megeve.com XSS vulnerability

Vulnerable URL: http://megeve.com/en/winter/revitalize-yourself/restaurants/?clearsearch=1/!/custom/custom/lang/en//pageno/en/pageno/clearsearch/1/pageno/4/pageno/4/3/pageno/1/pageno/2/pageno/4/"'--!=1=1/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017...

Zomato: Reflected XSS in Zomato Mobile - category parameter

Hi there. I have found a reflected XSS in Zomato.com mobile. This XSS affects mobile users of Zomato. Steps to reproduce: 1. Go to Zomato.com and change your user agent to mobile iPhone/Android user agent 2. Go to a certain restaurant/place and their photos e.g. site:...

Yelp: User can be fooled to Bookmark any restaurant by clickjacking

In this report https://hackerone.com/reports/214087 you people said the clickjacking issue is fixed but i have found another issue of clickjacking. Using clickjacking attacker can fooled an user to bookmark n numbers of restuarants. I am attaching a PoC video , watch the video...

Yelp: ClickJacking in editing business name

SUMMARY: Hope you guys are doing great. I found clickjacking vulnerability while updating business page.One of the endpoints which is vulnerable to clickjacking is https://www.yelp.com/bizattribute?bizid=RIyHYSf3lyJcFb4El9T4tQ . Clickjacking User Interface redress attack, UI redress attack, UI...

FIN7 Evolution and the Phishing LNK

FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015. FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7. FireEye recently observed a FIN7 spear phishin...

Dr. Panda Restaurant Asia - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Dr. Panda Restaurant Asia published at the 'play' market has multiple vulnerabilities...

restaurant-landivisiau.brit-hotel.fr XSS vulnerability

Vulnerable URL: http://restaurant-landivisiau.brit-hotel.fr/mapframe.php?lat=;...

restaurant-kerann.brit-hotel.fr XSS vulnerability

Vulnerable URL: http://restaurant-kerann.brit-hotel.fr/mapframe.php?lat=;...

restaurant-rodez.brit-hotel.fr XSS vulnerability

Vulnerable URL: http://restaurant-rodez.brit-hotel.fr/mapframe.php?lat=;...

restaurant-castel.brithotel.fr XSS vulnerability

Vulnerable URL: http://restaurant-castel.brithotel.fr/mapframe.php?lat=;...

restaurant-le-mans.brithotel.fr XSS vulnerability

Vulnerable URL: http://restaurant-le-mans.brithotel.fr/mapframe.php?lat=;...

restaurant-landivisiau.brithotel.fr XSS vulnerability

Vulnerable URL: http://restaurant-landivisiau.brithotel.fr/mapframe.php?lat=;...

restaurant-kerann.brithotel.fr XSS vulnerability

Vulnerable URL: http://restaurant-kerann.brithotel.fr/mapframe.php?lat=;...

restaurant-prema.brithotel.fr XSS vulnerability

Vulnerable URL: http://restaurant-prema.brithotel.fr/mapframe.php?lat=;...

Allset - Restaurant Ordering - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Allset - Restaurant Ordering published at the 'play' market has multiple vulnerabilities...

The Changing Face of Carbanak

Months of ramped up Carbanak activity that includes a new host of targets and new command and control strategy has reinvigorated attention on a criminal outfit that may have at one time stolen up to $1 billion from banks worldwide. Carbanak has moved on from an almost exclusive focus on financial...

guide-restaurant-bio.com XSS vulnerability

Vulnerable URL: http://www.guide-restaurant-bio.com/rechercher-restaurants-bio,1,0.php?rechercherNomRestaurant=%27%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FOPENBUGBOUNTY%2F%29%3E== Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS...

PizzaInn Beta 3 message-exec.php Cross Site Request Forgery

Exploit Title :----------------- : PizzaInn Restaurant Scripti Beta v3 - message-exec.php - CSRF Send Inbox Message. Author :------------------------ : Nassim Asrir Author Company :------------------------ : HenceForth Author Email :------------------------ : [email protected] Google Dork...

Zomato: CSRF in the "Add restaurant picture" function

Overview I found a CSRF vulnerability within the process responsible for adding photos for a restaurant which can lead to tricking victims into adding arbitrary photos to their restaurant's page. Details The CSRF vulnerability exists due to a misconfiguration on your part in which your X-CSRF-TOK...

Zomato: XSS onmouseover

Hi, my first rapport ever so be gentle! Found an XSS that can be executed by hoovering over links with Firefox https://www.zomato.com/cs/new-york-city/turtle-bay-restaurants/fast-casual/1zqjrw'/onmouseover='alert%281%29'/style='height:200;width:200'/b= Will add an picture also that proves that it...