Mojang Resets Users' Passwords, Microsoft Insists Not a Hack

Microsoft confirmed this week that one of its recent acquisitions, the gaming firm Mojang, has not been hacked. Nearly 2,000 credentials belonging to users of the Mojang game Minecraft – email addresses and passwords in plain-text – surfaced on Pastebin earlier this week and speculation began to...

SSLv3 exposed 0Day vulnerabilities rising to provide solution-vulnerability warning-the black bar safety net

1 0 On 1 5 December, the well-known encryption Protocol SSLv3 aeration became known as the“POODLE”of the high-risk vulnerability vulnerability number CVE-2 0 1 4-3 5 6 6, and can lead to data transmission network by hackers to monitor the users of sensitive information, online account and banking...

Google's Devices and Activity Dashboard — A New Account Security Wizard

We access our Google account from so many devices that we our self forget on how many devices our account is still connected and perhaps we don't use that device anymore. To make this problem easy for you, Google has come up with its new security dashboard which will help you keep better control...

X (Formerly Twitter): BROKEN AUTHENTICATION IN MOBILE VERIFICATION

Hey Team this is geekboy : this report is about broken authentication in mobile section . Description : when user want to add any mobile number to his account , he will go mobile section and twitter will ask the user to select the country and enter the mobile number . so when testing i entered th...

Bugzilla multiple security issues

Bugzilla Security Advisory Unauthorized Account Creation An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name cou...

76M Households, 7M Businesses Impacted in JPMorgan Chase Breach

A securities filing on Thursday revealed that up to 76 million households and seven million small businesses, far more than initially thought, were implicated in the cyber attack that hit JPMorgan Chase over the summer, making it one of the largest data breaches in U.S. history. The New York-base...

CVE-2014-4423

The Accounts subsystem in Apple iOS before 8 allows attackers to bypass a sandbox protection mechanism and obtain an active iCloud account's Apple ID and metadata via a crafted application...

LinkedIn Boosts Security With New Session Alert and Privacy Control Tools

With a need to give more controls in users’ hands, LinkedIn has introduced a few new security features that the company says will help users of the social network for professionals keep their accounts and data more secure. SESSION ALERTS Just like Google, Facebook, Yahoo and other online services...

Phabricator: Password Policy issue

Hello I hope you are doing fine. This is a very low severity issue that i just found out in your password policy. You have a good password policy implemented with the special characters and uppercase letters and stuff but the thing is that you do not check for passwords similar to the other field...

Fast payment and some credit card functions whether there is a defect? Know Bank card number and Expiration Date can consumer-vulnerability warning-the black bar safety net

Someone once broke a credit card just know the card number and expiration date on the CAN in some of the website on any purchase, while various payment products such as tenpay, Alipay launched fast pay only need to provide Bank card number, ID number, name, and phone number can be opened fast...

Square: CSRF login

Hello, This is new type of bug in this generation. Here, attacker throws his account access to normal user. Normal user can be monitored later by attacker. This will also deal with money in account. You are logging user into account from a 'Reset Password Link'. Here, any attacker can request...

Uzbey: All Active user sessions should be destroyed when user change his password!

Hello, There is an user sessions issue on your application that should be fixed. Proof of Concept ------------------------ Suppose, you have an account on uzbey Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromised what you'll...

Default Password (f00b@r) for 'root' Account

The account 'root' on the remote host has the password 'f00b@r'. An attacker may leverage this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password = "f00b@r"; include'deprecatednasllevel.inc';...

Slack: Password Policy issue (Weak Protect)

Ehy, I don't know if this is valid, but I decide to report it because when I try to report it on hackerone, the issue becomes duplicate, so that's not bad at all, issue valid but duplicate. This is the poc: http://grabilla.com/04616-eda16a72-0174-4eb1-82c6-4716a66b60d1.html Well, let's explain th...

Coinbase: 2FA settings allowed to be changed with no delay/freeze on funds

With the nature of bitcoin's instant transactions and the increase level of phishing/malware attempts on users, many bitcoin related businesses have freeze/delays on funds once a user changes their 2FA settings. That design keeps the 2FA from being defeated instantly if the user's email account h...

Factlink: Password reset link doesn't expire.

The password reset link sent by Factlink doesn't expire even after a long period of time. As Factlink account can be created 'without confirming' email id, so, this should be patched for the best practice...

Twitter Upgrades Account Security Features

Twitter has made a couple of changes to the service’s login process to help prevent account takeovers and enable users to reset their passwords in a simpler way. A Twitter account is among the more valuable assets for an attacker who is targeting a specific person. Accounts typically are tied to ...

Twitter Enables Password Reset With SMS and Suspicious Login Notifications

The popular social media site Twitter is rolling out a couple of new features to its login process to help users prevent their account in a more secure way and restore access to their account if they forget their accounts’ password. For tighten up the security measures Twitter is launching two...

Coinbase: Bypassing 2FA for BTC transfers

Under advanced settings, users have the ability to protect their wallet by requiring two-factor confirmation when sending bitcoins. Personally, I have configured my account with the most secure option, which requires two factor confirmation when sending any amount of bitcoins. However, a flaw...

C2FO: All Active user sessions should be destroyed when user change his password!

Hello, There is an user sessions issue on your application that should be fixed. Proof of Concept ------------------------ Suppose, you have an account on C2FO app.c2fo.com. Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromise...