Shopify: Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections

The following report intends to disclose a bypass for 416983. It's been found that removed staff members who had "Apps" permission can still modify flow app connection settings due to improper authorization. Description Signed URLs generated by Shopify Flow https://apps.shopify.com/flow use a...

Shopify: H1514 Removed Staff members who had "Apps" permission can still modify flow app connections

Summary: It's been found that removed staff members who had "Apps" permission can still modify flow app connection settings due to improper authorization. Description: Flow app https://apps.shopify.com/flow allows users to connect their Google Sheets, Trello and Asana accounts to their flow...

Google Sheets - BSD license, Exported ContentProvider, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Google Sheets published at the 'play' market has multiple vulnerabilities...

Carbanak Using Google Services for Command and Control

Carbanak certainly has not sat idly by after years of advanced criminal campaigns targeting primarily financial institutions. The outfit, alleged to have stolen from more than 100 banks worldwide, has popped up again with a new means of managing command and control over its malware and implants...

Uber: XSS in ubermovement.com via editable Google Sheets

A publicly-editable Google Sheet rendered on various ubermovement.com subdomains allowed anyone to inject HTML content into the page. It was possible for an attacker to inject malicious JavaScript code into the page by editing cells within the sheet, which would then be loaded by anyone who viewe...