Over 1 Billion Mobile App Accounts can be Hijacked Remotely with this Simple Hack

Security researchers have discovered a way to target a huge number of Android and iOS apps that could allow them to remotely sign into any victim's mobile app account without any knowledge of the victim. A group of three researchers – Ronghai Yang, Wing Cheong Lau, and Tianyu Liu – from the Chine...

bandmix.co.uk XSS vulnerability

Vulnerable URL: http://www.bandmix.co.uk/sign-in/ Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 11:53 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 301726 VIP website status:| No Check bandmix.co.uk SSL...

October 11, 2016 — KB3192441 (OS Build 10586.633)

None None...

October 11, 2016 — KB3194798 (OS Build 14393.321)

None None...

October 11, 2016 — KB3192440 (OS Build 10240.17146)

None None...

September 13, 2016 — KB3185611 (OS Build 10240.17113)

None None...

Instacart: Brute force login and bypass locked account restrictions via iOS app

When logging in to an account on the website, a user's account gets locked out after 15 tries to prevent an attacker from brute forcing access to the account. These same restrictions do not apply to the mobile sign-in endpoint a POST request to https://www.instacart.com/oauth/token, which allows ...

my.luckymarble.com XSS vulnerability

Open Bug Bounty ID: OBB-174317 Description| Value ---|--- Affected Website:| my.luckymarble.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Harvest: CSRF token fixation in Sign in with Google

Hi There is CSRF token fixation in Sign in with Google at https://id.getharvest.com/sessions/new The state parameter is same for any time login https://id.getharvest.com/oauth2/callback?state=%7B%22intent%22:%22sign-in%22%7D&code=code Steps to reproduce 1. Go to...

June 14, 2016 — KB3163017 (OS Build 10240.16942)

None None...

linkmarket.net XSS vulnerability

Open Bug Bounty ID: OBB-158306 Description| Value ---|--- Affected Website:| linkmarket.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-4792

Pulse Connect Secure PCS 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors...

CVE-2016-4792

Pulse Connect Secure PCS 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors...

Code injection

Pulse Connect Secure PCS 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors...

PT-2016-6146 · Pulse · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure PCS versions 8.2 through 8.2r1 Description: The issue allows remote attackers to disclose sign in pages via unspecified vectors. Recommendations: For Pulse Connect Secure PCS versions 8.2 through 8.2r1, update to version...

May 10, 2016 — KB3156387 (OS Build 10240.16854)

None None...

APITest.IO: Clickjacking: X-Frame-Options header missing

same as this report https://hackerone.com/reports/7492 vulnerable :- sign in ,sign up ,and main domain poc attached...

Adobe Experience Manager (AEM) Detection (HTTP)

HTTP based detection of Adobe Experience Manager AEM. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

tentown.co.uk XSS vulnerability

Vulnerable URL: https://www.tentown.co.uk/signin.php?message=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

HackerOne: HackerOne Private Programs users disclosure and de-anonymous-ize

Hi HackerOne Team, I have found a bug in HackerOne Platform allows any attacker to deanonymousize any security researcher using the platform and the most wild usage is to disclose some information about this security researcher if he is invited to a private program or not. Unfortunately HackerOne...