xss on autoserch #61367 Valid Cross-site Scripting – 2015-07-08 – 1 information disclosure #78765 Valid Information Disclosure – 2016-02-07 – 1 leak receipt of another user #61371 Valid Information Disclosure – 2015-11-13 – 2 Multiple sub domain are vulnerable because of leaking full path #62778 Valid Information Disclosure – 2015-06-25 – 2 xss profile #60016 Valid Cross-site Scripting – 2015-07-16 – 3 XSS on https://www.udemy.com/asset/export.html #62400 Valid Cross-site Scripting – 2015-10-08 – 3 XSS Vulnerability #87588 Valid Cross-site Scripting – 2015-11-09 – 3 Authentication Data are not Clearing #119262 Valid Authentication – 2016-04-13 – 4 Content Spoofing in udemy #172711 Valid Misconfiguration and Insecure Design – 2017-07-23 – 4 Extremely high Course rating values could be set in order to make really high Average rating of the course. Negative values could be set to. #73808 Valid Misconfiguration and Insecure Design – 2015-09-25 – 5 teach.udemy.com log poison vulnerability through wordpress debug.log being publically available #60058 Valid Command and Code Injection – 2015-06-09 – 8 Subdomain Takeover at Landing.udemy.com #208719 Valid Access Control – 2017-03-30 – 9 Ability to add pishing links in discusion ," Bypassing uneductional Links add " #62301 Valid Information Disclosure – 2016-07-09 – 10 AWS S3 bucket writable for authenticated aws user #131468 Valid Authentication – 2017-01-05 – 13 Jenkins #181849 Valid No weakness recorded – 2017-01-10 – 13 Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate #119166 Valid Authentication – 2017-03-26 – 16 Subdomain Takeover (and Stored XSS) via Trailing Dot at https://coding-exercises.udemy.com #223625 Valid No weakness recorded – 2018-05-10 – 19 S3 bucket unnecessarily discloses permissions #330135 Valid Access Control – 2019-04-26 – 27 [engineering.udemy.com] - Subdomain Takeover (ghost.io) #368119 Valid Access Control – 2018-06-27 – 33 [affiliates.udemy.com] Wordpress user admin information discloure #370777 Valid Information Disclosure – 2019-04-28 – 60 Completed Compromise & Source Code Disclosure via Exposed Jenkins Dashboard at https://jenkins101.udemy.com #182104 Valid Command and Code Injection – 2017-06-17 – 63