Palm North App has multiple vulnerabilities

Palm Shang Beiguo APP is a comprehensive mobile media platform created by Shijiazhuang Beiren Group, which integrates online shopping, member services, e-membership, member e-wallet, integral activities, coupon issuance, parking, navigation, scheduling, seat selection and other services. There ar...

Logic design flaws in the Android version of the E-Care App

E Nursing APP is a platform that provides professional nursing services for the majority of users through the development of an innovative health care service model by Shanghai Moyi Information Technology Development Co. There is a logical design vulnerability in the Android version of the E-Care...

One One Travel App Has Logic Design Flaws

One Rent Car is a new energy car time-share rental APP developed by Beijing One Rent Technology Co. One One Travel APP has a logical design vulnerability, attackers can successfully log in by grabbing packets to obtain the verification code...

Shandong government service app for Android has SMS bombing vulnerability

Shandong government service APP is a government information software created by the Shandong Government Office. The software can release the latest information of Shandong government services in time, support personalized subscription, full-text search function, to provide faster service for the...

Cuvva: Verification code for Underwriter dashboard can be brute-forced

Hi Cuvva, On the page of Underwriter dashboard https://underwriter.partner.cuvva.com/login/verify, the first option is to enter the email address of the person having the access to dashboard. I entered the email address of the guy whose email address was getting displayed in the bug:...

Trello: Phone verification code fails to expire and can be used multiple times also in different accounts to verify same cellphone number on Trello.com

Hi there Trello Security Team , I have noticed a certain behaviour at https://trello.com . What I belief to be a bug . Firstly , I would like to mention it is possible to use same cellphone number on multiple accounts without any problem , which I considere to be a security issue . I chose to...

Authentication Bypass

python-social-auth is vulnerable to authentication bypasses. A malicious user can log in once to obtain a genuine verification code and use it to log in to any other account in the system...

AVTECH video surveillance equipment authentication bypass and other vulnerabilities

Authentication bypass vulnerability There are two ways to achieve authentication bypass: The first one is. cab way, the cab file format is a video player plug-in, stored in the web root directory, it may need to verify directly be accessed and downloaded, and the device end only through the strst...

Coinbase: Authentication Issue

Hello there, I noticed while creating Recurring payment while 2FA is enabled it asks a user to enter verification code. So when someone confirm the Reccuring payment a request is sent to : POST /recurringpayments/58087a3d6861ee015644fc48/confirm HTTP/1.1 Host: beta.coinbase.com User-Agent:...

OLX: Bypassing Phone Verification For Posting AD On OLX

Overview In computer networks, rate limiting is used to control the rate of traffic sent or received by a network interface controller. It can be induced by the network protocol stack of the sender due to a received ECN-marked packet and also by the network scheduler of any router along the way...

Web Security testing common logic vulnerability analysis（combat article-the vulnerability warning-the black bar safety net

Logic vulnerabilities mining has always been Safety tested in the“timeless”topic. Compared toSQL injection, withXSSthe vulnerability of traditional security holes, and now the attacker is more inclined to use the business logic layer of the application security issues, such issues tend to harm th...

Mobile payment software is now vulnerabilities hackers use Siri to steal your money-vulnerability warning-the black bar safety net

! Venmo's security holes is by the Salesforce security engineer Martin Vigo found, and this vulnerability using the“medium”is very special, Siri in this process is very unfortunately become a hackers attack our tools. The hackers have to do things very simple, he just need to ask Siri to send a...

Trello: Verification Code Reused For activating 2FA

There is Authentication Problem with the Verification Code for Activating 2FA ! Description: Verification Code is getting reused for multiple times aven on every activation 2FA action there you recieve saperate an new Verification Code for Activating 2FA ! Proof Video thanks...

ChinaSoft Unified Terminal Security Management System Client Arbitrary Uninstallation Vulnerability

ChinaSoft Unified Terminal Security Management System is a comprehensive system management software that can guarantee system security. With the loophole of arbitrary uninstallation of the client of ChinaSoft Unified Terminal Security Management System, ordinary users who do not have administrato...

devise-two-factor 1.1.0 and earlier vulnerable to replay attacks

A OTP replay vulnerability in devise-two-factor 1.1.0 and earlier allows local attackers to shoulder-surf a user's TOTP verification code and use it to login after the user has authenticated. By not "burning" a previously used TOTP, devise-two-factor allows a narrow window of opportunity aka the...

iSMCloud平台逻辑缺陷重置任意用户密码(官方账户测试/秒改)

简要描述： 绕过验证码秒改用户密码！ 详细说明： 0x1:先用一个用户获取官方的邮箱。 [email protected] 就用这个用户来证明漏洞。 修改这个用户之前，我们先用自己的用户走一边正确的流程，为的就是获取正确的响应码。 获取正确的验证码，响应包返回如下。 "success":true,"msg":"resetpassword.jsp","errors":null,"resultData":null 漏洞证明： 0x2： 随意填入6位的验证码，无需获取验证码，下一步此时截断响应包，修改为正确的响应包。 跳到修改密码的界面，修改密码为wooyun123. 0x3:登陆验证。...

Automattic: Verification code issues for Two-Step Authentication

Hi there, I noticed two issues regarding the verification code that is sent to the phone as Two-Step Authentication for Wordpress accounts. I found out that verification code sent as SMS while enabling Two-Step Authentication can be reused infinitely for login. Issue1 The application does not...

Caught on the web of any user of the password reset vulnerability-vulnerability warning-the black bar safety net

Phone reset password password reset operation is not associated with a specific phone number, the lead can be reset to any phone registration account password. 1. The following url returns a result, you can traverse all the mobile phones registered account: http://api1.fun.tv/ajax/getmobilevcode/...

Password retrieve logic vulnerability summary-vulnerability warning-the black bar safety net

0x00 background description Please note these two articles: Password retrieve function there may be a problem Password retrieve function there may be issues supplemented From the above two documents the past six months, recently finishing a password to get back to the mind map, open the collectio...

A common Site Management System any user login/SQL injection/GetShell vulnerabilities source code analysis-vulnerability warning-the black bar safety net

Brief description: This system is not open source, most of the universities in use, turn the source off at the next Detailed description: 0x00 General case: code area Manufacturer: Rio Tinto tech Official website: http://www.ltpower.net/ The main is to do the educational products of the...