Browse / U.S. General Services Administration

U.S. General Services Administration

See its reports on the map

What gets reported to U.S. General Services Administration

• Insecure Direct Object Reference3
• Information Disclosure3
• Access Control3
• Misconfiguration2
• Authentication2
• Cross-Site Request Forgery1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. TAMS registration details API for admins open at https://tamsapi.gsa.gov/user/tams/api/usermgmnt/pendingUserDetails/Insecure Direct Object Reference (IDOR) · high
   60 votes
2. Weak password policy leading to exposure of administrator account accessMisconfiguration · critical
   37 votes
3. Account takeover through multistage CSRF at https://autochoice.fas.gsa.gov/AutoChoice/changeQAOktaAnswer and ../AutoChoice/changePwOktaAnswerCross-Site Request Forgery (CSRF) · medium
   33 votes
4. CRLF INJECTION CRLF Injection · low
   32 votes
5. e-mail verification bypass through interception & modification of response statusViolation of Secure Design Principles
   26 votes
6. Unauthorized access to employee panel with default credentials.Authentication Bypass Using an Alternate Path or Channel · high
   22 votes
7. Read Other Users Reports Through CloningInsecure Direct Object Reference (IDOR) · medium
   19 votes
8. Web Cache Poisoning leading to DoSUncontrolled Resource Consumption · medium
   19 votes
9. PHP info page disclosureInformation Disclosure · low
   19 votes
10. IDOR at training.smartpay.gsa.gov/reports/quizzes-taken-by-userInsecure Direct Object Reference (IDOR) · medium
    18 votes
11. access nagios dashboard using default credentials in ** omon1.fpki.gov, 3.220.248.203**Improper Access Control - Generic · critical
    17 votes
12. Account takeover leading to PII chained with stored XSSImproper Authentication - Generic · high
    14 votes
13. [Transportation Management Services Solution 2.0] Improper authorization at tmss.gsa.gov leads to data exposure of all registered usersImproper Authorization · critical
    14 votes
14. Path Traversal on meetcqpub1.gsa.gov allows attackers to see arbitrary file listings.Path Traversal · low
    11 votes
15. IDOR at https://demo.sftool.gov/TwsHome/ScorecardManage/ via scorecard nameImproper Access Control - Generic · high
    9 votes
16. User information disclosed via APIInformation Disclosure · high
    8 votes
17. Registered users contact information disclosure on salesforce lightning endpoint https://disposal.gsa.govInformation Disclosure · high
    5 votes