Browse / Paragon Initiative Enterprises

Paragon Initiative Enterprises

See its reports on the map

What gets reported to Paragon Initiative Enterprises

• Misconfiguration18
• Information Disclosure17
• Other weaknesses7
• Authentication7
• Cross-site Scripting6
• Cryptography5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. BAD Code ! N/ACommand Injection - Generic
   549 votes
2. DMARC Not found for paragonie.com URGENTSpamXML External Entities (XXE) · critical
   147 votes
3. Subdomain TakeoverN/AInformation Disclosure · critical
   83 votes
4. I am because bugSpamcritical
   40 votes
5. [Critical] billion dollars issueSpamMan-in-the-Middle · critical
   32 votes
6. ssl info shown N/ACryptographic Issues - Generic
   32 votes
7. Stored Cross-Site-Scripting in CMS Airship's authors profilesCross-site Scripting (XSS) - Generic
   24 votes
8. Email SpoofSpamImproper Authentication - Generic
   19 votes
9. Site support SNI But Browser can'tSpamCommand Injection - Generic
   17 votes
10. Spf SpamImproper Authentication - Generic
    17 votes
11. Content-type sniffing leads to stored XSS in CMS Airship on Internet Explorer Cross-site Scripting (XSS) - Generic
    15 votes
12. Stored XSS using SVG Cross-site Scripting (XSS) - Generic
    15 votes
13. Full directory path listingSpamInformation Exposure Through Directory Listing
    14 votes
14. Paragonie Airship Admin CSRF on Extensions PagesCross-Site Request Forgery (CSRF) · medium
    11 votes
15. Improper access control lead To delete anyone commentImproper Access Control - Generic · medium
    10 votes
16. Recaptcha Secret key LeakedInformativeInformation Disclosure · high
    9 votes
17. Broken Authentication & Session Management - Failure to Invalidate Session on all other browsers at Password changeN/AImproper Authentication - Generic · critical
    9 votes
18. Directory Disclose,Email Disclose Zendmail vulnerabilityInformation Exposure Through Directory Listing
    8 votes
19. [Airship CMS] Local File Inclusion - RST ParserInformation Disclosure · high
    7 votes
20. Issue with password reset functionality [Minor]InformativeViolation of Secure Design Principles
    6 votes
21. Stored XSS in commentsCross-site Scripting (XSS) - Generic
    6 votes
22. Incomplete fix for #181225 (target=_blank vulnerability)N/A
    5 votes
23. Incorrect detection of onion URLs
    5 votes
24. User enumeration via Password reset page [Minor]InformativeViolation of Secure Design Principles
    5 votes
25. Session ManagementN/AViolation of Secure Design Principles
    5 votes
26. SMTP server allows anonymous relay from internal addresses to internal addressesDuplicateImproper Authentication - Generic
    5 votes
27. Github repo's wiki publicly editableInformativeImproper Access Control - Generic
    4 votes
28. Airship: Persistent XSS via CommentCross-site Scripting (XSS) - Stored · medium
    4 votes
29. Invited user to a Author profile can remove the owner of that AuthorViolation of Secure Design Principles
    4 votes
30. Cross-site-ScriptingCross-site Scripting (XSS) - Stored · low
    4 votes
31. Email Spoofing With Your Website's EmailDuplicateImproper Authentication - Generic
    4 votes
32. CSRF AT SUBSCRIBE TO LIST N/ACross-Site Request Forgery (CSRF)
    4 votes
33. Open-redirect on paragonie.comOpen Redirect
    4 votes
34. Github wikis are editable by anyone https://github.com/paragonie/password_lock/wikiInformativeImproper Access Control - Generic · medium
    3 votes
35. CSRF token does not valided during blog commentCross-Site Request Forgery (CSRF)
    3 votes
36. Missing rel=noopener noreferrer in target=_blank links (Phishing attack)Violation of Secure Design Principles
    3 votes
37. Not clearing hex-decoded variable after usage in AuthenticationInformativeViolation of Secure Design Principles
    3 votes
38. [URGENT] Password reset emails are sent in clear-text (without encryption)InformativeCryptographic Issues - Generic
    3 votes
39. Email spoofing in [email protected]InformativeMemory Corruption - Generic
    3 votes
40. Email Authentication BypassN/AMemory Corruption - Generic
    3 votes
41. no session logout after changing the password in https://bridge.cspr.ng/InformativeImproper Authentication - Generic · low
    2 votes
42. Full Path Disclousure on https://airship.paragonie.comInformativeInformation Disclosure · low
    2 votes
43. Improper validation of Email Informative
    2 votes
44. directory information discloseInformativeInformation Disclosure
    2 votes
45. Full Path Disclosure by removing CSRF tokenInformativeInformation Disclosure
    2 votes
46. Session Management Issue CMS AirshipInformativeMemory Corruption - Generic
    2 votes
47. Airship doesn't reject weak passwordsInformativeImproper Authentication - Generic
    2 votes
48. Full path disclosure when CSRF validation failed InformativeInformation Disclosure
    2 votes
49. Nginx Version Disclosure On Forbidden PageInformativeInformation Disclosure
    2 votes
50. Vunerability : spfN/AMisconfiguration
    2 votes
51. Your Application Have Cacheable SSL PagesInformativeViolation of Secure Design Principles
    2 votes
52. Missing SPFDuplicateViolation of Secure Design Principles
    2 votes
53. Email Authentication bypass VulnerabilityDuplicateViolation of Secure Design Principles
    2 votes
54. Information Disclosure in Error PageInformativeInformation Disclosure
    2 votes
55. There is an vulnerability in https://bridge.cspr.ng where an attacker can users directoryInformativemedium
    1 votes
56. Using plain git protocol (vulnerable to MITM)InformativeCryptographic Issues - Generic
    1 votes
57. Missing GIT tag/commit verification in DockerInformative
    1 votes
58. Full path disclosure vulnerability on paragonie.comInformativeInformation Disclosure
    1 votes
59. The Anti-CSRF Library fails to restrict token to a particular IP address when being behind a reverse-proxy/WAFInformativeCross-Site Request Forgery (CSRF)
    1 votes
60. file full path discloser.InformativeInformation Disclosure
    1 votes
61. Missing SPF for paragonie.comDuplicateViolation of Secure Design Principles
    1 votes
62. Full Path DisclosureInformation Disclosure
    1 votes
63. Missing SPF for paragonie.comDuplicateViolation of Secure Design Principles
    1 votes
64. Blind SQL INJN/ASQL Injection
    1 votes
65. SSL certificate public key less than 2048 bitN/ACryptographic Issues - Generic
    1 votes
66. Missing SPF records for paragonie.comDuplicateViolation of Secure Design Principles
    1 votes
67. DNSsec not configuredInformativeViolation of Secure Design Principles
    1 votes
68. Email spoofingDuplicateViolation of Secure Design Principles
    1 votes
69. Missing SPF for https://paragonie.com/InformativeViolation of Secure Design Principles
    1 votes
70. Cross-domain AJAX requestInformativeViolation of Secure Design Principles
    1 votes
71. Non-secure requests are not automatically upgraded to HTTPSInformativeViolation of Secure Design Principles · low
72. Full Path Disclosure in airship.paragonie.com '/cabins/'InformativeInformation Disclosure
73. Not using Binary::safe* functions for substr/strlen function
74. Full Path Disclosure In EasyDBInformativeInformation Disclosure
75. Full Path Disclosure in password lockInformativeInformation Disclosure