Khan Academy: SignUp With Fake Email

Hello KhanAcademy Security Team, I'm rootbakar, I found an oddity that allows a user to register with Khanacademy using an invalid or fake email. In this trial I used the email '[email protected]' and after pressing the SIGN UP button it will automatically enter the user dashboard pag...

insuranceadvice.com XSS vulnerability

Open Bug Bounty ID: OBB-670851 Description| Value ---|--- Affected Website:| insuranceadvice.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

meetav.com XSS vulnerability

Open Bug Bounty ID: OBB-669390 Description| Value ---|--- Affected Website:| meetav.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

dash.trck.me XSS vulnerability

Open Bug Bounty ID: OBB-655855 Description| Value ---|--- Affected Website:| dash.trck.me Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

paintedcabernet.com XSS vulnerability

Open Bug Bounty ID: OBB-653968 Description| Value ---|--- Affected Website:| paintedcabernet.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-14474

views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup...

CVE-2018-14474

CVE-2018-14474 affects Orange Forum 1.4.0, with an open redirect in views/auth.go triggered by the next parameter to /login or /signup. The vulnerability allows an attacker to redirect users to a malicious site, potentially enabling phishing or credential theft. Several connected sources (e.g., N...

PT-2018-12543

Name of the Vulnerable Software and Affected Versions Orange Forum version 1.4.0 Description The issue in Orange Forum allows Open Redirection via the next parameter to "/login" or "/signup" API endpoints. This can be exploited by manipulating the next parameter. Recommendations For Orange Forum...

rixtkuiper.com XSS vulnerability

Open Bug Bounty ID: OBB-644306 Description| Value ---|--- Affected Website:| rixtkuiper.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

vedantu.com XSS vulnerability

Open Bug Bounty ID: OBB-641895 Description| Value ---|--- Affected Website:| vedantu.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cloudflare: Private API key leakage due to lack of access control

The lack of access control on the https://mobilesdk.cloudflare.com/api/v1/ api allows for a remote attacker to access and steal a logged in user's private data. This can be done due to the lack of origin protection. An attacker can embed the config URI...

resbook.com XSS vulnerability

Open Bug Bounty ID: OBB-639068 Description| Value ---|--- Affected Website:| resbook.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Liberapay: Liberapay Non Verified Account Takeover with signup feature

Hi, So i saw a strange behaviour of your web on signup feature when that can be escalated to Account Takeover but for limited timeline, Issue: When a New user signup for an account on https://en.liberapay.com/ he have to enter his email address only and it doesn't say anything about sending a...

GSA Bounty: Multiple Bugs in api.data.gov/signup endpoint leads to send custom messages to Anyone

Hey there, while signing for new api key, i have found two bugs that is unusual and make anyone to send crafted or customised email to someone. Bug 1: - low 1. Go to https://api.data.gov/signup/ 2. Enter first and last name , then enter email id and get api key. Bug: You can use the same email id...

musclecarmag.com.au XSS vulnerability

Open Bug Bounty ID: OBB-608975 Description| Value ---|--- Affected Website:| musclecarmag.com.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

blogmn.net XSS vulnerability

Open Bug Bounty ID: OBB-602800 Description| Value ---|--- Affected Website:| blogmn.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

travel-solutions.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-600085 Description| Value ---|--- Affected Website:| travel-solutions.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

hermitageart.com XSS vulnerability

Open Bug Bounty ID: OBB-598465 Description| Value ---|--- Affected Website:| hermitageart.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

mdundo.com XSS vulnerability

Open Bug Bounty ID: OBB-591711 Description| Value ---|--- Affected Website:| mdundo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Honeypot strategy is no longer effectively preventing spam account signup

panel:title=Fix From 3.9.5 onwards we have turned off the honeypot in favour of using captcha anyone affected by this issue just needs to switch the CAPTCHA on...