Zomato: Availing Zomato gold by using a random third-party `wallet_id`

We received a report from @pandaaaa wherein he demonstrated a way to avail Zomato Gold membership using random Zomato User's wallet. The report was triaged and rewarded with critical severity with a CVSS score of 9.3. It was considered critical since a random user's wallet could have been used fo...

F5 Networks BIG-IP : Intel MCE vulnerability (K17269881)

Improper invalidation for page table updates by a virtual guest operating system for multiple IntelR Processors may allow an authenticated user to potentially enable denial of service of the host system via local access. CVE-2018-12207 Impact A privileged guest user may use this flaw to induce a...

Razer: [api.easy2pay.co] SQL Injection at fortumo via TransID parameter [Bypassing Signature Validation🔥]

The tester discovered the api.easy2pay.co suffered from a SQL injection vulnerability, affecting Razer Gold Thailand. Razer thanks the tester for his report and diligence...

Gold Reward has a flawed logic vulnerability

Gold Reward GRX is an ethereum-based virtual currency.A security vulnerability in the 'sell' function in the smart contract implementation of GRX arises from the ability of an attacker to specify a selling price. The vulnerability can be exploited by an attacker to cause financial loss to the buy...

binutils security and bug fix update

2.30-73.0.1 - Forward-port of Oracle patches from 2.30-68.0.2. - Reviewed-by: Elena Zannoni 2.30-68.0.2 - Backport the non-cycle-detecting-capable deduplicating CTF linker - Backport a fix for an upstream hashtab crash no upstream bug number, triggered by the above. - Fix deduplication of...

RSA-250 Factored

RSA-250 has been factored. This computation was performed with the Number Field Sieve algorithm, using the open-source CADO-NFS software. The total computation time was roughly 2700 core-years, using Intel Xeon Gold 6130 CPUs as a reference 2.1GHz: RSA-250 sieving: 2450 physical core-years RSA-25...

Razer: SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter.

The tester discovered a monitoring server in a Razer Gold environment was running legacy software with a SQL injection vulnerability. Razer thanks the tester for his diligence and helping keep Razer's customer data secure. A Razer Gold asset suffered from an SQL injection due to an outdated...

Razer: 🐞 OS Command Injection at https://sea-web.gold.razer.com/lab/ws-lookup via IP parameter

The tester discovered a Razer Gold Thailand site that suffered from a service with a command injection vulnerability. Razer thanks the tester for his report and clear PoC. a real world CTF-Like challenge 😅 Burpsuite Collaborator Client was very helpful Thanks @Razer for the bounty 🥳...

Hubei Tao code thousand dimensional information technology limited company gold micro cell phone mall system exists arbitrary file modification vulnerability

Jinwei mobile mall system is suitable for micro-business customers with public number, imitating the page layout of the hand Tao, support embedded video playback. Support customized model specifications, the main specifications support attached pictures, each subdivided model support inventory...

Razer: SQL injection at https://sea-web.gold.razer.com/ajax-get-status.php via txid parameter

The tester determined the Razer Gold TH site suffered from a SQL injection issue. Razer thanks the tester for his due diligence and clear report...

Razer: Blind SQL Injection at http://easytopup.in.th/es-services/mps.php via serial_no parameter

The tester determined a Razer Gold Thailand server was vulnerable to a boolean-based blind SQL injection attack. Razer thanks the tester for the very clear PoC...

Razer: DOM-based XSS on https://zest.co.th/zestlinepay/

The tester discovered a DOM based XSS on a Razer Gold Thailand associated website that could allow stealing of user session cookies. He provided excellent reproduction steps and a video PoC. Razer thanks the tester for his great report and helping us to keep our customers' information secure...

Razer: SQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour Parameter

The tester discovered a SQL injection issue that allowed access to data via Razer Gold Thailand's sea-web server. Razer appreciates the clear and thorough report...

Razer: SQL injection at https://sea-web.gold.razer.com/demo-th/goto-e2p-web-api.php via Multiple Parameters

The tester discovered a SQL injection vulnerability that allowed the potential extraction of information from a Razer Gold database. Although this turned out to be an unused service, we thank the tester for his diligence...

CVE-2019-14629

Improper permissions in IntelR DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access...

Information disclosure

Improper permissions in IntelR DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access...

Razer: Reflected XSS on https://www.easytopup.in.th/store/product/return on parameter mref_id

The tester discovered a reflected XSS on Razer Gold Thailand's easytopup.in.th page. We appreciate the excellent POC and code analysis...

RSA-240 Factored

This just in: We are pleased to announce the factorization of RSA-240, from RSA's challenge list, and the computation of a discrete logarithm of the same size 795 bits: RSA-240 = 12462036678171878406583504460810659043482037465167880575481878888328...

Information Disclosure Vulnerability in Multiple Intel Products (CNVD-2019-47000)

The Intel Core Processor i7-8500Y is a Core i7 series CPU.The Intel Xeon Platinum Processor 8253 is a Xeon Platinum series server CPU.The Intel Xeon Gold Processor 5215 is a Xeon Gold series server CPU.The Intel Xeon Gold Processor 5215 is a Xeon Gold series server CPU.The Intel Xeon Gold Process...

Multiple Intel Products CVE-2019-0154 Denial of Service Vulnerability

Description Multiple Intel Products are prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service conditions. Technologies Affected Intel 6th generation Core processors Intel 7th generation Core processors Intel 8th generation Core processors Intel...