vc movie app has a payment logic design flaw

vc movie app is a movie information software on the phone. The vc movie app has a payment logic design vulnerability. Attackers use the vulnerability to bypass the payment verification mechanism to modify the payment amount...

Zomato: [www.zomato.com/dubai/gold] CRITICAL - Allowing arbitrary amount to become a GOLD Member

Hacker was able to find the internal testing Zomato Gold membership. I was able to purchase the PREMIUM GOLD MEMBERSHIP by selecting the amount of our own choice, here it required two conditions first is that you must have a valid premium membership. So, when I looked up the cost of the membershi...

Regular Expression Denial Of Service (ReDoS)

brace-expansion is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a string containing a large amount of commas to cause the package to hang...

Project Zero Prize Conclusion

Posted by Natalie Silvanovich, Project Zero On September 13, 2016 we announced the Project Zero Prize. It concluded last week with no prizes awarded. The purpose of this post is to discuss what happened and what we learned about hacking contest design. Throughout the contest, we did not receive a...

Scientific Linux Security Update : openssl on SL6.x, SL7.x i386/x86_64 (20170220)

Security Fixes : - An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. CVE-2017-3731 - A denial of service flaw was found in th...

Xi'an Concert Hall App Payment Logic Vulnerability

Xi'an Concert Hall Android Client is a smartphone application that provides Xi'an Concert Hall performance inquiry and ticket purchase. A payment logic vulnerability exists in the Xi'an Concert Hall app. An attacker can modify the payment amount by bypassing the bank verification mechanism by...

HackerOne: Reward Money Leakage

By monitoring the average bounty amounts of a team, you can infer a certain amount of information about the size of the bounties awarded, even if the team has chosen not to show bounty amounts. we have decided to close this report as Informative as we are okay with the current state of the bounty...

HackerOne: Know undisclosed Bounty Amount when Bounty Statistics are enabled.

Hi, When a program does not disclose How much bounty is paid to particular report , but if bounty statics is enabled then undisclosed Bounty Amount can be enumerated. For example Uber does not disclose bounty awarded to particular researcher but show bounty statics so we can write a script that...

CVE-2016-2106

Integer overflow in the EVPEncryptUpdate function in crypto/evp/evpenc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service heap memory corruption via a large amount of data...

[ MDVSA-2015:090 ] libpng

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:090 http://www.mandriva.com/en/support/security/ Package : libpng Date : March 28, 2015 Affected: Business Server 2.0 Problem Description: Updated libpng package fixes security vulnerabilities: The...

Cock wire from scratch-micro-shoot APP vulnerability-vulnerability warning-the black bar safety net

Micro-shot, is the mobile Internet the most popular mobile video social APP, has a unique whitening Skin Beauty and other video effects in iPhone and Android Phones the App Store social category and the photography category of the APP list are among the best in Beijing grasshopper online Technolo...

Mail.ru: money.mail.ru: Странное поведение SMS

Есть API для отправки SMS: POST /usr/sendsmscode HTTP/1.1 Host: money.mail.ru User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:28.0 Gecko/20100101 Firefox/28.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3...

GNU/Gallery <= 1.1.1.0 (admin.php) Local File Inclusion Vulnerability

No description provided by source. --==+================================================================================+==-- --==+ GNU/Gallery = 1.1.1.0 admin.php Local File Inclusion Vulnerability +==-- --==+================================================================================+==--...

Uzbey: Price Manipulation

Hey guys, I put this down as a 2nd bug as it may have been overlooked from the previous report and I figured it'd be easier to track a fix and add comments separately... When completing an order it looks like it may be possible to pay an arbitrary amount - what happens is a request is generated t...

haneWIN DNS服务器缓冲区溢出漏洞

BUGTRAQ ID: 65287 haneWIN DNS Server是Windows平台上的DNS服务器。 haneWIN DNS Server 1.5.3及其他版本在处理大量数据时存在SEH溢出，攻击者可利用此漏洞在应用上下文中执行任意代码。 0 hanewin haneWIN DNS Server 1.5.3 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.hanewin.net/dns-e.htm !/usr/bin/python Exploit Title: haneWIN DNS Server SEH...

CVE-2013-4627

Removed by vendor...

PHPCMS V9 member table of contents feel free to modify the vulnerability and fix-vulnerability warning-the black bar safety net

A variable is not initialized causing the server setting registerglobal=On when members can freely modify their own member information. Due to the need registerglobal=On support, the impact is limited.. Vulnerability relates to members can modify their own balance lead to the website may have...

CVE-2011-3954

Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service application crash via vectors that trigger a large amount of database usage...

Design/Logic Flaw

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service resource consumption via a URL associated with...

Linux Kernel <= 2.6.33.3 SCTP INIT Remote DoS

Exploit for linux platform in category dos / poc ============================================= Linux Kernel http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1173 The sctpprocessunkparam function in net/sctp/smmakechunk.c in the Linux kernel 2.6.33.3 and...