8693 matches found
Yelp: CRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit Card
@hk755a discovered an Insecure Direct Object Reference Vulnerability that allowed an attacker to associate a randomly added but subsequently deregistered credit card with their own account, via the /rewards/signup endpoint. While the attacker would not have been able to use this credit card as...
Reverb.com: Items bought for free due to lacks of quantity controls
Hi, The server fails to check the quantity of the items that are going to be sell. Values = 0 are accepted as 1. PoC: Go here https://sandbox.reverb.com/fr/item/139897-fender-2-strap-leather-test-2018-leather Intercept the response after clicking "Add to cart" and put "quantity: 0" F302179 Procee...
Mcard Mobile Card Selling Platform 1 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Exploit Title: Mcard Mobile Card Selling Platform 1 - SQL Injection Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/mcard-mobile-card-selling-platform/19307193?srank=15 Version: 1 Tested on: Kali linux POC 1 :...
Mcard Mobile Card Selling Platform 1 SQL Injection
Exploit Title: Mcard Mobile Card Selling Platform 1 - SQL Injection Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/mcard-mobile-card-selling-platform/19307193?srank=15 Version: 1 Tested on: Kali linux POC 1 : Attacker can bypass admin panel authentication...
Mcard Mobile Card Selling Platform 1 Cross Site Request Forgery
Exploit Title: Mcard - Mobile Card Selling Platform 1 - Cross-Site Request Forgery Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/mcard-mobile-card-selling-platform/19307193?srank=15 Version: 1 Tested on: Kali linux POC : CSRF POC document.forms0.submit;...
Mcard Mobile Card Selling Platform 1 - SQL Injection
Exploit Title: Exploit Title: Mcard Mobile Card Selling Platform 1 - SQL Injection Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/mcard-mobile-card-selling-platform/19307193?srank=15 Version: 1 Tested on: Kali linux POC 1 : Attacker can bypass admin panel...
Mobile Card Selling Platform 1 - Cross-Site Request Forgery
Exploit Title: Mcard - Mobile Card Selling Platform 1 - Cross-Site Request Forgery Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/mcard-mobile-card-selling-platform/19307193?srank=15 Version: 1 Tested on: Kali linux POC : CSRF POC document.forms0.submit;...
Mobile Card Selling Platform 1 - Cross-Site Request Forgery
Mobile Card Selling Platform 1 - Cross-Site Request Forgery Exploit Title: Mcard - Mobile Card Selling Platform 1 - Cross-Site Request Forgery Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/mcard-mobile-card-selling-platform/19307193?srank=15 Version: 1 Tested...
Mcard Mobile Card Selling Platform 1 - SQL Injection
Mcard Mobile Card Selling Platform 1 - SQL Injection Exploit Title: Exploit Title: Mcard Mobile Card Selling Platform 1 - SQL Injection Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/mcard-mobile-card-selling-platform/19307193?srank=15 Version: 1 Tested on: Kal...
Latin American ‘Biñeros’ Bond Over Fraudulent Purchase Scheme
A type of card-not-present fraud is spreading throughout the Latin American underground, uniting groups of malefactors in a communal effort to perpetrate it as widely and as often as possible. Cybercriminals in the region are making use of problems in the validation process for bank identificatio...
CVE-2018-8849
Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest...
The vulnerability of the embedded web-server microprogramming software module of the APC MGE SNMP/Web Card Transverse 66074 allows a intruder to obtain administrator account data.
The vulnerability of the embedded web-server-based microprogramming software module for the APC MGE SNMP/Web Card Transverse 66074 relates to the transmission of credentials in an unencrypted form. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain...
Medtronic N'Vision Clinician Programmer (Update A)
1. EXECUTIVE SUMMARY --------- Begin Update A Part 1 of 5 -------- CVSS v3 6.3 --------- End Update A Part 1 of 5 ----------- ATTENTION: Low skill level to exploit Vendor: Medtronic Equipment: N’Vision Clinician Programmer --------- Begin Update A Part 2 of 5 ----------- Vulnerabilities:...
May 17, 2018—KB4103724 (Preview of Monthly Rollup)
None None...
May 17, 2018—KB4103722 (OS Build 15063.1112)
None None...
Chili’s Doesn’t Leave Data Breach on the Back Burner
Southwestern/Texas-themed restaurant chain Chili’s has become the latest victim of a data breach involving the heist of point-of-sale information from payment cards — and the alacrity with which it has admitted the incident is notable. Hackers had unauthorized access to payment-card data between...
CVE-2018-0579
Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2018-0579
Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Vega Stealer malware steals passwords & card data from Chrome & Firefox
By Waqas The IT security researchers at Proofpoint have discovered a new This is a post from HackRead.com Read the original post: Vega Stealer malware steals passwords & card data from Chrome & Firefox...