Equifax or Equiphish?

More than a week after it said most people would be eligible to enroll in a free year of its TrustedID identity theft monitoring service, big three consumer credit bureau Equifax has begun sending out email notifications to people who were able to take the company up on its offer. But in yet...

Lexmark Scan To Network (SNF) 3.2.9 Information Disclosure

Summary ======= 1. Information exposure of network credentials in embedded printer application CVE-2017-13771 Vendor ====== "Lexmark creates innovative imaging solutions and technologies that help customers worldwide print, secure and manage information with ease, efficiency and unmatched value...

CookieCatcher - Tool to assist in the exploitation of XSS

CookieCatcher is an open source application which was created to assist in the exploitation of XSS Cross Site Scripting vulnerabilities within web applications to steal user session IDs aka Session Hijacking. The use of this application is purely educational and should not be used without proper...

WakaTime: Missing Account Deletion Notification

Currently, there is no email notification sent out when the account was deleted. I understand it asks for the password to delete but when an attacker somehow get's the credentials, he can only 'read' users data without alarming the user. It would stop him if he knows the user would come to know...

WakaTime: No notificatoin sent on email after account deletion.

Hi again, Description: I've just noticed that there's no email notification received after successfully removal of account. Fixation: User should be notified by email notification at his email after removal of an account. Cheers Mansoor...

HackerOne: Updating payout preference to CurrencyCloud doesn't notify user via email

When change payment method in user's payments, then a notification about Change payment method is sent to the user email. However, user not always gets a notification about change payment method - when change payment method via add payout method on Payout Methods, then such a notification is not...

Mixmax: [app.mixmax.com] Stored XSS on Adding new enhancement.

Hi Mixmax team, Today I just found a Stored XSS on app.mixmax.com by adding a new enhancement. Just follow the steps below to reproduce this bug. Vulnerable URL APP MIXMAX - Settings - Integrations & API Payload " Steps to reproduce - Go to the Vulnerable URL. - Click Integrations & API then clic...

Weblate: No notificatoin sent on email after account deletion.

Hi again, Description: As I reported in previous report about account deletion about without entering password 229904 I've just noticed that there's no email notification received after successfully removal of account. Fixation: User should be notified by email notification at his email after...

Senator Demands Answers About CloudPets Breach

A U.S. senator has called Spiral Toys onto the carpet for its data security practices in light of the recent CloudPets breach. Sen. Bill Nelson D-FL, a ranking member of the Committee on Commerce, Science and Transportation and backer of a 2016 report on security and privacy concerns related to...

1.7 Million Opera Browser Users Told To Reset Passwords

Opera Software is warning 1.7 million users of its Opera web browser sync feature of a possible attack that exposes passwords to hackers. In a security bulletin posted on Friday, the company said its Opera sync system showed “signs of an attack” and asked users to change their Opera sync password...

Paragon Initiative Enterprises: Issue with password reset functionality [Minor]

Dear Team, There is password change issue with bridge.cspr.ng Issue: ------------- User is not receiving notification when he/she reset password via password reset link. when user change his info like password change. User doesn't get email notification for password change etc. It will be a good...

Linux Vulnerability Scanner: Vuls

Vulnerability scanner for Linux, agentless, written in golang For a system administrator, having to perform security vulnerability analysis and software update on a daily basis can be a burden. To avoid downtime in production environment, it is common for system administrator to choose not to use...

HackerOne: Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports

Hi Team, Legend ====== AppSecBounty = Bug ProgramSandbox Program Hacker1001 = Bug Reporter BugAdmin = Program Admin BugMember = Team Member associated ProgramManagement Group ProgramManagement Group = Custom Group created with "Program Management Permission" Steps: 1. Hacker1001 reports a Bug to...

The Artillery Project

Artillery is a combination of a honeypot, monitoring tool, and alerting system. Eventually this will evolve into a hardening monitoring platform as well to detect insecure configurations from nix systems. It’s relatively simple, run ./setup.py and hit yes, this will install Artillery in...

itBit Exchange: user-agent Content spoofing

Upon every unsuccessful login attempt an email is sent to the user containing the time of login attempt ,user-agent and ip .It is possible to modify the request using proxy tools and modify the user agent string to to a malicious link and the email being sent to notify the user will contain this...

[SECURITY] Fedora 21 Update: nagios-plugins-2.0.3-1.fc21

Nagios is a program that will monitor hosts and services on your network, and to email or page you when a problem arises or is resolved. Nagios runs on a Unix server as a background or daemon process, intermittently running checks on various services that you specify. The actual service checks ar...

AirLink101 SkyIPCam1620W - OS Command Injection

AirLink101 SkyIPCam1620W - OS Command Injection 1. Advisory Information Title: AirLink101 SkyIPCam1620W OS Command Injection Advisory ID: CORE-2015-0011 Advisory URL: http://www.coresecurity.com/advisories/airlink101-skyipcam1620w-os-command-injection Date published: 2015-07-08 Date of last updat...

Coinbase: Big Bug with Vault which i have already reported: Case #606962

All info was provided via email you guys asked me to put my case number here. Case 606962 im [email protected] on coinbase...

Project's permission bypass JIRA global permissions

h3. Summary Users are able to create/comment issues via email without group membership if they are added directly to the project's permission. User shouldn't be able to do that since he can't access the application itself. Same applies to JIRA's notifications. h3. Steps to Reproduce Remove user...

HackerOne: Email Notification should be get while changing Paypal Email

an email notification should be get while changing paypal email address when we use hackerone a/c in any team there many people in team member so when we change paypal email an email notification should be get...