Palo Alto Software: IDOR on notes to HTML injection

Summary: Team member with role USER can change notes of any users and also we able to inject some html tags Steps To Reproduce: 1. Login in with role owner create note 1. login team member with role users 1. add note and capture with burp suite and change the uuid of notes PUT...

Palo Alto Software: Unauthorised access to pagespeed global admin at https://webtools.paloalto.com/

Summary: I came across this subdomain https://webtools.paloalto.com/ which took my attention, after a bit enumeration I found an endpoint which allows anyone to access PageSpeed Global Admin without any type of authentication. Vulnerable URL: https://webtools.paloalto.com/pagespeed-global-admin/...