Linked Questions
31 questions linked to/from How to disclose a security vulnerability in an ethical fashion?
25
votes
4
answers
4k
views
What to do when I find a possible security vulnerability of public interest? [duplicate]
Let's say I found a possible vulnerability in a security system. The system has been universally considered sound for years and nowadays is used worldwide.
I am not an expert in security, but there ...
- 269
20
votes
4
answers
3k
views
My old job has massive security exploits in their product, but they dont care [duplicate]
A company I used to work for developed a Point Of Sale system that also has an eCommerce portion. While working there, I discovered massive flaws with their security model.
Simply put, there is 0 ...
- 311
10
votes
1
answer
13k
views
Found security vulnerability, what should I do? [duplicate]
Possible Duplicate:
How to disclose a security vulnerability in an ethical fashion?
Reporting vulnerable sites
I've found a security vulnerability which gives me the ability transfer money to ...
- 307
7
votes
4
answers
1k
views
Where to publicly report a vulnerability, after developer ignores it? [duplicate]
If I've discovered a vulnerability, and disclosed it to the website/app's developer, how should I disclose it publicly?
I gave the developer ample time to address the issue, as recommended by this. ...
- 245
5
votes
2
answers
559
views
My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do? [duplicate]
Four years ago, I discovered that an applet on my college's website sends SQL queries directly to a server application. The databases contain nominal and personal information about students and grades,...
5
votes
3
answers
187
views
Ethics & releasing research with no viable solution [duplicate]
I've been doing some pretty interesting research that involves abusing a particular technology to carry out malicious behavior. Normally, upon completion of my research, I'd hand over all of my work ...
- 468
4
votes
2
answers
388
views
What to do if you think you discovered a zero day vulnerability? (white hat style) [duplicate]
Does anybody discovered a zero day vulnerability?
I know some black hat hackers sell that kind of info on deep web. But if you are a white hat...
Which steps to perform?
How to assure a CVE is ...
- 5,245
6
votes
1
answer
298
views
Publishing an exploit after vendor contact and patching [duplicate]
I recently discovered several serious security holes in a vendors product. I worked with them and they just released a patch.
I understand this is a very competitive field so I would like to publish ...
- 3,096
0
votes
0
answers
325
views
How to disclose a weak username/password? [duplicate]
I was collecting sites that use a system we're going live with. Just URLs and nothing more, so we can see what others have done with the same system to give us ideas.
Since I know how the system ...
- 287
-5
votes
1
answer
275
views
What should i do now? [duplicate]
i'm a student cybercrime.
I've tested sql injection on an indian site that sells properties etc..
I was vunerable so i kept going with testing.
so after half an hour i managed to get all the ...
- 9
5
votes
1
answer
156
views
Misconfiguration security vulnerability disclosure [duplicate]
I accidently discovered a misconfiguration (?) security vulnerability:
Workstation managing system is publicly exposed with default credentials. admin/admin
The system contains arround 2k ...
- 53
0
votes
0
answers
158
views
Dirty ajax calls allows me to get free pizza [duplicate]
Recently my buddy at work wanted to order some food for lunch from a website that we usually order from. The site allows the visitor to become a member of the site by registering and then logging in.
...
- 137
0
votes
1
answer
92
views
Where to expose flaws in security? [duplicate]
Some websites have ridiculous security flaws.
Thankfully the public is slowly becoming more aware, and many sites are fixing the more obvious ones, like lack of HTTPS, poor password creation ...
- 245
3
votes
0
answers
82
views
Bug in pay by phone screen accepts credit card information [duplicate]
I recently noticed some strange behavior in a pay-as you go mobile hotspot service when I was adding money to my account via phone.
I forgot my pin so I guessed. I was wrong. I guessed again, and it ...
0
votes
1
answer
90
views
Course of actions after finding security flaw [duplicate]
I've found what I believe is a significant security flaw on quite a big platform. It can be exploited to obtain on the orders of millions of email addresses with some additional data. They're big ...
- 3