All your Paypal OAuth tokens belong to me - localhost for the win

tl;dr I was able to hijack the OAuth tokens of EVERY Paypal OAuth application with a really simple trick. Introduction If you have been following this blog you might have got tired of how many times I have stressed out the importance of the redirecturi parameter in the OAuth flow. This simple...

Udemy: Completed Compromise & Source Code Disclosure via Exposed Jenkins Dashboard at https://jenkins101.udemy.com

Howdy, @udemy! Summary: ======= I am writing to inform you of a critical information disclosure bug via an exposed Jenkins dashboard located at https://jenkins101.udemy.com. Upon navigating to this address, I was asked to authenticate with my Github account. After authenticating, I was surprised ...

Powerful word brother! 4 easy steps to bypass PayPal two-factor authentication mechanism-vulnerability warning-the black bar safety net

! Two-factor authentication, 2FA refers to the combination of password and a physical card or credit card, SMS, phone, token or fingerprint and other biological signs the two conditions of the user authentication method. This approach has for businesses, is mainly used to increase account securit...

sandbox3.paypal.com XSS vulnerability

Open Bug Bounty ID: OBB-184560 Description| Value ---|--- Affected Website:| sandbox3.paypal.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

sandbox.paypal.com XSS vulnerability

Vulnerable URL: https://www.sandbox.paypal.com/ie/webapps/mpp/standard?locale.x=%3C/SCript%3E%3CsvG/onLoad=alert%28/openbugbounty/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 12.09.2017 Latest check for patch:| 12.09.2017 10:49 GMT Vulnerability type:| XSS Vulnerability status:|...

PayPal 2FA Bypass

Document Title: =============== PayPal Inc BB 127 - 2FA Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1903 Release Date: ============= 2016-08-12 Vulnerability Laboratory ID VL-ID: ==================================== 1903 Common...

PayPal Inc BB #127 - 2FA Bypass Vulnerability

Document Title: =============== PayPal Inc BB 127 - 2FA Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1903 Release Date: ============= 2016-08-12 Vulnerability Laboratory ID VL-ID: ==================================== 1903 Common...

PayPal Inc BB #127 - 2FA Bypass Vulnerability

Document Title: =============== PayPal Inc BB 127 - 2FA Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1903 Release Date: ============= 2016-08-11 Vulnerability Laboratory ID VL-ID: ==================================== 1903 Common...

PayPal Fixes CSRF Vulnerability in PayPal.me

PayPal recently fixed a vulnerability on its PayPal.me site that could have let an attacker change a user’s profile without permission. The issue stemmed from a cross-site request forgery CSRF vulnerability that existed in PayPal.me, a site the company launched last year to let its users request...

PayPal Suspicious URL Phishing Attempt

A mail phishing attack had been reported, attempting to obtain the victim's PayPal credentials. The attacker uses embedded redirection links in order to gain the victim's account information...

Ktools Photostore 4.7.5 - Multiple Vulnerabilities

Exploit for php platform in category web applications -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Ktools Photostore = 4.7.5 Multiple Vulnerabilities Bug discovered by Yakir Wizman Date 01/07/2016 Affected versions prior to 4.7.5 Vendor Homepage - http://www.ktools.net...

Ktools Photostore 4.7.5 - Multiple Vulnerabilities

Ktools Photostore 4.7.5 - Multiple Vulnerabilities -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Ktools Photostore = 4.7.5 Multiple Vulnerabilities Bug discovered by Yakir Wizman Date 01/07/2016 Affected versions prior to 4.7.5 Vendor Homepage - http://www.ktools.net...

BlackShades Strain of Ransomware Teases Researchers

Researchers who dig deep through the code of one of the latest strains of ransomware might be surprised and even a little irked at what they find. Hidden inside some of those strings of code are taunts aimed at them. According to Lawrence Abrams who runs BleepingComputer.com, the malware,...

PayPal Bug Bounty Filter Bypass Vulnerability

PayPal is an e-commerce application that provides online payment and money transaction services. A filter bypass vulnerability exists in PayPal. A remote attacker is able to inject malicious script code into some email headers...

PayPal Deposit major vulnerability, 1 0 seconds no need to verify stolen brush Bank card within the amount-vulnerability warning-the black bar safety net

! Usually online often see Alipay stolen brush cases, but from their very far, did not expect this thing but in this day are happening in my body. The genuineness, without warning. Only 1 0 seconds, I did not receive any input the verification code or Payment password in the process, the Bank car...

Threat Outbreak Alert RuleID22264: Email Messages Distributing Malicious Software on May 9, 2016

Medium Alert ID: 45090 First Published: 2016 May 9 14:10 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22264 may contain the following files: Name | Size ...

PayPal Mail Phishing Containing Attachment

Genuine email from PayPal will never include attachments. A remote attacker could send spam PayPal e-mails including those malicious attachments and convince users to manually enable them. This would allow the malicious code to run and infect the target system...

3 6 0 The White List is bypassed, Taobao sellers victims-vulnerability warning-the black bar safety net

Checkpoint exposure to malicious software maker to bribe the Chinese game company, by carrying the malicious code file is sent to the odd Tiger 3 6 0, was added to its white list, to achieve any recklessly malicious behavior. ! Once the file by qihoo verification process, was eventually included ...

Threat Outbreak Alert RuleID22205: Email Messages Distributing Malicious Software on April 11, 2016

Medium Alert ID: 44603 First Published: 2016 April 11 13:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22205 may contain the following files: Name | Si...

LynxFramework - Extension Exploitation Framework

LynxFramework is an operating tool for web browser offering a specialized service in the effect browser extension development , namely Google Chrome and Firefox soon. The operation is based on the script for the injection in the order to retrieve data targeted. LynxFramework est un outil...