U.S. Dept Of Defense: Violation of secure design principles on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about a user. @spam404 was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability! Passwords stored in cleartext...

U.S. Dept Of Defense: Arbitrary Script Injection (Mail) in a DoD Website

A DoD website was misconfigured in a manner that could have allowed an attacker to inject malicious code into automated emails sent by the server. @ahsantahir was able to demonstrate this vulnerability by posting a specially formatted webform. Thanks @ahsantahir!...

U.S. Dept Of Defense: Arbitary file download vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application or system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!...

U.S. Dept Of Defense: Information disclosure on a DoD website

A Department of Defense website was misconfigured to disclose potentially sensitive system and user information. @r0p3 was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @r0p3!...

U.S. Dept Of Defense: DNS Misconfiguration

Multiple reporters identified a DNS configuration issue in the defense.gov domain that could allow same-site scripting. Thanks to @myst404 for first reporting this, and to @atik-rahman and others for also reporting it...

U.S. Dept Of Defense: Information disclosure vulnerability in a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about user sessions. @r0p3 was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Information leakage on a Department of Defense website

A Department of Defense website was misconfigured to disclose potentially sensitive system and user information. korprit was able to demonstrate this vulnerability by requesting a particular webpage and logfile. Thanks korprit!...

U.S. Dept Of Defense: RCE on a Department of Defense website

A misconfigured webserver hosted by the Department of Defense allowed the execution of local shell commands. dawgyg was able to demonstrate this vulnerability by crafting a particularly formatted URL. Thanks dawgyg!...

Boozt Fashion AB: Cookie Misconfiguration

Hello, Great Day, I just want to Inform You that i Founded an Misconfiguration in your Website with android app. Steps to Reproduce ==================== 1.Login in to your Website https://www.boozt.com/login 2.Login with same account on android 3.Change Password ion Website 4.As You See That pass...

Shopify: Misconfiguration in Two Factor Authorisation

Hey There seems to be a weird misconfiguration which leads to bypass of two factor authorisation Scenario 1. Let's assume you have setup Two Factor Authorisation with Google Authenticator 2. You now activate Google Apps from Login services at https://shop-1.myshopify.com/admin/settings/account 3...

GitLab: Mailgun misconfiguration leads to email snooping and postmaster@-access on email.mg.gitlab.com

Hi, Previously a blog post went out about Uber's Sendgrid issues: http://blog.pentestnepal.tech/post/149985438982/reading-ubers-internal-emails-uber-bug-bounty Also, a report from @uranium238 went out due to a similar issue with Slack that I know uses Mailgun: https://hackerone.com/reports/163938...

Broken CORS

Overview Affected versions of sails have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious...

Aternity version 9 vulnerable to cross-site scripting and remote code execution

Overview The Aternity webserver, version 9 and prior, is reportedly vulnerable to cross-site scripting XSS on several web pages, and remote code execution via inclusion of untrusted functionality by default due to improper authentication before execution. Description CWE-80: Improper Neutralizati...

The vulnerability of the Microsoft Office software package, which allows a hacker to bypass the ASLR protection mechanism

The vulnerability of the Click-to-Run package for Microsoft Office programs is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the ASLR protection mechanism by using a specially created application...

Zomato: CSRF in the "Add restaurant picture" function

Overview I found a CSRF vulnerability within the process responsible for adding photos for a restaurant which can lead to tricking victims into adding arbitrary photos to their restaurant's page. Details The CSRF vulnerability exists due to a misconfiguration on your part in which your X-CSRF-TOK...

Zomato: CORS Misconfiguration on www.zomato.com

The website at https://www.zomato.com tries to use Cross-Origin Resource Sharing CORS to allow cross-domain access from all subdomains of zomato.com. However, due to a flaw in the implementation, it actually allows cross-domain access from all domains ending in zomato.com including notzomato.com ...

Legal Robot: 2 vulns

the first report is concerning AWS S3 bucket Readable for authenticated aws users , the same as this report 163476 the bucket is sdk.amazonaws.com , i believe it's yours because i found it in a Head request to https://app.legalrobot.com/ : F115189 listing the bucket : 115190 i don't have any...

Legal Robot: Information Disclosure in AWS S3 Bucket

Hi, While this doesn't fall directly under the Program scope, I feel that the subject of this report is directly connected to the primary Legal Robot web properties and would like to inform your team in case this was a misconfiguration concern. I noticed that legalrobot.amazonaws.com is configure...

New Relic: Cookie Misconfiguration

1 install add ons "Edit this Cookie" in google chrome" 2 login your account/create an account 3 get the cookie using "edit this cookie" 4 logout the account 5 delete the current cookie using edit this cookie and put the cookie what you copy and refresh the tab Video...

Mozilla Firefox Forgery Attack Vulnerability

Mozilla Firefox is an open source web browser; Mozilla Firefox fails to properly set the LINKABLE and URISAFEFORUNTRUSTEDCONTENT flags for about: URLs used by error pages, allowing remote attackers to exploit the vulnerability to build malicious WEB pages that can be tricked into parsing by users...