Linked Questions

25 votes
4 answers

What to do when I find a possible security vulnerability of public interest? [duplicate]

Let's say I found a possible vulnerability in a security system. The system has been universally considered sound for years and nowadays is used worldwide. I am not an expert in security, but there ...
Jacob's user avatar
  • 269
20 votes
4 answers

My old job has massive security exploits in their product, but they dont care [duplicate]

A company I used to work for developed a Point Of Sale system that also has an eCommerce portion. While working there, I discovered massive flaws with their security model. Simply put, there is 0 ...
ItsNotMe's user avatar
  • 311
10 votes
1 answer

Found security vulnerability, what should I do? [duplicate]

Possible Duplicate: How to disclose a security vulnerability in an ethical fashion? Reporting vulnerable sites I've found a security vulnerability which gives me the ability transfer money to ...
noob's user avatar
  • 307
7 votes
4 answers

Where to publicly report a vulnerability, after developer ignores it? [duplicate]

If I've discovered a vulnerability, and disclosed it to the website/app's developer, how should I disclose it publicly? I gave the developer ample time to address the issue, as recommended by this. ...
Academiphile's user avatar
5 votes
2 answers

My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do? [duplicate]

Four years ago, I discovered that an applet on my college's website sends SQL queries directly to a server application. The databases contain nominal and personal information about students and grades,...
Concerned Kid's user avatar
5 votes
3 answers

Ethics & releasing research with no viable solution [duplicate]

I've been doing some pretty interesting research that involves abusing a particular technology to carry out malicious behavior. Normally, upon completion of my research, I'd hand over all of my work ...
haze's user avatar
  • 468
4 votes
2 answers

What to do if you think you discovered a zero day vulnerability? (white hat style) [duplicate]

Does anybody discovered a zero day vulnerability? I know some black hat hackers sell that kind of info on deep web. But if you are a white hat... Which steps to perform? How to assure a CVE is ...
OscarAkaElvis's user avatar
6 votes
1 answer

Publishing an exploit after vendor contact and patching [duplicate]

I recently discovered several serious security holes in a vendors product. I worked with them and they just released a patch. I understand this is a very competitive field so I would like to publish ...
Jason's user avatar
  • 3,126
0 votes
0 answers

How to disclose a weak username/password? [duplicate]

I was collecting sites that use a system we're going live with. Just URLs and nothing more, so we can see what others have done with the same system to give us ideas. Since I know how the system ...
pee2pee's user avatar
  • 297
-5 votes
1 answer

What should i do now? [duplicate]

i'm a student cybercrime. I've tested sql injection on an indian site that sells properties etc.. I was vunerable so i kept going with testing. so after half an hour i managed to get all the ...
Feint's user avatar
  • 9
5 votes
1 answer

Misconfiguration security vulnerability disclosure [duplicate]

I accidently discovered a misconfiguration (?) security vulnerability: Workstation managing system is publicly exposed with default credentials. admin/admin The system contains arround 2k ...
user2917823's user avatar
0 votes
0 answers

Dirty ajax calls allows me to get free pizza [duplicate]

Recently my buddy at work wanted to order some food for lunch from a website that we usually order from. The site allows the visitor to become a member of the site by registering and then logging in. ...
JonH's user avatar
  • 137
1 vote
1 answer

Where to expose flaws in security? [duplicate]

Some websites have ridiculous security flaws. Thankfully the public is slowly becoming more aware, and many sites are fixing the more obvious ones, like lack of HTTPS, poor password creation ...
Academiphile's user avatar
0 votes
1 answer

Course of actions after finding security flaw [duplicate]

I've found what I believe is a significant security flaw on quite a big platform. It can be exploited to obtain on the orders of millions of email addresses with some additional data. They're big ...
reveance's user avatar
3 votes
0 answers

Bug in pay by phone screen accepts credit card information [duplicate]

I recently noticed some strange behavior in a pay-as you go mobile hotspot service when I was adding money to my account via phone. I forgot my pin so I guessed. I was wrong. I guessed again, and it ...
Sweasonable Doubt's user avatar

15 30 50 per page