Command injection

Barco TransForm N before 3.8 allows Command Injection issue 2 of 4. The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An...

SQL Injection Vulnerability in WDECP-IC Card Metering Management Platform

Tangshan Liulin Automation Equipment Co., Ltd. is a high-tech enterprise engaged in the research and development, production, sales and system engineering technical services of Internet of Things security communication terminal and intelligent application platform software. WDECP-IC card metering...

Juspay data breach 35 million customers’ card data sold on dark web

By Waqas The Indian startup Juspay handles payments for online marketplaces, including Amazon. This is a post from HackRead.com Read the original post: Juspay data breach 35 million customers card data sold on dark web...

Data from August Breach of Amazon Partner Juspay Dumped Online

Data from a breach that occurred five months ago involving Juspay, which handles payments for Amazon and other online retailers in India, has been dumped online, a researcher has found. Security researcher Rajshekhar Rajaharia discovered data of 35 million Indian credit-card holders from a breach...

Qualcomm Automotive Telematics Security Breach

Qualcomm Automotive Telematics is a support firmware for automotive telematics from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Automotive Telematics where a newly created buffer is read again from mmc without validation. mdm9630, mdm9640, mdm9650, mdm9655, msm8909w,...

PT-2021-03: Apple Pay authentication and fields validation issues

Apple allows payments using Transport Card for amount0.00, without implementing proper authentication to ensure that only dedicated transport terminals were used for paying on locked or uncharged iPhones. Advisory status: October, 2021 - Vendor notification date Credits: Timur Yunusov...

The most enticing cyberattacks of 2020

This is part one of a two-part series. To read about the strangest cybersecurity events of 2020, read our second story here. In 2020, we experienced a major shift. Much of the world pitched in to limit the spread of the coronavirus, with people changing their daily routines to include a mixture o...

Law Enforcement Seizes Joker's Stash — Stolen Credit Card Marketplace

The US Federal Bureau of Investigation FBI and Interpol have allegedly seized proxy servers used in connection with Blockchain-based domains belonging to Joker's Stash, a notorious fraud bazaar known for selling compromised payment card data in underground forums. The takedown happened last week ...

Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Synergy (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects Rational Synergy. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Joker's Stash Carding Site Taken Down

Joker’s Stash, the carding site where cybercriminals hawk their payment-card wares, has suffered a blow after law enforcement apparently seized one of its domains. Joker’s Stash is a popular cybercriminal destination that specializes in trading in payment-card data, offering millions of stolen...

Dark Web Pricing Skyrockets for Microsoft RDP Servers, Payment-Card Data

Cybercriminals are vying for Remote Desktop Protocol RDP access, stolen payment cards and DDoS-for-Hire services, based on a recent analysis of underground marketplace pricing. During the COVID-19 pandemic, cybercriminals have profited with “increasingly advantageous positions to benefit from the...

Research: Stealing data from air-gapped PC by turning RAM into Wi-Fi Card

By Deeba Ahmed Israeli Researchers Discover New Data Exfiltration Technique by Turning RAM into Wi-Fi Card. Here's what the researchers have found out. This is a post from HackRead.com Read the original post: Research: Stealing data from air-gapped PC by turning RAM into Wi-Fi Card...

Online Health Card System 1.0 SQL Injection

Exploit Title: ​Authentication Bypass via ​SQL injection on ​Online Health Care System 1.0 Date: 23/10/2020 Exploit Author: Valerio Alessandroni Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/14526/online-health-care-system-php-full-source-code-...

A week in security (December 7 – December 13)

Last week on Malwarebytes podcast we talked to Doug Levin, founder of the K12 cybersecurity resource center and advisor to the K12 Security Information Exchange, about how schools can plan for a cybersecure 2021. We also released a Malwarebytes Labs report revealing that 50 percent of schools did...

VPX on SDX 22000 - 12.1 build 55.18 - SSL card going down due to unsupported ECDSA ECC Curves

SSL card on primary and secondary devices are showing failed and then both devices have become secondary. In thenewnslog , the countersslerrcardstatusdown will get incremented. In the packet trace, you can see the Client certificate with ECDSA ECC Curve 224...

Security Issues in PoS Terminals Open Consumers to Fraud

Researchers are detailing widespread security issues in point-of-sale PoS terminals – specifically, three terminal device families manufactured by vendors Verifone and Ingenico. Click to register. The issues, which have been disclosed to the vendors and since patched, open several popular PoS...

Hiding Malware in Social Media Buttons

Clever tactic: This new malware was discovered by researchers at Dutch cyber-security company Sansec that focuses on defending e-commerce websites from digital skimming also known as Magecart attacks. The payment skimmer malware pulls its sleight of hand trick with the help of a double payload...

Denial of Service Vulnerability in Schneider Tricon Safety Instrumented Systems TCM 4351B Communication Card (CNVD-2020-70795)

Tricon Safety Instrumented System is a safety instrumented system from Schneider Electric Co. The TCM 4351B communication card is a communication card for the Tricon Safety Instrumented System from Schneider, which supports Ethernet as well as serial communication. A denial of service vulnerabili...

What the cluck?! Cyber hygiene when eating out.

This feels like the new norm for eating out at a restaurant: Stand uncomfortably, 2 metres from the party in front/furrow your brow when the other party move within your “safe zone”. Make a huge over-theatrical show of sanitising your hands, as though you’re about to perform some major surgery...

Authorities disrupt massive stolen credit card trading scam on dark web

By Deeba Ahmed Dubbed Carding Action 2020; the operation aimed at targeting several dark web marketplaces resulting in saving $48million/€40 million. This is a post from HackRead.com Read the original post: Authorities disrupt massive stolen credit card trading scam on dark web...