Yi Technology Home Camera 27US QR Code Base64 Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. An attacker can make the camera scan a QR code to trigger this vulnerability...

Keycloak vulnerable to uncontrolled resource consumption

JBoss KeyCloak versions prior to 1.0.3.Final allow remote attackers to create a denial of service resource consumption by supplying a large value in the size parameter to auth/qrcode, related to QR code generation...

GHSA-R32R-3977-CGC3 Keycloak vulnerable to uncontrolled resource consumption

JBoss KeyCloak versions prior to 1.0.3.Final allow remote attackers to create a denial of service resource consumption by supplying a large value in the size parameter to auth/qrcode, related to QR code generation...

Shopify: H1514 Ability to MiTM Shopify PoS Session to Takeover Communications

Hi @iv-rodriguez, After a decent amount more digging and research, I must disagree with you on the "expecting to work offline" portion. The code actually specifically listens on all local interfaces 0.0.0.0 and the wifi network address is specifically used in the QR code connection string, as sho...

h1-5411-CTF: Solution for h15411's CTF challenge

Baby steps Earlier today a friend tipped me off about an ongoing CTF challenge that was being run by HackerOne and would get the first ten winners a ticket to participate in h15411, which will be a live-hacking event happening in Buenos Aires. This immediately caught my attention and I decided to...

h1-5411-CTF: Flag WriteUp

Hello everyone , here is my writeup : Intro First I decoded the QR Code of the tweet , decoding to Here you go: 68747470733a2f2f68312d353431312e68316374662e636f6d . Decoding the hex value we get the challenge URL : https://h1-5411.h1ctf.com Path traversal + local file read On the website I found...

You down with P2P? 10 tips to secure your mobile payment app

If you look at the figures, you cannot deny that the eCommerce industry is steadily growing. More and more people are doing their shopping online, not only for products and services geared toward the use of technologies and the Internet, but also for items previously only found in brick and morta...

QR Code Bug in Apple iOS 11 Could Lead You to Malicious Sites

A new vulnerability has been disclosed in iOS Camera App that could be exploited to redirect users to a malicious website without their knowledge. The vulnerability affects Apple's latest iOS 11 mobile operating system for iPhone, iPad, and iPod touch devices and resides in the built-in QR code...

CVE-2014-3651

JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service resource consumption via a large value in the size parameter to auth/qrcode, related to QR code generation...

Design/Logic Flaw

JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service resource consumption via a large value in the size parameter to auth/qrcode, related to QR code generation...

CVE-2014-3651

JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service resource consumption via a large value in the size parameter to auth/qrcode, related to QR code generation...

CVE-2014-3651

Affected product: JBoss KeyCloak before 1.0.3.Final. Vulnerability: remote attackers can cause denial of service by sending a large value in the size parameter to auth/qrcode, related to QR code generation (resource consumption). Root cause: excessive resource usage leading to DoS. Impact: availa...

Why It’s Still A Bad Idea to Post or Trash Your Airline Boarding Pass

An October 2015 piece published here about the potential dangers of tossing out or posting online your airline boarding pass remains one of the most-read stories on this site. One reason may be that the advice remains timely and relevant: A talk recently given at a Czech security conference...

the Crypto Undertaker: Tomb

Tomb aims to be a free and open source system for easy encryption and backup of personal files, written in code that is easy to review and links shared GNU/Linux components. At present, Tomb consists of a simple shell script Zsh using standard filesystem tools GNU and the cryptographic API of the...

Legal Robot: Missing Issuer parameter on TOTP 2FA

During our 2FA challenge, a security researcher discovered that the Issuer parameter was not set in the TOTP URL that gets turned into a QR Code. While there is no direct security impact, it does make 2FA software tokens more difficult to manage...

wordpress plugin esponce-qr-code-generator cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin esponce-qr-code-generator, which, due to improper filteri...

Social Engineering Attack Vector: QRLJacking

Social Engineering Attack Vector QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on “Login with QR code” feature as a secure way to login into accounts. In a simple way, In a nutshell...

The micro-engine technology-the QR code to delete the page platform/qr.ctrl.php Sql injection

No description provided by source...

QRLJacking — Hacking Technique to Hijack QR Code Based Quick Login System

Do you know that you can access your WeChat, Line and WhatsApp chats on your desktop as well using an entirely different, but fastest authentication system? It's SQRL, or Secure Quick Response Login, a QR-code-based authentication system that allows users to quickly sign into a website without...

WhatsApp launches Desktop Software for Windows and Mac Users

The most popular messaging app WhatsApp now has a fully functional desktop app – both for Mac as well as Windows platform. Facebook-owned WhatsApp messaging software has been a mobile-only messaging platform forever, but from Tuesday, the company is offering you its desktop application for both...