Uber: SQLI on desafio5estrelas.com

Vendor created and managed site desafio5estrelas.com had a SQLI vulnerability which could potentially expose sensitive data. A time-based blind MYSQL SQLI vulnerability existed at the endpoint https://desafio5estrelas.com/login in the URL parameters "codigo". Basic SQLI that was found on an uber...

Uber: Lack of CSRF protection on uberps.com makes every form vulnerable to CSRF

A malicious website can cause visitors who are currently authenticated to https://uberps.com to take sensitive actions on https://uberps.com A basic CSRF vuln on a old uber microsite. Check out my blog https://healdb.tech/blog/ or my Twitter https://twitter.com/healdben for some Bug Bounty tool...

Grab: [growth.grab.com] Reflected XSS via Base64-encoded "q" param on "my.html" Valentine's microsite

Hi, An encoded injection in the q parameter on my.html can be used to reflect JavaScript in the growth.grab.com context. This microsite creates a "Grab's Valentine" card for a driver over the past year, and carries its data in Base64 format. Proof of concept Please visit the following URL, scroll...

refer.travelzoo.com XSS vulnerability

Vulnerable URL: https://refer.travelzoo.com/zone/microsite?channel=other%27%22--!%3E%3C/Script/%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

refer.avant.com XSS vulnerability

Vulnerable URL: https://refer.avant.com/zone/microsite?utmterm=20150827referral1d%20post%20funding%27%22--!%3E%3C/Script/%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:|...

microsite.vodafone.in Open Redirect vulnerability

Vulnerable URL: http://microsite.vodafone.in/mailer/newsletter/proactivelinks.asp?linkname=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 22.02.2016 Latest check for patch:| 22.02.2016 15:33 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly...