CVE-2016-4837

SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

EC-CUBE Coupon Plugin SQL Injection Vulnerability

LOCKON EC-CUBE is a set of open source e-commerce website building platform. coupon is one of the discount coupon plugin. LOCKON EC-CUBE Coupon suffers from a SQL injection vulnerability that can be exploited by remote attackers to submit specially crafted SQL queries to manipulate or obtain...

EC-CUBE plugin "Coupon Plugin" vulnerable to SQL injection

Overview EC-CUBE plugin "Coupon Plugin" provided by Seed Inc. contains an SQL injection vulnerability CWE-89. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact...

JVN#40696431: EC-CUBE plugin "Coupon Plugin" vulnerable to SQL injection

EC-CUBE plugin "Coupon Plugin" provided by Seed Inc. contains an SQL injection vulnerability CWE-89. Impact Information stored in the database may be obtained or altered by a remote attacker. Solution Update the plugin Update to the latest version according to the information provided by the...

The Web in conditions of competitive Race conditions）vulnerability-vulnerability warning-the black bar safety net

In order to improve developer and network security personnel on the conditions of the competitive attacks of vigilance,I wrote this blog. I think not many people know about this problem,to this end, I researched some of the points system is susceptible to conditions of competition to attack the C...

Instacart: CSRF with redeem coupon request

This behavior is working as intended. We have a number of fraud prevention mechanisms in place that limit the effects of a single entity abusing this feature...

Get the passenger and the owner of the personal information? This note Uber logical vulnerability“combination punches”worth a look-vulnerability warning-the black bar safety net

! Uber recently finally opened up its vulnerability reward program, and encourage white-hat gate expand on the Uber online service vulnerability mining. Please with FreeBuf xiaobian together look at this a few logical loopholes the formation of“combination of Boxing” it. Information collected...

H.I.S. Coupon Lite - Dynamic Code Loading, External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application H.I.S. Coupon Lite published at the 'play' market has multiple vulnerabilities...

COUPIES Coupons im Supermarkt - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application COUPIES Coupons im Supermarkt published at the 'play' market has multiple vulnerabilities...

Udemy: Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate

I recently purchased a gift for a friend, and noticed the share URL gift ID was simply numeric. I managed to access other people's gifts simply by incrementing and decrementing the ID by 2, I was able to verify that the price was dropped to "Free", regardless of if I was logged in or not, and I w...

shop.redbullmobile.at XSS vulnerability

Vulnerable URL: http://shop.redbullmobile.at/is-bin/INTERSHOP.enfinity/WFS/Mobilkom-A1Shop-Site/deAT/-/EUR/CouponHandlingView-AddCoupon?submitcouponID=Einl%c3%b6sen=alle-handys=OverviewPage=Gutscheincode%2520eingebenalert/XSSPOSED/...

vistaprint.sg Open Redirect vulnerability

Vulnerable URL: http://www.vistaprint.sg/add-coupon.aspx?redirect=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 15.03.2017 Latest check for patch:| 15.03.2017 17:20 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 26395...

QiboCMS地方门户系统文件coupon/s.php存在SQL注入漏洞

No description provided by source...

齐博地方门户系统 v2.5 /coupon/s.php SQL注入漏洞

No description provided by source...

Csv2WPeC Coupon <= 1.1 - Unauthenticated Remote File Upload

The code in csv2wpecCouponFileUpload.php does not properly sanitize user input, it checks the file mime-type for type x-php but this can be tricked when using the short code for "; $uploadfile="/var/www/s.pht"; $ch =...

Csv2WPeC Coupon <= 1.1 - Unauthenticated Remote File Upload

The code in csv2wpecCouponFileUpload.php does not properly sanitize user input, it checks the file mime-type for type x-php but this can be tricked when using the short code for PoC "; $uploadfile="/var/www/s.pht"; $ch =...

Dropbox: Race condition when redeeming coupon codes

Hello, there is a race condition when redeeming coupon codes in https://www.dropbox.com/coupons. Basically, it enables me to reuse one coupon code many times. Here are the steps to reproduce: 1. Get a coupon code. I bought mine on fiverr. 2. Go to https://www.dropbox.com/coupons and enter your co...

CVE-2014-5891

The SnipSnap Coupon App aka com.snipsnap.snipsnapapp application 1.1.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The SnipSnap Coupon App aka com.snipsnap.snipsnapapp application 1.1.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5891

The CVE-2014-5891 entry concerns the SnipSnap Coupon App (com.snipsnap.snipsnapapp) for Android v1.1.11, where the app does not verify X.509 certificates from SSL servers. The underlying issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certifi...