Browse / LocalTapiola

LocalTapiola

See its reports on the map

What gets reported to LocalTapiola

• Cross-site Scripting25
• Information Disclosure17
• Misconfiguration13
• SQL Injection12
• Denial of Service11
• Access Control5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Oracle Webcenter Sites administrative and hi-privilege access available directly from the internet (/cs/Satellite)Uncontrolled Resource Consumption
   $18,000264 votes
2. RCE using bash command injection on /system/images (toimitilat.lahitapiola.fi)OS Command Injection
   209 votes
3. CORS misconfiguration allows to steal client's "password", Authorization token and the customer details e.g. names, SSN, bank account etc.Improper Authentication - Generic
   86 votes
4. CORS misconfiguration allows to steal customers data Violation of Secure Design Principles
   84 votes
5. Blind Stored XSS Against Lahitapiola Employees - Session and Information leakageCross-site Scripting (XSS) - Generic
   70 votes
6. Blind Stored XSS Against Lahitapiola Employees - Session and Information leakageCross-site Scripting (XSS) - Generic
   $5,00070 votes
7. User able to access company details in yrityspalvelu without proper permissionsImproper Authentication - Generic
   $2,00063 votes
8. SQL Injection /webApp/oma_conf ctx parameter (viestinta.lahitapiola.fi)SQL Injection
   $1,35050 votes
9. SQL Injection on /webApp/omatalousuk (viestinta.lahitapiola.fi)SQL Injection
   41 votes
10. PHPMYADMIN Setup is accessible without authentication on https://lml.lahitapiola.fi/Improper Access Control - Generic
    38 votes
11. Cookie exfiltration through XSS on the main search request of www.lahitapiola.fiCross-site Scripting (XSS) - DOM
    $50036 votes
12. SQL Injection in sijoitustalous_peruutus (viestinta.lahitapiola.fi)SQL Injection
    36 votes
13. Wordpress Users Disclosure (/wp-json/wp/v2/users/)Information Disclosure
    $5032 votes
14. Open Redirect (verkkopalvelu.lahitapiola.fi)Open Redirect
    $40028 votes
15. SQL Injection on `/cs/Satellite` pathSQL Injection
    27 votes
16. Persistent XSS at verkkopalvelu.tapiola.fi using spoofed React element and React v.0.13.3Cross-site Scripting (XSS) - Generic
    27 votes
17. xmlrpc.php FILE IS enable it will used for bruteforce attack and denial of serviceUncontrolled Resource Consumption
    $31526 votes
18. SQL Injection /webApp/cancel_iltakoulu regId parameter (viestinta.lahitapiola.fi)SQL Injection
    26 votes
19. Reflected XSS+CSRF on secure.lahitapiola.fiCross-site Scripting (XSS) - Reflected
    23 votes
20. Malicious file upload (secure.lahitapiola.fi)Violation of Secure Design Principles
    22 votes
21. Secure Client-Initiated RenegotiationCryptographic Issues - Generic
    21 votes
22. User Information Disclosure via the REST API - /?_method=GETInformation Disclosure
    19 votes
23. SQL Injection in lapsuudenturva (viestinta.lahitapiola.fi)SQL Injection
    19 votes
24. F5 BIG-IP Cookie Remote Information DisclosureInformation Disclosure
    18 votes
25. SQL Injection on /webApp/sijoitustalousuk email-parameter + potential lack of CSRF Token (viestinta.lahitapiola.fi)SQL Injection
    $1,35018 votes
26. Error Page Content Spoofing or Text Injection (viestinta.lahitapiola.fi)Violation of Secure Design Principles
    17 votes
27. CSRF allows attacker to delete item from customer's "Postilaatikko"Cross-Site Request Forgery (CSRF)
    16 votes
28. Single user DOS on selectedLanguage -cookie (yrityspalvelu.lahitapiola.fi)Violation of Secure Design Principles
    $40015 votes
29. SQL Injection /webApp/sijoitustalous_peruutus locId parameter (viestinta.lahitapiola.fi)SQL Injection
    $35015 votes
30. HTML Injection in email /webApp/lahti (viestinta.lahitapiola.fi)Cross-site Scripting (XSS) - Generic
    $26415 votes
31. Email Server Compromised at secure.lahitapiola.fiCode Injection
    15 votes
32. Cookie-based client-side denial-of-service to all of the Lähitapiola domainsCross-Site Request Forgery (CSRF)
    15 votes
33. WordPress username enumeration (/author)Information Disclosure
    13 votes
34. Sitemap causing strain on your Lahitapiola.fi serverUncontrolled Resource Consumption
    13 votes
35. Reflected XSS (myynti.lahitapiolarahoitus.fi)Cross-site Scripting (XSS) - Reflected
    12 votes
36. CSRF possible when SOP Bypass/UXSS is availableViolation of Secure Design Principles
    $5012 votes
37. Reflected XSS and Open Redirect in several parameters (viestinta.lahitapiola.fi)Cross-site Scripting (XSS) - Generic
    12 votes
38. Content Spoofing or Text Injection (404 error page injection on yrityspalvelu)Violation of Secure Design Principles
    12 votes
39. Reflected XSS of bbe-child-starter Theme via "value"-GET-parameterCross-site Scripting (XSS) - Reflected
    11 votes
40. High server resource usage on captcha (viestinta.lahitapiola.fi)Uncontrolled Resource Consumption
    11 votes
41. Remote Code Execution in NovaStor NovaBACKUP DataCenter backup software (Hiback)Code Injection
    $10011 votes
42. CRLF injection in https://verkkopalvelu.lahitapiola.fi/CRLF Injection
    $40011 votes
43. F5 BigIP Backend Cookie DisclosureInformation Disclosure
    10 votes
44. Reflected XSS on bbe_open_htmleditor_popup.php of BBE Theme via "value"-GET-parameterCross-site Scripting (XSS) - Reflected
    10 votes
45. The parameter in the POST query allows to control size of returned page which in turn can lead to the potential DOS attackUncontrolled Resource Consumption
    $31510 votes
46. Open Redirect bypass and cookie leakage on www.lahitapiola.comOpen Redirect
    $40010 votes
47. Non-secure requests to www.lahitapiola.fi are not automatically upgraded to HTTPSCryptographic Issues - Generic
    10 votes
48. Mixed Active Scripting Issue on https://www.lahitapiola.fiViolation of Secure Design Principles
    10 votes
49. Exposed authentication (/cs/Satellite)Improper Restriction of Authentication Attempts
    9 votes
50. Single user DOS on selectedLanuage -cookie at (verkkopalvelu.tapiola.fi)Uncontrolled Resource Consumption
    $1009 votes
51. Single User DOS on SelectedLocale -cookie (verkkopalvelu.tapiola.fi)Uncontrolled Resource Consumption
    $4009 votes
52. Test Page available with Server details on /r/test (viestinta.lahitapiola.fi)Information Disclosure
    9 votes
53. Multiple Vulnerabilities in Oracle Webcenter Sites (/cs/Satellite)SQL Injection
    $6009 votes
54. Creating arbitrary cookies values /cs/CookieServer (www.lahitapiola.fi)Misconfiguration
    $1509 votes
55. Reflected XSS on sankarikoulutus (viestinta.lahitapiola.fi)Cross-site Scripting (XSS) - Generic
    9 votes
56. SMTP configuration vulnerability viestinta.lahitapiola.fi
    $1009 votes
57. Poodle attack SSLv3 Support (viestinta.lahitapiola.fi)Cryptographic Issues - Generic
    9 votes
58. DoS of www.lahitapiolarahoitus.fi via CVE-2018-6389 exploitationUncontrolled Resource Consumption
    8 votes
59. Authorization issue on 'valtakirjat' (/e2/verkkopalvelu/)Insecure Direct Object Reference (IDOR)
    8 votes
60. Cleartext protocol after bank authentication (yrityspalvelu.tapiola.fi)Violation of Secure Design Principles
    8 votes
61. High server resource usage on captcha (viestinta.lahitapiola.fi)Uncontrolled Resource Consumption
    $3158 votes
62. SQL Injection on /webApp/lapsuudenturva (viestinta.lahitapiola.fi)SQL Injection
    8 votes
63. Sql injection on /webApp/sijoituswebinaari (viestinta.lahitapiola.fi)SQL Injection
    8 votes
64. SQL Injection on /webApp/viivanalle (viestinta.lahitapiola.fi)SQL Injection
    8 votes
65. Multiple Reflected XSS /webApp/lahti (viestinta.lahitapiola.fi)Cross-site Scripting (XSS) - Generic
    $1508 votes
66. Open redirection protection bypass (/cs/Satellite)Open Redirect
    8 votes
67. Flash-based XSS on mediaelement-flash-audio-ogg.swf of www.lahitapiolarahoitus.fiCross-site Scripting (XSS) - Reflected
    7 votes
68. Disclosure of Users Information via Wordpress API (?rest_route)Information Disclosure
    $507 votes
69. CSRF bypass + XSS on verkkopalvelu.tapiola.fiCross-site Scripting (XSS) - Generic
    7 votes
70. /icons/README available on viestinta.lahitapiola.fiViolation of Secure Design Principles
    7 votes
71. XSS and open redirect in verkkopalvelu.lahitapiola.fiCross-site Scripting (XSS) - Generic
    7 votes
72. Internal IP Address Disclosure at https://www.lahitapiolarahoitus.fi/wp-json/wp/v2/pagesInformation Disclosure
    $506 votes
73. Securemail server used to internal spam and resource exhaustionUncontrolled Resource Consumption
    $2646 votes
74. Information exposure via error pages (www.lahitapiola.fi Tomcat)Information Exposure Through an Error Message
    6 votes
75. Reflected XSS Vulnerability in https://www.lahitapiola.fi/cs/SatelliteCross-site Scripting (XSS) - Reflected
    $2506 votes
76. Possible sweet32 lahitapiola.fi
    6 votes
77. HTML Injection in email from http://www.lahitapiola.fi/henkilo/sivut/tonttutestiCross-site Scripting (XSS) - Generic
    $2646 votes
78. Brute force unsubscription on /webApp/unsub_sb (viestinta.lahitapiola.fi)Cross-Site Request Forgery (CSRF)
    $2006 votes
79. Blacklist bypass for /cs/Satellite (www.lahitapiola.fi)Improper Access Control - Generic
    $6006 votes
80. Disclosure of IBM Websphere pageViolation of Secure Design Principles
    6 votes
81. Reflected XSS in LTContactFormReceiver (/cs/Satellite)Cross-site Scripting (XSS) - Generic
    $506 votes
82. /icons/README is still available on viestinta.lahitapiola.fiViolation of Secure Design Principles
    $505 votes
83. Option method enabled (viestinta.lahitapiola.fi)Information Disclosure
    5 votes
84. Lahitapiola´s customer names send to 3rd partyInformation Disclosure
    $5885 votes
85. The PdfServlet-functionality used by the "Tee vakuutustodistus" allows injection of custom PDF-content via CSRF-attackCross-Site Request Forgery (CSRF)
    5 votes
86. Verbose error message reveals internal system hostnames, protols and used ports (yrityspalvelu.tapiola.fi)Information Disclosure
    4 votes
87. Reflected XSS Vulnerability in www.lahitapiola.fi/cs/SatelliteCross-site Scripting (XSS) - Reflected
    $2504 votes
88. XSS on 3rd party service Localtapiola is usingCross-site Scripting (XSS) - Generic
    $1004 votes
89. Exploiting Secure Shell (SSH) on mobilelt.lahitapiola.fiMemory Corruption - Generic
    $1004 votes
90. Abusing and Hacking the SMTP Server secure.lahitapiola.fiPrivilege Escalation
    $3004 votes
91. HTTP status code manipluation & java stack trace Information Disclosure
    $1004 votes
92. Enumeration in unsubscribe -function of /omatalousuk (viestinta.lahitapiola.fi)Privilege Escalation
    3 votes
93. Reflected XSS on iltakoulu_varkaus (viestinta.lahitapiola.fi)Cross-site Scripting (XSS) - Generic
    3 votes
94. Reflected XSS and Open Redirect (verkkopalvelu.lahitapiola.fi)Cross-site Scripting (XSS) - Generic
    $4003 votes
95. Suspicious browser fingerprinting(?) scripts on http://www.lahitapiola.fi/ redirectorViolation of Secure Design Principles
    $1003 votes
96. Amazon Bucket Accessible (http://inpref.s3.amazonaws.com/)Information Disclosure
    3 votes
97. Posting modified information in 'Investment section' will cause unintended information change in verkkopalvelu.tapiola.fiUncontrolled Resource Consumption
    $1,0003 votes
98. User Information Disclosure via Json responseInformation Disclosure
    $502 votes
99. show control page if you insert ' at http://viestinta.lahitapiola.fi/Privilege Escalation
    2 votes
100. OpenSSL Padding Oracle Attack (CVE-2016-2107) on viestinta.lahitapiola.fiCryptographic Issues - Generic
     2 votes