CVE-2021-35060: Generation of Error Message Containing Sensitive Information

/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system...

PT-2021-20819

Name of the Vulnerable Software and Affected Versions: OpenWay WAY4 ACS versions prior to 1.2.278-2693 Description: The issue allows unauthenticated attackers to discover whether a specific payment card number is stored in the system by leveraging response differences. The "/way4acs/enroll"...

PT-2021-20818

Name of the Vulnerable Software and Affected Versions: OpenWay WAY4 ACS versions prior to 1.2.278-2693 Description: The issue allows for XSS via the "/way4acs/enroll" action parameter. This means an attacker could potentially inject malicious scripts into the application, affecting users who...