41 matches found
Udemy: NON VALIDATION OF SESSIONS AFTER PASSWORD CHANGE
bug introduced which prevented password change from invalidating sessions other than the one initiating the password change...
Udemy: Csrf on creating course
The investigator thought that since there was a CSRF token sent for a request that does not enforce CSRF he was bypassing it...
Udemy: Showing Up Source Code
Hello Sir! I have just seen vulnerability in your website: https://blog.udemy.com in this website your website is showing the PHP code of a file named wordpress-importer.php link of this file is listed below: https://blog.udemy.com/wp-content/uploads/2010/09/wordpress-importer.php.txt I have also...
Udemy: AWS S3 bucket writable for authenticated aws user
Hey, I found an open S3 Amazon bucket udemy-maven. While I can’t confirm if you own it or not, it appears that it is publicly writable using the aws cli. When I write to udemy-maven, I get: move: ./test.txt to s3://udemy-maven/test.txt And also when I remove file, I get: delete:...
UFB: Udemy for Business - Customized SSL, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application UFB: Udemy for Business published at the 'play' market has multiple vulnerabilities...
Udemy Online Courses - Customized SSL, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Udemy Online Courses published at the 'play' market has multiple vulnerabilities...
Udemy: Authentication Data are not Clearing
Authentication Data are not Clearing Authentication Data are not Clearing...
Udemy: Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate
I recently purchased a gift for a friend, and noticed the share URL gift ID was simply numeric. I managed to access other people's gifts simply by incrementing and decrementing the ID by 2, I was able to verify that the price was dropped to "Free", regardless of if I was logged in or not, and I w...
Udemy: Stored XSS
Hello, Bug: Stored XSS Payload: " Browser Used: Google Chrome OS: Windows 7 Steps to Reproduce: 1 Log in to your account 2 Click on My Courses 3 Choose any enrolled courses 4 Click on Add Discussion 5 Click on Link - Insert Link 6 In URL use above Payload 7 In Text write anything 8 Click on Inser...
Udemy: Reflected XSS and/or malicious redirection via JWPlayer 6 configuration modification
1 Malicious attacker by visiting course page e.g. https://www.udemy.com/overview-of-big-data-hadoop/ and intercepting browser's generated requests can find one to the following URL:...
Udemy: XSS Vulnerability
Hi, I just want to report a XSS Vulnerability POC: Fire up LIVEHTTPHEADERS and capture the request - I upload 2015-08-24162829.png as my file name -After capturing the request, rename you image into '" as payload...
Udemy: information disclosure
THe below URLs showing the version number of the application : http://about.udemy.com/readme.html http://about.udemy.com/wp-content/plugins/all-in-one-seo-pack/readme.txt...
Udemy: Extremely high Course rating values could be set in order to make really high Average rating of the course. Negative values could be set to.
Authenticated user can register for some course paid or free. After registering and taking couple of lectures "Rate course" functional becomes active. Malicious user can fill the rating form and submit it. By intercepting request to the server's API by using intercepting proxy tool and modify...
Udemy: Multiple sub domain are vulnerable because of leaking full path
At the following address i have found debug.log file disclose the application full path onthe server. https://business.udemy.com/wp-content/debug.log http://about.udemy.com/wp-content/debug.log THe below URLs showing the version number of the application : http://about.udemy.com/readme.html...
Udemy: XSS on https://www.udemy.com/asset/export.html
Description https://www.udemy.com/asset/export.html is used to generate a content of a lecture and it will be dispalyed on https://www.udemy.com/staticx/udemy/flash/udemypresentation.player.swf?. https://www.udemy.com/asset/export.html contain json response but the content type is text/html,...
Udemy: Ability to add pishing links in discusion ," Bypassing uneductional Links add "
refer to case number 247874 Hey devs , IF you went in course discussion and tried to add for example " evil.com " it will get blocked by your system . But if you tried to add https://support.udemy.com/ it will be added directly So using a thing i learned in old times th ' @ ' sign after a website...
Udemy: leak receipt of another user
A attacker can leak receipt information of another user by using the forced browse. by changing single char here i see another user's receipt https://www.udemy.com/dashboard/pdf-receipt/?invnum=PD-CC-66574B6C57334B626B366B39...
Udemy: xss on autoserch
i have found a XSS on auto search endpoint https://www.udemy.com/autocomplete/search/?cl=EyNkHjsRED4T&displayType=json&cf=ExRONTsRED5COkUCGxAHKV8HaTMPDBFu&count=4&term=%22%3E%3Cimg+src%3D%3E...
Udemy: teach.udemy.com log poison vulnerability through wordpress debug.log being publically available
Hello udemy your site teach.udemy.com has its debug.log publically available consisting of 1 gb of debug logs. The logs don't expose critical information except for some user ip addresses, mail-addresses and other info, but it may lead to remote code execution,since the logs also store user agent...