720 matches found
Zomato: Page has a link to google drive which has logos and a few customer phone recordings
Description: Go to ███████ Refer to the screenshot below ██████ As you can see in the above image, there is is link to access zomato logos.This redirected me to a google drive page which not only had logos but also customer care recordings where sensitive information like Customer mobile...
sberbank-uploads.chatbot.ba GDPR PII Exposure vulnerability
Open Bug Bounty ID: OBB-1146386 Security Researcher dubstard Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting sberbank-uploads.chatbot.ba website and its users. Following coordinated and responsible vulnerability disclosure...
Lollipopz - Data Exfiltration Utility For Testing Detection Capabilities
Data exfiltration utility used for testing detection capabilities of security products. Obviously for legal purposes only. Exfiltration How-To /etc/shadow - HTTP GET requests Server ./lollipopz-cli.py -m lollipopz.methods.http.paramcipher.GETServer -lp 80 -o output.log Client $ ./lollipopz-cli.py...
Quick wins with Adobe Experience Manager
Introduction Adobe Experience Manager AEM, is a comprehensive content management solution for building websites, mobile apps and forms. And it makes it easy to manage your marketing content and assets. If you've ever looked into AEM you may have heard of Mikhail Egorov @0ang3el. He has done some...
cknuckles.com GDPR PII Exposure vulnerability
Open Bug Bounty ID: OBB-1119636 Security Researcher MrBug Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting cknuckles.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO...
U.S. Dept Of Defense: Improper Access Controls Allow PII Leak via ████
Summary: Dashboards in ██████████ allow a user to add widgets and obtain large amounts of information to include PII and diagnostic information. Additionally, a user is able to make changes to certain catalogs via these widgets. Description: Impact An adversary can gain access to PII to include...
U.S. Dept Of Defense: PII Leak via https://████████
Summary: An attacker can create an account on https://████ and gain access to a wealth of PII for practically every member that is registered on the website. This includes e-mail addresses, physical addresses, telephone numbers, and other information about a vast majority of the US Air Force, as...
Booked < 2.2.6 - Broken Authentication to Export Users Data in CSV
The plugin allows users to Book Appointment by providing their PII such as Email, Name, Phone Number and Personal Message. The vulnerability allows anyone to Dump all records of users and their appointment details in CSV as an unauthenticated user. The user also gets registered as a WP User after...
Ultimate Membership Pro < 8.6.2 - Multiple CSRF Issues via AJAX Calls, Insufficient Filename Entropy
Version 8.6.1 attempted fo fix multiple critical issues mainly lack of authorisation checks, allowing low privileges users to call the admin functions of the plugin, leading to PII disclosure and login bypasses. However, the fixes were not sufficient: - An indeedIsAdmin check was added to all AJA...
Ultimate Membership Pro < 8.6.2 - Multiple CSRF Issues via AJAX Calls, Insufficient Filename Entropy
Version 8.6.1 attempted fo fix multiple critical issues mainly lack of authorisation checks, allowing low privileges users to call the admin functions of the plugin, leading to PII disclosure and login bypasses. However, the fixes were not sufficient: - An indeedIsAdmin check was added to all AJA...
U.S. Dept Of Defense: [Critical] Insufficient Access Control On Registration Page of Webapps Website Allows Privilege Escalation to Administrator
Summary: Hello. Due to insufficient access controls and poor implementation of the registration at https://████████/████/login.cfm it was possible to register while privilege escalating to an administrator. Description: It was possible to tamper with the registration request at...
Jailcore database leaks PII of inmates & correctional officers across US
By Sudais Asif Jailcore claims since these are incarcerated individuals, their rights differ substantially from the free lot in terms of privacy. This is a post from HackRead.com Read the original post: Jailcore database leaks PII of inmates & correctional officers across US...
HackerOne: Email address of any user can be queried on Report Invitation GraphQL type when username is known
Summary: Email id of all hackerone users disclosure Description: There is an flaw , with that i can get all hackerone users email id Steps To Reproduce 1. Invoke the below graphql call POST /graphql HTTP/1.1 "query":"mutation Revokecredentialmutation$input0:AddReportParticipantInput!...
culturelab.gr GDPR PII Exposure vulnerability
Open Bug Bounty ID: OBB-1086626 Security Researcher SecuWatch Helped patch 15 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting culturelab.gr website and its users. Following...
sematec-metrologie.com GDPR PII Exposure vulnerability
Open Bug Bounty ID: OBB-1086526 Security Researcher SecuWatch Helped patch 15 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting sematec-metrologie.com website and its users. Followin...
beavrs.org GDPR PII Exposure vulnerability
Open Bug Bounty ID: OBB-1086137 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
fems.asso.fr GDPR PII Exposure vulnerability
Open Bug Bounty ID: OBB-1085684 Security Researcher SecuWatch Helped patch 15 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting fems.asso.fr website and its users. Following...
Ultimate Membership Pro < 8.6.1 - Multiple Critical Vulnerabilities
Multiple Critical Vulnerabilities found in Ultimate Membership Pro could leads to Authenticated using a low privilege account, such as subscriber Remote Code Execution on default Installation, as well as PII disclosure such as emails, IP addresses, hashed passwords, usernames, User-Agent and so o...
Ultimate Membership Pro < 8.6.1 - Multiple Critical Vulnerabilities
Multiple Critical Vulnerabilities found in Ultimate Membership Pro could leads to Authenticated using a low privilege account, such as subscriber Remote Code Execution on default Installation, as well as PII disclosure such as emails, IP addresses, hashed passwords, usernames, User-Agent and so o...
Topcoder: PII of Users Disclosure using "/members/invite/" endpoint
Hello! I found PII Disclosue at https://connect.topcoder.com/projects/ Steps to Reproduce. 1 Go to https://connect.topcoder.com/projects 2 Select an existing project, or create a new one. 3 Select the "Manage Invitations" option. on the left sidebar. 4 Enter the Username/Email of the user you wan...