Wrong implementation of OperatorResolver::areOperatorsImported

This issue has been created to upgrade a QA report submission to a medium severity finding. From kenzo: Wrong implementation of OperatorResolver::areOperatorsImported The function as implemented will return true if the operators have same implementation but different selector, or different...

areOperatorsImported has incorrect logic

This issue has been created to upgrade a QA report submission to a medium severity finding. From 0xliumin: areOperatorsImported has incorrect logic Right now, this function returns false if the implementation AND the selector don't match. It's possible to provide a destination with either a...

qa.guidelinecentral.com Cross Site Scripting vulnerability OBB-2388793

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Applied YARA training Q&A

Introduction On August 31, 2021 we ran a joint webinar between VirusTotal and Kaspersky, with a focus on YARA rules best practices and real world examples. If you didnt have the chance to watch the webinar live, you can see it as a recording on Brighttalk: Applied YARA training. During the webina...

R3: Exposed Prometheus instance at prometheus.qa.r3.com

Summary Hi there, just wanted to note that all of your assets are listed as out of scope on HackerOne right now, which is a bit confusing. Nevertheless, I noticed that your Prometheus server at prometheus.qa.r3.com is exposed to the internet, which appears to let you view all of the internal...

Mail.ru: Information Disclosure on qa-delivery-srv.plazius.ru

Performance metrics were available at qa-delivery-srv.plazius.ru...

XSS Vulnerability in the CmsEasyQA Reward Q&A System of Siping City Jiuzhou Yitong Technology Co.

CmsEasyQA Reward Q&A System is a php Q&A system developed in PHP+MySQL. CmsEasyQA Reward Q&A System of Siping City Jiuzhou Yitong Technology Co., Ltd. has an XSS vulnerability, which can be exploited by attackers to obtain sensitive information such as user cookies...

novddostest3.qa-apptrana.info.indussecure.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1063720 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

novddostest2.qa-apptrana.info.indussecure.com Cross Site Scripting vulnerability

Security Researcher Gh05tPT Helped patch 6855 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting novddostest2.qa-apptrana.info.indussecure.com website an...

advancebat1005.qa-apptrana.info.indusguard.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1063663 Security Researcher Gh05tPT Helped patch 6884 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

SQL Injection Vulnerability in ASK2 Q&A System Backend uid Parameter

ask2 Q&A system is whatsns product community, providing free version of the open source php Q&A system, integration of paid Q&A system, paid voice Q&A system, comes with a super collection of features, rapid station building, powerful seo optimization. ASK2 Q&A system background uid parameters...

CVE-2017-18605

The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection...

Design/Logic Flaw

The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection...

CVE-2017-18605

CVE-2017-18605 affects the gravitate-qa-tracker WordPress plugin up to version 1.2.1, which is vulnerable to PHP Object Injection due to insecure handling of serialized data. Exploitation is reported to be possible over HTTP requests (unauthenticated), enabling object-injection-based impact. Othe...

Question2Answer User Account Creation Vulnerability

Question2Answer is a PHP implementation of the class StackOverflow website question and answer system . A security vulnerability exists in the qa-include/qa-install.php file in Question2Answer versions prior to 1.7.5. A remote attacker can exploit this vulnerability to create multiple user accoun...

CVE-2017-12775

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

Stored Cross-Site Scripting Vulnerability in ASK2 user.php

ASK2 Q&A system belongs to the Beijing Zhengying Network Technology Company's products , is a set of open source php Q&A system , integration of paid Q&A system , paid voice Q&A system . ASK2 user.php has a stored cross-site scripting vulnerability , because the system fails to strictly filter th...

qa-archive-it.org XSS vulnerability

Vulnerable URL: https://www.qa-archive-it.org/organizations/318?fc=metaSubject%3AGay+community%22%3Cbody/onpageshow=%22alert%22--!%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E%22San+Antonio.=metaPublisher%3AUniversity+of+Texas+at+San+Antonio Details: Description| Value ---|--- Patched:| No Latest che...

Gravitate QA Tracker <= 1.2.1 - Unauthenticated PHP Object Injection

The plugin gravitate-qa-tracker insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. Attack is exploitable over HTTP requests to sites with the gravitate-qa-tracker Plugin. The original researcher...

Gravitate QA Tracker <= 1.2.1 - Unauthenticated PHP Object Injection

The plugin gravitate-qa-tracker insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. PoC Attack is exploitable over HTTP requests to sites with the gravitate-qa-tracker Plugin. The original...