U.S. Dept Of Defense: Insecure Direct Object Reference (IDOR) vulnerability in a DoD website

A Department of Defense website was vulnerable to an IDOR attack which may allow an attacker to modify web content or certain database parameters. @eugui was able to demonstrate this vulnerability by manipulating web objects in a clever way. Very well done. Thank you!...

U.S. Dept Of Defense: XXE on DoD web server

A Department of Defense webserver was vulnerable to an XML External Entity XXE processing vulnerability. dawgyg was able to exploit this vulnerability by crafting an XML request that revealed sensitive local system information. Thanks dawgyg!...

U.S. Dept Of Defense: Local File Inclusion vulnerability on an Army system allows downloading local files

A misconfigured Army website may have allowed unauthorized users to remotely download local files, potentially revealing sensitive system or user information. Nahamsec was able to demonstrate this vulnerability by crafting a particularly formatted URL. Thanks Nahamsec!...