full-disclosure - Re: Yahoo! Store Security Advisory (Stuart Moore)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <e67b775b04092710276984dc68@mail.gmail.com>
From: timoguin at gmail.com (Tim O'Guin)
Subject: Re: Yahoo! Store Security Advisory (Stuart Moore)

This "vulnerability" is also present in the free PayPal shopping cart
as well as the more advanced eMartCart that will work with PayPal.  I
imagine other free shopping carts that have to have all the data
posted through an html form are susceptible to this as well.

IMO, it's not too much of a problem though.  If the vendor is stupid
enough not to realize that the price doesn't seem right then they
shouldn't be selling to the public.  Small price differences, however,
may be hard to recognize.

/me shrugs.