Wallarm at NGINX.conf

Wallarm is proud to be a gold sponsor of NGINX 2017. nginx.conf is an annual conference for technical professionals who are passionate about delivering better application and web performance. The event takes place on September 6–8 at the Nines Luxury Hotel in Portland, OR. Join us at the...

slimewave.com XSS vulnerability

Vulnerable URL: http://slimewave.com/discount/girl.php?slug="terajoy Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 542624 VIP website status:| No Check slimewave.com SSL connection:| Grade: A Coordinated...

webspace-discount-24.de XSS vulnerability

Open Bug Bounty ID: OBB-226493 Description| Value ---|--- Affected Website:| webspace-discount-24.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

mm.discountflights.com XSS vulnerability

Vulnerable URL: http://www.mm.discountflights.com/dynamic-flight-result.php?air-radio=on=%27%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%22==%27%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%22==03%2F12%2F17=03%2F12%2F17=1=0=0=Economylanguage=en-UScurrency=USD=2 Details:...

telunjuk.com XSS vulnerability

Vulnerable URL: https://www.telunjuk.com/jual?isdiscounti=1=+amp+=2prompt/OPENBUGBOUNTY/...

hyatt.com XSS vulnerability

Vulnerable URL: https://www.hyatt.com/content/partnerlandingpage/en/corporate/global/hyatt-member-discount.html?icamp=";alertOPENBUGBOUNTY;// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Ale...

123

STR: 1/ Go to discount calculetor http://www.nibulon.com/data/zakupivlya-silgospprodukcii/kalkulyator-znizhok.html 2. Enter value '9999999999999999999999999999999999999999999999999999999999999999' into 'Виберіть показник вологості' file Enter some vald value 'Виберіть показник сміттєвої домішки' ...

Yahoo / Verizon: A $1B Data Breach Discount?

In July of this year Verizon announced it was going to buy Yahoo for $4.8B. A few weeks later, Yahoo starts investigating a potential data breach of around 200 million records that were for sale on the Dark Web. In mid-September, Yahoo discloses that sometime in 2014, they were attacked and rough...

Discount Bank - Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Discount Bank published at the 'play' market has multiple vulnerabilities...

email-discount-london.com XSS vulnerability

Vulnerable URL: https://email-discount-london.com/login.php?message=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:|...

studentbeans.com XSS vulnerability

Vulnerable URL: https://www.studentbeans.com/student-discount/uk/results?query=%3C/stYle/%3C/titLe/%3C/teXtarEa/%3C/scRipt/--!%3E\spam404/%3CsVg/oNloAd=alert%28/XSSPOSED/%29//%3E\x3e Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS...

Shopify: Stored XSS via "Free Shipping" option (Discounts)

POC steps: 1 Go to the customers page and add a new search group named as "img src=x onerror=prompt7 see img1.png 2 Go to the discounts page, create a new discount code and mark the "Free Shipping" option. 3 Open a web proxy i.e. tamper data and press the "save discount" button. 4 Through the web...

New OAuth book: OAuth 2 in Action

Justin Richer and myself have been writing a book about OAuth. It gives a deep look at the OAuth 2.0 protocol including hands on examples and practical implementation vulnerabilities to avoid. You can preorder the book today or you can download the first chapter for free on the publisher’s websit...

CVE-2015-4358

Cross-site scripting XSS vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4358

The vulnerability CVE-2015-4358 affects Ubercart Discount Coupons module for Drupal 6.x-1.x prior to 6.x-1.8. The issue is an XSS in unspecified administration pages due to insufficient sanitization of user-supplied text, exploitable by remote authenticated users with certain permissions to injec...

CVE-2015-4358: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

Shopify: Bulk Discount App in myshopify.com exposes http://bulkdiscounts.shopifyapps.com vulnerable to XSS

Installing the Bulk Discount App in .myshopify.com which requires a paid basic plan makes the bulkdiscounts.shopifyapps.com vulnerable to XSS due to non sanitized input in products and collections. POC: 1. Enter a product name or a collection such as " and save it. 2. Install the Shopify...

Drupal Ubercart Discount Coupons Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Ubercart Discount Coupons is one of the modules used to set up coupons for the Ubercart store. A cross-site scripting vulnerability exists in the Drupal Ubercart Discount Coupons module...

SA-CONTRIB-2015-064 - Ubercart Discount Coupons - Cross Site Scripting (XSS)

Ubercart Discount Coupons module provides discount coupons for Ubercart stores. The module doesn't sufficiently sanitize user supplied text in some administration pages, thereby exposing a Cross Site Scripting vulnerability. The vulnerability is mitigated by the fact that an attacker must have a...

CVE-2014-7647

The BOOKING DISCOUNT aka com.wmygoodhotelscom application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...