198 matches found
Shopify: Expire User Sessions in Admin Site does not expire user session in Shopify Application in IOS
If an owner or an administrator clicks "Expire User Sessions" in Admin Site although you get the notification that all users where logged out, but this does not actually happens for the user that is currently logged in using the Shopify Application in IOS This was tested on the latest Shopify app...
Heroku Bug Bounty #2 - (API) Re Auth Bypass Vulnerability
Document Title: =============== Heroku Bug Bounty 2 - API Re Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1323 Video: http://www.vulnerability-lab.com/getcontent.php?id=1336 Vulnerability Magazine:...
Unix / Linux - Local Users Information : Passwords Never Expire
Using the supplied credentials, Nessus was able to list local users that are enabled and whose passwords never expire. TRUSTED...
Shopify: IDOR expire other user sessions
Hi here attacker able to expire other user session just changing the request Steps: 1. Login as Attacker 2. Go to account settings 3. Click on expire all session and capture request 4. replace account id with victim and forward 5. victim account logged out request POST...
ThinkPHP一处过滤不当造成SQL注入漏洞
简要描述： 内核中某个模块开发的太粗糙啦。 详细说明： 问题出现在session，Thinkphp支持更换session handle。 handle中包括Db和Memcache，如下配置即可使用数据库作为session的存储器： 设置了选项后，在数据库里插入这个表（前缀think可以自己定义）： / 数据库方式Session驱动 CREATE TABLE thinksession sessionid varchar255 NOT NULL, sessionexpire int11 NOT NULL, sessiondata blob, UNIQUE KEY sessionid...
Easy-LAN-Folder-Share-3.2.0-SEH
The registration code field in the 'activate license' window is vulnerable to a buffer overflow. This script generates a malicious registry file. Once the generated file has been loaded into the registry, execute the application as normal. header = "Windows Registry Editor Version 5.00\n\n" heade...
X (Formerly Twitter): getting emails of users/removing them from victims account [using typical attack]
Hey Hi, I would like to explain a typical type of attack combined with a brute force attack leading to email disclosure. conditions : should be having email notifications ON . Every time someone follows me , favs my tweet i get a notification on my email, and the footer of the email . click here ...
HackerOne: Broken Authentication and session management OWASP A2
Description: Session management issue in https://www.hackerone.com Cookies are used to maintain session of the particular user and they should expire once the user logs out of his hackerone account.In secure web application,Cookies immediately expire once the user logs out of his account. But thi...
Skype Account Service - Expire Token Bypass Vulnerability
Document Title: =============== Skype Account Service - Expire Token Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=762 Download: http://www.vulnerability-lab.com/resources/videos/762.wmv View: http://www.youtube.com/watch?v=lrNj785QQlg Advisory:...
Skype Account Service - Expire Token Bypass Vulnerability
Document Title: =============== Skype Account Service - Expire Token Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=762 Download: http://www.vulnerability-lab.com/resources/videos/762.wmv View: http://www.youtube.com/watch?v=lrNj785QQlg Advisory:...
Rookie Academy of crack Session cookie method-vulnerability warning-the black bar safety net
The so-called session cookies, is a platform in you after a successful login, a cookie that indicates you have passed verification, but with the General cookie is different, he will not be there on your hard drive, that is to say: before you leave the browser, it will disappear, which means: the...
curl TLS certificates spoofing
Certificate's activation adn expire dates are not checked if GnuTLS verification method is used...
Crack the Session cookie method-vulnerability warning-the black bar safety net
This method, I think, already with the 1,2 years, in the hope that there is a need friends useful. The so-called session cookie, is the site in your login is successful, the Send a cookie that indicates you have passed verification, but with the General cookie The difference is, he will not be...
v3chatIM.txt
V3 Chat Instant Messenger http://www.v3chat.com/ Affected files: /mail/index.php /mail/reply.php isonline.php online.php profile.php profileview.php search.php mycontacts.php expire.php Editing your profile: - input boxes ------------------------------------------ Mail Vulnerabilities: Full path...
Microsoft Windows - Local Users Information : Passwords Never Expire
Using the supplied credentials, Nessus was able to list local users that are enabled and whose passwords never expire. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10916; scriptversion"1.23"; scriptcvsdate"Date: 2018/08/13 14:32:39"; scriptnameenglish:"Microsoft...
Microsoft Windows - Users Information : Passwords Never Expire
Using the supplied credentials, Nessus was able to list users that are enabled and whose passwords never expire. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10900; scriptversion"1.22"; scriptcvsdate"Date: 2018/08/13 14:32:39"; scriptnameenglish:"Microsoft Windows ...
Poll It CGI 2.0 - Multiple Vulnerabilities
Poll It CGI 2.0 - Multiple Vulnerabilities !/usr/bin/perl Poll It CGI v2.0 exploit keelis/havoc korp 2000 shouts to modjo, p, zen, kd, ab, all the script kiddies. keelisathushmaildotcom use Socket; $host, $cgiloc = @ARGV0,1; $ip=inetaton$host; print"\n\t+--- Poll It CGI v2.0 exploit ---+";...
