Linked Questions

26
votes
4answers
4k views

What to do when I find a possible security vulnerability of public interest? [duplicate]

Let's say I found a possible vulnerability in a security system. The system has been universally considered sound for years and nowadays is used worldwide. I am not an expert in security, but there ...
21
votes
4answers
3k views

My old job has massive security exploits in their product, but they dont care [duplicate]

A company I used to work for developed a Point Of Sale system that also has an eCommerce portion. While working there, I discovered massive flaws with their security model. Simply put, there is 0 ...
7
votes
1answer
7k views

Found security vulnerability, what should I do? [duplicate]

Possible Duplicate: How to disclose a security vulnerability in an ethical fashion? Reporting vulnerable sites I've found a security vulnerability which gives me the ability transfer money to ...
7
votes
4answers
1k views

Where to publicly report a vulnerability, after developer ignores it? [duplicate]

If I've discovered a vulnerability, and disclosed it to the website/app's developer, how should I disclose it publicly? I gave the developer ample time to address the issue, as recommended by this. ...
5
votes
2answers
484 views

My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do? [duplicate]

Four years ago, I discovered that an applet on my college's website sends SQL queries directly to a server application. The databases contain nominal and personal information about students and grades,...
5
votes
3answers
141 views

Ethics & releasing research with no viable solution [duplicate]

I've been doing some pretty interesting research that involves abusing a particular technology to carry out malicious behavior. Normally, upon completion of my research, I'd hand over all of my work ...
4
votes
2answers
296 views

What to do if you think you discovered a zero day vulnerability? (white hat style) [duplicate]

Does anybody discovered a zero day vulnerability? I know some black hat hackers sell that kind of info on deep web. But if you are a white hat... Which steps to perform? How to assure a CVE is ...
6
votes
1answer
160 views

Publishing an exploit after vendor contact and patching [duplicate]

I recently discovered several serious security holes in a vendors product. I worked with them and they just released a patch. I understand this is a very competitive field so I would like to publish ...
0
votes
0answers
224 views

How to disclose a weak username/password? [duplicate]

I was collecting sites that use a system we're going live with. Just URLs and nothing more, so we can see what others have done with the same system to give us ideas. Since I know how the system ...
-5
votes
1answer
188 views

What should i do now? [duplicate]

i'm a student cybercrime. I've tested sql injection on an indian site that sells properties etc.. I was vunerable so i kept going with testing. so after half an hour i managed to get all the ...
5
votes
1answer
97 views

Misconfiguration security vulnerability disclosure [duplicate]

I accidently discovered a misconfiguration (?) security vulnerability: Workstation managing system is publicly exposed with default credentials. admin/admin The system contains arround 2k ...
0
votes
0answers
114 views

Dirty ajax calls allows me to get free pizza [duplicate]

Recently my buddy at work wanted to order some food for lunch from a website that we usually order from. The site allows the visitor to become a member of the site by registering and then logging in. ...
3
votes
0answers
78 views

Bug in pay by phone screen accepts credit card information [duplicate]

I recently noticed some strange behavior in a pay-as you go mobile hotspot service when I was adding money to my account via phone. I forgot my pin so I guessed. I was wrong. I guessed again, and it ...
0
votes
1answer
49 views

Where to expose flaws in security? [duplicate]

Some websites have ridiculous security flaws. Thankfully the public is slowly becoming more aware, and many sites are fixing the more obvious ones, like lack of HTTPS, poor password creation ...
0
votes
0answers
21 views

What is the proper procedure for a ATM security disclosure? [duplicate]

I've discovered a possible security vulnerability in a line of ATMs. What is the ethical notification protocol? How long does one wait after notifying the company before making a public disclosure?

15 30 50 per page