Browse / U.S. Department of State

U.S. Department of State

See its reports on the map

What gets reported to U.S. Department of State

• Cross-site Scripting3
• Access Control2
• SQL Injection1
• Insecure Direct Object Reference1
• Server-Side Request Forgery1
• Information Disclosure1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Time Based SQL InjectionSQL Injection · critical
   64 votes
2. Accessing unauthorized administration pages and seeing admin password - speakerkit.state.govImproper Access Control - Generic · high
   44 votes
3. IDOR in TalentMAP API can be abused to enumerate personal information of all the usersInsecure Direct Object Reference (IDOR) · high
   40 votes
4. RXSS on https://travel.state.gov/content/travel/en/search.htmlCross-site Scripting (XSS) - Reflected · medium
   30 votes
5. xss and html injection on ( https://labs.history.state.gov)Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
   23 votes
6. Bypassing Whitelist to perform SSRF for internal host scanningServer-Side Request Forgery (SSRF) · low
   21 votes
7. LDAP anonymous access enabled at certrep.pki.state.gov:389Improper Access Control - Generic · medium
   16 votes
8. HTML INJECTION on coins.state.govImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · low
   16 votes
9. Impact of Using the PHP Function "phpinfo()" on System Security - PHP info page disclosureInformation Disclosure · low
   13 votes