123

STR: 1/ Go to discount calculetor http://www.nibulon.com/data/zakupivlya-silgospprodukcii/kalkulyator-znizhok.html 2. Enter value '9999999999999999999999999999999999999999999999999999999999999999' into 'Виберіть показник вологості' file Enter some vald value 'Виберіть показник сміттєвої домішки' ...

Yahoo / Verizon: A $1B Data Breach Discount?

In July of this year Verizon announced it was going to buy Yahoo for $4.8B. A few weeks later, Yahoo starts investigating a potential data breach of around 200 million records that were for sale on the Dark Web. In mid-September, Yahoo discloses that sometime in 2014, they were attacked and rough...

Discount Bank - Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Discount Bank published at the 'play' market has multiple vulnerabilities...

email-discount-london.com XSS vulnerability

Vulnerable URL: https://email-discount-london.com/login.php?message=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:|...

studentbeans.com XSS vulnerability

Vulnerable URL: https://www.studentbeans.com/student-discount/uk/results?query=%3C/stYle/%3C/titLe/%3C/teXtarEa/%3C/scRipt/--!%3E\spam404/%3CsVg/oNloAd=alert%28/XSSPOSED/%29//%3E\x3e Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS...

Shopify: Stored XSS via "Free Shipping" option (Discounts)

POC steps: 1 Go to the customers page and add a new search group named as "img src=x onerror=prompt7 see img1.png 2 Go to the discounts page, create a new discount code and mark the "Free Shipping" option. 3 Open a web proxy i.e. tamper data and press the "save discount" button. 4 Through the web...

New OAuth book: OAuth 2 in Action

Justin Richer and myself have been writing a book about OAuth. It gives a deep look at the OAuth 2.0 protocol including hands on examples and practical implementation vulnerabilities to avoid. You can preorder the book today or you can download the first chapter for free on the publisher’s websit...

CVE-2015-4358

Cross-site scripting XSS vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4358

The vulnerability CVE-2015-4358 affects Ubercart Discount Coupons module for Drupal 6.x-1.x prior to 6.x-1.8. The issue is an XSS in unspecified administration pages due to insufficient sanitization of user-supplied text, exploitable by remote authenticated users with certain permissions to injec...

Shopify: Bulk Discount App in myshopify.com exposes http://bulkdiscounts.shopifyapps.com vulnerable to XSS

Installing the Bulk Discount App in .myshopify.com which requires a paid basic plan makes the bulkdiscounts.shopifyapps.com vulnerable to XSS due to non sanitized input in products and collections. POC: 1. Enter a product name or a collection such as " and save it. 2. Install the Shopify...

Drupal Ubercart Discount Coupons Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Ubercart Discount Coupons is one of the modules used to set up coupons for the Ubercart store. A cross-site scripting vulnerability exists in the Drupal Ubercart Discount Coupons module...

SA-CONTRIB-2015-064 - Ubercart Discount Coupons - Cross Site Scripting (XSS)

Ubercart Discount Coupons module provides discount coupons for Ubercart stores. The module doesn't sufficiently sanitize user supplied text in some administration pages, thereby exposing a Cross Site Scripting vulnerability. The vulnerability is mitigated by the fact that an attacker must have a...

CVE-2014-7647

The BOOKING DISCOUNT aka com.wmygoodhotelscom application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The AAAA Discount Bail aka com.onesolutionapps.aaaadiscountbailandroid application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7647

The CVE-2014-7647 entry concerns the BOOKING DISCOUNT (com.wmygoodhotelscom) Android app version 0.1, where SSL server certificate validation is not performed. This allows a man-in-the-middle attacker to spoof servers and potentially obtain sensitive information via a crafted certificate. The doc...

CVE-2014-7647

The BOOKING DISCOUNT aka com.wmygoodhotelscom application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7785

The AAAA Discount Bail aka com.onesolutionapps.aaaadiscountbailandroid application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7785

CVE-2014-7785 affects the Android app “AAAA Discount Bail” (com.onesolutionapps.aaaadiscountbailandroid) version 1.1. The issue is failure to verify X.509 certificates when connecting to SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and extract sensitive information via a cra...

Threat Outbreak Alert: Fake Travel Information Email Messages on June 15, 2014

Medium Alert ID: 31784 First Published: 2013 November 15 14:41 GMT Last Updated: 2014 June 16 18:15 GMT Version: 10 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain travel discounts for the recipient. The text in the email message...

DiscuzX1. 5+ prop of the brush sub-vulnerability-vulnerability warning-the black bar safety net

If the user group set up"to purchase items a discount"option to buy when the price is discounted price, and sell when the price is not discounted price. That is the time to buy discount, sell when it is the original price. Buy: $magic'discountprice' = $G'group''magicsdiscount' ? intval$magic'pric...