @korprit was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Persistent XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. korprit was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Arbitrary Script Injection (Mail) in a DoD Website

A DoD website was misconfigured in a manner that could have allowed an attacker to inject malicious code into automated emails sent by the server. @ahsantahir was able to demonstrate this vulnerability by posting a specially formatted webform. Thanks @ahsantahir!...

U.S. Dept Of Defense: Cross-Site Scripting (XSS) on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @clizsec was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Arbitary file download vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application or system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!...

U.S. Dept Of Defense: DNS Misconfiguration

Multiple reporters identified a DNS configuration issue in the defense.gov domain that could allow same-site scripting. Thanks to @myst404 for first reporting this, and to @atik-rahman and others for also reporting it...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @r0p3 was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Information disclosure vulnerability in a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about user sessions. @r0p3 was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Information leakage on a Department of Defense website

A Department of Defense website was misconfigured to disclose potentially sensitive system and user information. korprit was able to demonstrate this vulnerability by requesting a particular webpage and logfile. Thanks korprit!...

U.S. Dept Of Defense: SQL Injection vulnerability on a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive financial information. korprit was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks korprit!...

U.S. Dept Of Defense: Out-of-date Version (Apache)

URL https://████████/ Identified Version 2.2.15 contains 4 important and 10 other vulnerabilities Latest Version 2.2.31 Vulnerability Database Result is based on 27.10.2016 vulnerability database content. Vulnerability Details Link identified you are using an out-of-date version of Apache. Impact...

U.S. Dept Of Defense: XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ramsexy was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ramsexy was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Unrestricted File Upload

A Navy system had a file upload tool accessible from the Internet. This would have permitted an attacker to upload malicious files and potentially execute code on the server. Thanks to @hogarth45 for reporting it...

U.S. Dept Of Defense: Cross-site scripting vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @r0p3 was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Cross-site scripting (XSS) vulnerability on a DoD website

A cross-site scripting XSS vulnerability was found on a Department of Defense. XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @ juliocesar able to demonstrate this vulnerability b...