PRODSECBUG-1513: Insufficient brute force protections on promo code entry

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...

releasepromo.com XSS vulnerability

Open Bug Bounty ID: OBB-718692 Description| Value ---|--- Affected Website:| releasepromo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

promo-cines.com XSS vulnerability

Open Bug Bounty ID: OBB-698125 Description| Value ---|--- Affected Website:| promo-cines.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

promo-hilton-tucuman.com XSS vulnerability

Open Bug Bounty ID: OBB-589915 Description| Value ---|--- Affected Website:| promo-hilton-tucuman.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

promo.3798.com XSS vulnerability

Open Bug Bounty ID: OBB-557771 Description| Value ---|--- Affected Website:| promo.3798.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Mail.ru: reflected xss on cycloferon.health.mail.ru

Reflected XSS in http://cycloferon.health.mail.ru/ promo site. This domain is not covered by bug bounty program. Since this site is not longer supported, an access was closed as a workaround...

surfline.com XSS vulnerability

Open Bug Bounty ID: OBB-462824 Description| Value ---|--- Affected Website:| surfline.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Uber: The Uber Promo Customer Endpoint Does Not Implement Multifactor Authentication, Blacklisting or Rate Limiting

Summary The https://cn-sjc1.uber.com/rt/users/apply-clients-promotions customer endpoint used to apply Uber promotions does not implement multifactor authentication, IP address blacklisting for multiple failed attempts, or IP address-based rate limiting to prevent brute force bearer token...

promo-code.net Open Redirect vulnerability

Vulnerable URL: http://www.promo-code.net/track/?url=http%3A//openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 10296910 VIP website status:| No Coordinated Disclosure Timeline:...

Mail.ru: reflected XSS on healt.mail.ru

Reflected XSS via GET paramters in quiz game on promo site in health.mail.ru subdomain. .health.mail.ru was in the bug bounty program's scope on the moment of report submission...

promo.ulaval.ca XSS vulnerability

Vulnerable URL: http://www.promo.ulaval.ca/T/WF/879/GULoZU/Info/Form.ofsys?urlprovenance=";alert'OPENBUGBOUNTY';// Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 13:13 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alex...

hostgator.com XSS vulnerability

Vulnerable URL: http://www.hostgator.com/promo/special-offeralert'OPENBUGBOUNTY'...

krasnodar.infinity-promo.ru Open Redirect vulnerability

Vulnerable URL: http://krasnodar.infinity-promo.ru/www/www.openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 18:41 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 1690009 VIP website...

Uber promo code vulnerability allows hackers a free ride-vulnerability warning-the black bar safety net

! Do you want to by Uber taxi services to travel free? If you are the Uber taxi service loyal users,or you've ever used Uber to call a car service,then this article will definitely make you excited. Because there is a name from the Egypt independent security researcher in the Uber app found a...

Uber Hack lets anyone find Unlimited Promo Codes for Free Uber Rides

An Independent Security Researcher from Egypt has discovered a critical vulnerability in Uber app that could allow an attacker to brute force Uber promo code value and get valid codes with the high amount of up to $25,000 for more than one free rides. Mohamed M.Fouad has discovered a "promo codes...

iGraal - Codes promo&Cashback - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application iGraal - Codes promo&Cashback published at the 'play' market has multiple vulnerabilities...

Uber: Possibility to enumerate and bruteforce promotion codes in Uber iOS App

Due to the lack of rate limiting on the promo code redemption endpoint, it was possible to enumerate promo codes. The response also leaked metadata about the user, including the country of the user, their name and profile photo. Thanks, @r0t! Uber has a feature in the iOS app to apply a promotion...

New Relic: No Rate Limitation on Promo Code

Hello, there is no rate limitation on entering "promo code" while upgrading the subscription. an attacker can bruteforce the promo code and could get a lot of benefits with that. https://rpm.newrelic.com/accounts/XXXXXXX/products i have tested this bug by attempting 500+ invalid promo code. and g...

CVE-2014-4528

Multiple cross-site scripting XSS vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator fbpromotions plugin 1.3.4 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 promotype, 2 fbeditaction, or 3 promoid...

Windows website loophole allow anyone to get WIndows 8 in just $14.99

Windows 8 launched in 37 languages and 140 worldwide markets, as the tech giant unveiled the new version of its computer operating system. The OS is now available in over 30 certified devices, and a broad selection of local apps are already available in the onboard Windows Store. It is also...