Brute Force Attacks

phpMyFAQ is vulnerable to brute force attacks. The library does not lockout an account after too many failed attempts, allowing a malicious user to brute force a password to an account...

Weblate: The username of an account can be ..

Hello, Description: The username of an account can be set to ... This makes it impossible to view the public profile of this account. POC: I have claimed the username .. on the demo.weblate.org site. It is impossible to view this account's public profile page. Here is the public profile page:...

Mail.ru: BruteForce Any [My.com] Account Credentials.

CAPTCHA entered on account.my.com was not actually checked. account.my.com has no relation to My.Com's MyMail and is not currently covered by regular Mail.Ru bug bounty program...

pwned - A command-line tool for querying the 'Have I been pwned?' service

A command-line tool for querying Troy Hunt 's Have I been pwned? service using the hibp Node.js module. Installation npm install pwned -g Usage Usage: pwned option | command Commands: ba options get all breaches for an account username or email address breaches options get all breaches in the...

Password Breaches Fueling Booming Credential Stuffing Business

The market for credential stuffing software and services is thriving thanks in large part to an epidemic of breaches of usernames and passwords. Digital Shadows said today in a new report that credential leaks, such as this past month’s Anti Public Combo List and others, have buoyed the market fo...

Google Shuts Down Docs Phishing Spree

Google said it has disabled offending accounts involved in a widespread spree of phishing emails today impersonating Google Docs. The emails, at the outset, targeted journalists primarily and attempted to trick victims into granting the malicious application permission to access the user’s Google...

Weblate: Insecure Account Removal

Hi Team, The removal of account is one of the sensitive part of a web application that needs to protect, therefor removing an account should validate the authenticity of the legitimate user, however i have found that when removing an account, the system did not require the user to input the accou...

D-Link DSL-2730U Wireless N 150 - Cross-Site Request Forgery

D-Link DSL-2730U Wireless N 150 - Cross-Site Request Forgery Author : B GOVIND Exploit Title : DLink DSL-2730U Wireless N 150, Change DNS Configuration bypassing ‘admin’ privilege Date : 01-03-2017 Vendor Homepage : http://www.dlink.co.in Firmware Link : ftp://support.dlink.co.in/firmware/DSL-273...

Yahoo Hacked Once Again! Quietly Warns Affected Users About New Attack

Has Yahoo rebuilt your trust again? If yes, then you need to think once again, as the company is warning its users of another hack. Last year, Yahoo admitted two of the largest data breaches on record. One of which that took place in 2013 disclosed personal details associated with more than 1...

OLX: Combined attacks leading to stealing user's account

Hello, First: I have found out that when I register an account with the an email already used it doesn't tell anything but it sends a link to the registered email and when the user visits the link the password is changed without any further checking if the user was the one who asked for password...

New Relic: Logic flaw enables restricted account to access account license key

Hello - this is a resubmission of my report 197071 that was sent to the public NewRelic program. You have a serious logic flaw which results in a restricted account being able to view the account license key. This is able to be performed by logging into a restricted account, clicking on the...

CVE-2016-7060

It was found that several password fields in QCI failed to properly mask the password while it was being entered. An attacker with physical access or the ability to view the screen would be able to see the passwords as they are being entered, allowing them to later access accounts and services...

U.S. Dept Of Defense: Attackers can control which security questions they are presented (████████)

Summary: When clicking on the forgot password link on ██████, the questions used to verify identify can be arbitrarily selected by an attacker. Description: When clicking on the forgot password link on ██████████, the questions used to verify identify can be arbitrarily selected by an attacker...

X (Formerly Twitter): Vine - overwrite account associated with email via android application

Hi, It's possible to deny any user from logging in to his account by overwriting the password associated with his email. This is not an account takeover because while we do override the password associated with that specific mail we just login to a "new" account and not the user's original one...

Over 43 Million Weebly Accounts Hacked; Foursquare Also Hit By Data Breach

2016 is the year of data breaches that has made almost every major companies victims to the cyber attacks, resulting in compromise of over billion of online users accounts. Weebly and Foursquare are the latest victims of the massive data breach, joining the list of "Mega-Breaches" revealed in...

500 Million Yahoo Accounts Stolen By State-Sponsored Hackers

Yahoo says it was the victim of state-sponsored hackers who stole information associated with 500 million accounts. Yahoo CISO Bob Lord said the attack happened on the company’s network in late 2014; he did not name the country responsible. “The account information may have included names, email...

Yelp: Bybass The Closing of the account and logged again to your account

Hello Details: All My accounts have been closed i dnot know the reason so i have played around and manged to bypass this mechanism using the last unused password token Steps: - go to forget password page and get new password reset token and dnot use it - go and make anything against the rules lea...

Uber: Stealing users password (Limited Scenario)

Hello Team, Description : This is report is about an interesting scenario where an user's password can be steal while password reset process due to wired user controlled redirection take place after password reset process. By accepting the fact that URL redirect is not in scope for uber but this...

Certly: Business logic Failure - Browser cache management and logout vulnerability in Certly

1.login the account. 2. browse any tabs or anything in the site 3. logout the account 4.click the back browser button and you are able to see the all previous page Related Topic: https://hackerone.com/reports/7909...

Ubiquiti Inc.: IDOR Causing Deletion of any account

The researcher demonstrated how to close other users account, using a IDOR in community.ubnt.com he was able to delete all data in others account using the user id number of the victim. IDOR in Community.ubnt.com :500$ Created two user:-- Attacker with username:--vibhuti123i Victim:-- Johnvictim...