Completed Compromise & Source Code Disclosure via Exposed Jenkins Dashboard at https://jenkins101.udemy.com Analysed #182104 Valid Command and Code Injection – 2017-06-17 – 63 [affiliates.udemy.com] Wordpress user admin information discloure Analysed #370777 Valid Information Disclosure Low 2019-04-28 – 60 [engineering.udemy.com] - Subdomain Takeover (ghost.io) #368119 Valid Access Control Low 2018-06-27 – 33 S3 bucket unnecessarily discloses permissions #330135 Valid Access Control None 2019-04-26 – 27 Subdomain Takeover (and Stored XSS) via Trailing Dot at https://coding-exercises.udemy.com #223625 Valid No weakness recorded None 2018-05-10 – 19 Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate #119166 Valid Authentication – 2017-03-26 – 16 Jenkins #181849 Valid No weakness recorded – 2017-01-10 – 13 AWS S3 bucket writable for authenticated aws user #131468 Valid Authentication – 2017-01-05 – 13 Ability to add pishing links in discusion ," Bypassing uneductional Links add " #62301 Valid Information Disclosure – 2016-07-09 – 10 Subdomain Takeover at Landing.udemy.com #208719 Valid Access Control Low 2017-03-30 – 9 teach.udemy.com log poison vulnerability through wordpress debug.log being publically available #60058 Valid Command and Code Injection – 2015-06-09 – 8 Extremely high Course rating values could be set in order to make really high Average rating of the course. Negative values could be set to. #73808 Valid Misconfiguration and Insecure Design – 2015-09-25 – 5 Content Spoofing in udemy #172711 Valid Misconfiguration and Insecure Design – 2017-07-23 – 4 Authentication Data are not Clearing #119262 Valid Authentication – 2016-04-13 – 4 XSS Vulnerability #87588 Valid Cross-site Scripting – 2015-11-09 – 3 XSS on https://www.udemy.com/asset/export.html #62400 Valid Cross-site Scripting – 2015-10-08 – 3 xss profile #60016 Valid Cross-site Scripting – 2015-07-16 – 3 Multiple sub domain are vulnerable because of leaking full path #62778 Valid Information Disclosure – 2015-06-25 – 2 leak receipt of another user #61371 Valid Information Disclosure – 2015-11-13 – 2 information disclosure #78765 Valid Information Disclosure – 2016-02-07 – 1 xss on autoserch #61367 Valid Cross-site Scripting – 2015-07-08 – 1