U.S. Dept Of Defense: Remote code execution vulnerability on a DoD website

A remote code execution RCE vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. Thank you @mantis for notifying us of this vulnerability!...

U.S. Dept Of Defense: Bypass file access control vulnerability on a DoD website

A DoD website was configured in a manner that allowed a remote user to bypass a file access control. This vulnerability could have allowed the user to view potentially sensitive system files. @generaleg able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @generale...

U.S. Dept Of Defense: Cross-site scripting (XSS) on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @reptou was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Stored XSS vulnerability on a DoD website

A stored cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @rashedhasan007 was able to demonstrate this vulnerability by crafti...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information. Thank you @jonbottarini for notifying us of this!...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information. Thank you @sp1d3rs for notifying us of this! I discovered a publicy accessible internal statistics module in the Army system. The module was outdated and unused, however, it disclosed some...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information. Thank you @sp1d3rs for notifying us of this! I discovered a publicy accessible internal admin/superadmin interface. The problem was fixed by restricting the access to this interface...

U.S. Dept Of Defense: Server side information disclosure

A misconfigured Department of Defense webserver improperly disclosed configuration information when returning an error page. sulemanmalik03 was able to demonstrate this vulnerability by crafting a particularly formatted URL. Thanks sulemanmalik03!...

U.S. Dept Of Defense: Remote code execution vulnerability on a DoD website

A remote code execution RCE vulnerability was found on a DoD website which could have enabled an attacker to execute remote commands on the web server. Thank you @korprit for notifying us of this vulnerability!...

U.S. Dept Of Defense: Open FTP server on a DoD system

Summary: I don't know if this qualifies but during my search I discovered an open FTP panel that I was able to successfully log into. Using any FTP program, I used File zilla and then entered ████ as my host then connected. Then I was able to look through any of the files. I noticed the last...

U.S. Dept Of Defense: Default credentials on a DoD website

A Department of Defense website was misconfigured in a manner that may have allowed a malicious user to reset, or steal login credentials. @korprit was able to demonstrate this vulnerability by testing the user account application of the website. Thanks @korprit!...

U.S. Dept Of Defense: DOM Based XSS on a DoD website

A DoD website was vulnerable to a DOM based cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. @juliocesar was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @juliocesar was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: Server Side Request Forgery (SSRF) vulnerability in a DoD website

A Department of Defense webserver was vulnerable to an SSRF attack that could have enabled a remote user to send custom web requests from the vulnerable system. @korprit was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @korprit!...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A misconfigured Department of Defense webserver improperly disclosed application information.@babayaga was able to demonstrate this vulnerability by crafting specially formatted URLs...

U.S. Dept Of Defense: Information disclosure on a DoD website

A Department of Defense website was misconfigured to disclose potentially sensitive system and user information. @mr47 was able to demonstrate this vulnerability by requesting specific web files. Thanks @mr47!...

U.S. Dept Of Defense: Time Based SQL Injection vulnerability on a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive financial information. @korprit was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you!...

U.S. Dept Of Defense: Authentication bypass vulnerability on a DoD website

A Department of Defense website was exposed to an authentication bypass vulnerability which could have allowed an unauthenticated user to browse the website as an authenticated user. Thanks to @spam404 for discovering this vulnerability!...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information about the web application or system. @reptou was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us!...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A misconfigured Department of Defense webserver improperly disclosed application information. @clizsec was able to demonstrate this vulnerability by crafting a specially formatted URL...