LY Corporation: SSRF occurrence in website preview used by LINE Official Account Manager (https://manager.line.biz)

LINE Official Account Manager https://manager.line.biz uses PagePoker to provide website previews. Here it was not properly validated against the Opengraph image tag target, which could point to an internal network resource...

LY Corporation: Able to Become Admin for Any LINE Official Account

The reporter found an issue where abusing an IDOR would allow for an attacker to become an administrator of any LINE Official Account. This was due to an issue where the group ID could be extracted and/or easily guessed, combined with lack of authentication, leading to being able to craft a reque...

Starbucks: unuse domain still in using at wechat by Starbucks East China

Summary: spcc.mobi is still using at wechat offical account by Starbucks East China. but this domain is on sale. Description: I had reported this at reportid=433843，bu your gays had ignored, because they said the domain is unused. In fact, spcc.mobi still having an interface using at wechat offic...

iSMCloud平台逻辑缺陷重置任意用户密码(官方账户测试/秒改)

简要描述： 绕过验证码秒改用户密码！ 详细说明： 0x1:先用一个用户获取官方的邮箱。 [email protected] 就用这个用户来证明漏洞。 修改这个用户之前，我们先用自己的用户走一边正确的流程，为的就是获取正确的响应码。 获取正确的验证码，响应包返回如下。 "success":true,"msg":"resetpassword.jsp","errors":null,"resultData":null 漏洞证明： 0x2： 随意填入6位的验证码，无需获取验证码，下一步此时截断响应包，修改为正确的响应包。 跳到修改密码的界面，修改密码为wooyun123. 0x3:登陆验证。...

President Ali Abdullah Saleh website hacked !

Yemen has denied that the website of President Ali Abdullah Saleh—the ambition of anti-government protests—was brought bottomward by hackers this accomplished week, its official account bureau said. "An official in the admiral of advice and advice technology denied letters claiming that the websi...