Smartphone shopaholic

Have you ever noticed strange reviews of Google Play apps that look totally out of place? Their creators might give it five stars, while dozens of users rate it with just one, and in some cases the reviews seem to be talking about some other program entirely. If so, you may be unknowingly...

Starbucks: India - OTP bypass on Phone number verification for account creation

dekster discovered a mobile number verification bypass via incorrect client side validation allowing an attacker to validate a new account creation without a valid phone number attached. @dekster — thank you for reporting this vulnerability and for confirming the resolution...

Citrix ADC (NetScaler) Directory Traversal RCE

This module exploits a directory traversal in Citrix Application Delivery Controller ADC, aka NetScaler, and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0, to execute an arbitrary command payload. Module Options msf use exploit/freebsd/http/citrix/dirtraversalrce msf undefineddirtraversalrce show...

A week in security (October 28 – November 3)

Last week on Malwarebytes Labs, we celebrated the birth of the Internet 50 years ago, highlighted reports about the US Federal Trade Commission FTC filing a case against stalkerware developer Retina-X, issued a PSI on disaster donation scams, looked at the top cybersecurity challenged SMBs face,...

This Week in Security News: Trend Micro Launches its XDR Center in India and EU Reports 5G Cybersecurity Risks

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about Trend Micro’s new XDR Center in India that will help solve data sovereignty issues. Also, read about 5G network software use bei...

The State of Stalkerware in 2019

Introduction and methodology Six months ago, we created a special alert that notifies users about commercial spyware stalkerware products installed on their phones. This report examines the use of stalkerware and the number of users affected by this software in the first eight months of 2019...

Starbucks: India - An Insecure Direct Object Reference (IDOR) allowed unauthorized access to view card index number and monetary balance

mrintrusionist discovered an Insecure Direct Object Reference IDOR which affects the https://card.starbucks.in/StarbucksMSRModule/starbucksGetCardData.do endpoint through the cardId parameter. This allowed an authenticated, but unauthorized user to iterate cards and view the balance...

Dtrack RAT is Behind Virulent ATM-Espionage Campaign

An espionage malware called Dtrack – and a related variant, ATMDtrack – has been traced back to the notorious North Korea-linked Lazarus Group APT. Both have been identified this month targeting victims in India. According to researcher Konstantin Zykov of Kaspersky, researchers first uncovered...

WordPress WooCommerce PayU India Payment Gateway Plugin Unauthorized Operation Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WooCommerce PayU India Payment Gateway plugin is one of the PayU payment gateway plugins used in it. A security...

CVE-2019-14978

/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for lower than the intended price...

CVE-2019-14978

The CVE-2019-14978 entry concerns the WooCommerce PayU India Payment Gateway plugin for WordPress, version 2.1.1. A vulnerability exists in the /payu/icpcheckout/ component where the purchaseQuantity=1 parameter can be tampered, enabling a buyer to pay less than the intended price. Publicly avail...

WooCommerce PayU India <= 2.1.1 - Price Tampering

The last time it was checked the plugin was still affected and had been closed...

Exploit for Path Traversal in Ivanti Connect_Secure

CVE-2019-11510-poc Pulse Secure SSL VPN pre-auth file reading...

Best Soft Inc.(BSI) Advance Hotel Booking System Cross-Site Scripting Vulnerability

Best Soft Inc.BSI Advance Hotel Booking System is a hotel online booking system from Best Soft India. The system offers modules for hotel booking, room search and discount coupons. A cross-site scripting vulnerability exists in the bookingdetails.php script in the Best Soft Inc. BSI Advance Hotel...

Kartpay: Application Design issue for Phone Number field in Registration.

The current system only works for India so ISD Code of India i.e +91 is mandatory for Registration. During the Registration system was accepting any country ISD code due to Request was not validated by the system instead whatever sent through client-side modification is accepted. So the Strict...

Iran-linked APT33 Shakes Up Cyberespionage Tactics

Following a recent report detailing APT33’s infrastructure and tactics, the Iranian state-sponsored threat actor shook up its cyberespionage efforts by adopting new tools and reassigning key domain infrastructure. The infrastructure overhaul stems from a March 2019 Symantec report exposing the...

Over 100 Million JustDial Users' Personal Data Found Exposed On the Internet

An unprotected database belonging to JustDial, India's largest local search service, is leaking personally identifiable information of its every customer in real-time who accessed the service via its website, mobile app, or even by calling on its fancy "88888 88888" customer care number, The Hack...

Data Breaches of the Week: Tales of PoS Malware, Latrine Status

The data-breach onslaught continued this week with casualties sprinkled across the globe. Victims included retailers, banks and one state-owned gas station. The theme this was the Indian subcontinent, with consumers in Pakistan and India feeling the main brunt of the proceedings. A point-of-sale...

2019 Already Marred By Slew of Data Breach Incidents

It has been a busy year for data breaches already, and January isn’t even officially over. This past week has been no exception. In past seven days, in addition to the Airbus news that we previously reported, Discover Financial, IT management giant Rubrik, the City of St. John in New Brunswick,...

Data Exposed in OXO, Amazon and MongoDB Leaks

2019 has so far been making good on security experts’ predictions that there will be no ebb in data exposures for the new year: In the first half of January, several data breaches and leaks have already come to light, including three notable incidents at well-known firms in just the past week. Ov...