This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

Fashionbox Live - Exported components, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Fashionbox Live published at the 'play' market has multiple vulnerabilities...

MasterCard launches Credit Card with Built-In Fingerprint Scanner

MasterCard has unveiled its brand new payment card that has a built-in biometric fingerprint scanner, allowing customers to authorize payments with their fingerprint, without requiring a PIN code or a signature. The company is already testing the new biometric payment cards, combined with the...

content.capitalonecardservice.com XSS vulnerability

Vulnerable URL: http://content.capitalonecardservice.com/ccs/recurring/alerts/ealertbtposted.jsp?FirstName=Name=Yxxx4DIGITS=1234NAME=GMCardEmailAddress=Jxxxxx@yahoo.comABBREV=gmcard.comDESCCODE=GMCOLOR=5E93EACOLOR=5E93EACOLOR=5E93EA Details: Description| Value ---|--- Patched:| Yes, at 08.08.2017...

Hackers Steal Payment Card Data From Over 1,150 InterContinental Hotels

InterContinental Hotels Group IHG is notifying its customers that credit card numbers and other sensitive information may have been stolen after it found malware on payment card systems at 1,174 franchise hotels in the United States. It's the second data breach that U.K.-based IHG, which owns...

InterContinental Hotel Chain Breach Expands

In December 2016, KrebsOnSecurity broke the news that fraud experts at various banks were seeing a pattern suggesting a widespread credit card breach across some 5,000 hotels worldwide owned by InterContinental Hotels Group IHG. In February, IHG acknowledged a breach but said it appeared to invol...

Trello: Malicious file can be hidden as Card Attachment or Card Cover image

You can upload infected jpeg files to a card. If a user clicks on the attachment image, the infected file will get downloaded instead of showing the image. On opening it, any sort of system calls can be run on the victim. Steps to Reproduce 1 Navigate to https://trello.com/ 2 Click on the Tutoria...

IHG Confirms Second Credit Card Breach Impacting 1,000-Plus Hotels

In what’s becoming a familiar refrain to guests, InterContinental Hotels Group, said late last week that payment card systems at more than 1,000 of its hotels had been breached. It’s the second breach that IHG, a multinational hotel conglomerate that counts Holiday Inn and Crowne Plaza among its...

NetCam - Native code usage, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application NetCam published at the 'play' market has multiple vulnerabilities...

Brosix - External URLs, SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Brosix published at the 'play' market has multiple vulnerabilities...

Shoney’s Hit By Apparent Credit Card Breach

It's Friday, which means it's time for another episode of "Which Restaurant Chain Got Hacked?" Multiple sources in the financial industry say they've traced a pattern of fraud on customer cards indicating that the latest victim may be Shoney's, a 70-year-old restaurant chain that operates primari...

JVN#05340816: Multiple installers of Toshiba memory card related software may insecurely load Dynamic Link Libraries

Multiple installers of Toshiba memory card related software contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use the latest installe...

VR Space: The Last Mission - External URLs, Native code usage, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application VR Space: The Last Mission published at the 'play' market has multiple vulnerabilities...

sunhill mForce - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application sunhill mForce published at the 'play' market has multiple vulnerabilities...

Désiré - Corrupted files, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Désiré published at the 'play' market has multiple vulnerabilities...

CVE-2017-6603

A vulnerability in Cisco ASR 903 or ASR 920 Series Devices running with an RSP2 card could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on a targeted system because of incorrect IPv6 Packet Processing. More Information: CSCuy94366. Known Affected Releases...

CVE-2017-6603

Cisco issued advisory Cisco-SA-20170405-ASR describing CVE-2017-6603: A vulnerability in Cisco ASR 903/ASR 920 Series routers with an RSP2 card allows an unauthenticated, adjacent attacker to cause a denial-of-service by mishandling IPv6 packets. The root cause is insufficient IPv6 packet process...

Credit Card Manager - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Credit Card Manager published at the 'play' market has multiple vulnerabilities...

Like4Like - SD-card access, Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Like4Like published at the 'play' market has multiple vulnerabilities...

SayAt.Me - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application SayAt.Me published at the 'play' market has multiple vulnerabilities...