Improper access control

An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior t...

CVE-2020-10516

GitHub Enterprise Server (API) vulnerability: improper access control allowed an organization member to escalate permissions and access unauthorized repositories within an org. Affected all versions prior to 2.21; fixed in 2.20.9, 2.19.15, and 2.18.20. Exploitation status and in‑the‑wild details ...

lade.org.lb Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1179583 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Establishing risk appetite is key to effective risk management

The mission of an enterprise risk management program is to respond to and monitor risks to the enterprises operations and objectives. In order to properly respond to and monitor risks, the enterprise must establish risk appetite thresholds. Well-established and well-communicated risk appetite...

sc08.supercomputing.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1167885 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Build support for open source in your organization

Have you ever stared at the same lines of code for hours only to have a coworker identify a bug after just a quick glance? That’s the power of community! Open source software development is guided by the philosophy that a diverse community will produce higher quality code by allowing anyone to...

neres.org Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1165965 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

FedRAMP – 8 years in and 100 assessments achieved

Back in 2011, if you had asked me what cloud computing was, I would have looked at you with a blank look on my face. At the time, I was supporting a Federal client when my boss asked me to assist in applying to become a 3PAO. I had no clue what 3PAO even stood for it stands for Third-Party...

idec.org.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1163620 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

csfyemen.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1160510 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Helium: unpermitted user can change the device name of admin account

Invited user with only the read-only permission can change the device name in admin account 1.create two account 'A 'and 'B ' in console.helium 2.Invited the account 'B' with 'A' by giving the read-only permission 3.In account 'B' trying to delete the organization created by admin account 'A' and...

Mail.ru: Cross-organization data access in city-mobil.ru

A legitimate partner's superuser account could have access to information of driver belonging to different partner, including passport and driving license data. Combined Improrer Access + IDOR It was possible to get access to passport, drive license any taxi driver. As well as changed settings...

How An Image Could've Let Attackers Hack Microsoft Teams Accounts

Microsoft has patched a worm-like vulnerability in its Teams workplace video chat and collaboration platform that could have allowed attackers to take over an organization's entire roster of Teams accounts just by sending participants a malicious link to an innocent-looking image. The flaw,...

A Dozen Nation-Backed APTs Tap COVID-19 to Cover Spy Attacks

Cybercriminals have seized on the novel coronavirus as a theme in their attacks, and it turns out that the most sophisticated players on that scene are no exception. According to Google’s Threat Analysis Group TAG, more than a dozen nation-state-backed APTs are using the COVID-19 pandemic as a...

antiporno.org Open Redirect vulnerability

Open Bug Bounty ID: OBB-1145983 Security Researcher myNickName Helped patch 200 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting antiporno.org website and its users. Following...

oratid.org Open Redirect vulnerability

Open Bug Bounty ID: OBB-1145915 Security Researcher myNickName Helped patch 190 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting oratid.org website and its users. Following...

Oracle E-Business Suite Human Resources Organization Hierarchy Viewer PosServer SQL Injection Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of Oracle E-Business Suite Human Resources. Authentication is required to exploit this vulnerability. The specific flaw exists within the Organization Hierarchy Viewer. The issue results from the lack of...

Oracle E-Business Suite Human Resources Organization Hierarchy Viewer OrgServer SQL Injection Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of Oracle E-Business Suite Human Resources. Authentication is required to exploit this vulnerability. The specific flaw exists within the Organization Hierarchy Viewer. The issue results from the lack of...

Description of the security update for SharePoint Server 2013: May 9, 2017

Description of the security update for SharePoint Server 2013: May 9, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...

bioinformatics.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1137688 Security Researcher Dipu1A Helped patch 1014 vulnerabilities Received 6 Coordinated Disclosure badges Received 22 recommendations , a holder of 6 badges for responsible and coordinated disclosure, found a security vulnerability affecting bioinformatics.org website...