Dual Opening Assistant App has a logical design flaw

Double Open Assistant APP is a game assistance application. There is a logical design vulnerability in Dual Open Assistant APP. Attackers can arbitrarily register users and reset arbitrary passwords by capturing packets to obtain verification codes...

EYEE Beehive App Has Logic Design Flaws

EYEE Bee Tide App is an online shopping app. There is a logical design vulnerability in EYEE Beehive APP. An attacker can register any account and reset any password by grabbing packets and bursting the verification code...

TeleShadow - Telegram Desktop Session Stealer (Windows)

Stealing desktop telegrams has never been so easy ! Set the email and sender details of the sender and recipient and send it to the victim after compiling. How do I use the session file? Delete everything inside folder at "C:\Users\YourName\AppData\Roaming\Telegram Desktop\tdata" Then Replace...

Logic design flaws in Zhongxinxin Sharing App

Zhongxinxin Sharing App is a car sharing software that allows you to book car reservations online. There is a logical design vulnerability in Zhongxinxin Sharing APP. An attacker can reset any password by grabbing packets to get the verification code through the forgot password function...

There are logic design flaws in the App of Promotion e-Network.

The App is a comprehensive learning and teaching aid product for high school students that integrates online learning, volunteer application, psychological counseling, and community communication. There is a logic design vulnerability in the Study eNET APP. Attackers can register any account and...

Arbitrary Account Password Reset Vulnerability in Haiwell Cloud SCADA Android App

Haiwell Cloud SCADA is an industrial automation monitoring and management platform software based on .NET Framework developed by Xiamen Haiwell Technology Co. An arbitrary account password reset vulnerability exists in the Haiwell Cloud SCADA Android APP. An attacker can reset any account passwor...

Worth Borrowing App Has Logic Design Flaws

Worth Borrowing App is a comprehensive lending platform with a huge selection of low-interest, low-threshold pure credit cash borrowing products. There is a logical design vulnerability in the Worth Borrowing App, which allows an attacker to log in to the system and perform unauthorized operation...

Palm North App has multiple vulnerabilities

Palm Shang Beiguo APP is a comprehensive mobile media platform created by Shijiazhuang Beiren Group, which integrates online shopping, member services, e-membership, member e-wallet, integral activities, coupon issuance, parking, navigation, scheduling, seat selection and other services. There ar...

Logic design flaws in the Android version of the E-Care App

E Nursing APP is a platform that provides professional nursing services for the majority of users through the development of an innovative health care service model by Shanghai Moyi Information Technology Development Co. There is a logical design vulnerability in the Android version of the E-Care...

One One Travel App Has Logic Design Flaws

One Rent Car is a new energy car time-share rental APP developed by Beijing One Rent Technology Co. One One Travel APP has a logical design vulnerability, attackers can successfully log in by grabbing packets to obtain the verification code...

Shandong government service app for Android has SMS bombing vulnerability

Shandong government service APP is a government information software created by the Shandong Government Office. The software can release the latest information of Shandong government services in time, support personalized subscription, full-text search function, to provide faster service for the...

Cuvva: Verification code for Underwriter dashboard can be brute-forced

Hi Cuvva, On the page of Underwriter dashboard https://underwriter.partner.cuvva.com/login/verify, the first option is to enter the email address of the person having the access to dashboard. I entered the email address of the guy whose email address was getting displayed in the bug:...

Trello: Phone verification code fails to expire and can be used multiple times also in different accounts to verify same cellphone number on Trello.com

Hi there Trello Security Team , I have noticed a certain behaviour at https://trello.com . What I belief to be a bug . Firstly , I would like to mention it is possible to use same cellphone number on multiple accounts without any problem , which I considere to be a security issue . I chose to...

Authentication Bypass

python-social-auth is vulnerable to authentication bypasses. A malicious user can log in once to obtain a genuine verification code and use it to log in to any other account in the system...

AVTECH video surveillance equipment authentication bypass and other vulnerabilities

Authentication bypass vulnerability There are two ways to achieve authentication bypass: The first one is. cab way, the cab file format is a video player plug-in, stored in the web root directory, it may need to verify directly be accessed and downloaded, and the device end only through the strst...

Coinbase: Authentication Issue

Hello there, I noticed while creating Recurring payment while 2FA is enabled it asks a user to enter verification code. So when someone confirm the Reccuring payment a request is sent to : POST /recurringpayments/58087a3d6861ee015644fc48/confirm HTTP/1.1 Host: beta.coinbase.com User-Agent:...

OLX: Bypassing Phone Verification For Posting AD On OLX

Overview In computer networks, rate limiting is used to control the rate of traffic sent or received by a network interface controller. It can be induced by the network protocol stack of the sender due to a received ECN-marked packet and also by the network scheduler of any router along the way...

Web Security testing common logic vulnerability analysis（combat article-the vulnerability warning-the black bar safety net

Logic vulnerabilities mining has always been Safety tested in the“timeless”topic. Compared toSQL injection, withXSSthe vulnerability of traditional security holes, and now the attacker is more inclined to use the business logic layer of the application security issues, such issues tend to harm th...

Mobile payment software is now vulnerabilities hackers use Siri to steal your money-vulnerability warning-the black bar safety net

! Venmo's security holes is by the Salesforce security engineer Martin Vigo found, and this vulnerability using the“medium”is very special, Siri in this process is very unfortunately become a hackers attack our tools. The hackers have to do things very simple, he just need to ask Siri to send a...

Trello: Verification Code Reused For activating 2FA

There is Authentication Problem with the Verification Code for Activating 2FA ! Description: Verification Code is getting reused for multiple times aven on every activation 2FA action there you recieve saperate an new Verification Code for Activating 2FA ! Proof Video thanks...