CVE-2018-17768

CVE-2018-17768 affects Ingenico Telium 2 POS terminals, where an insecure TRACE protocol was exposed. The issue is resolved by applying Telium 2 SDK v9.32.03 patch N. Affected component: TRACE protocol handling in Telium 2 devices; root cause reported as insecure TRACE use. CVSS data from sources...

CVE-2018-17768

Ingenico Telium 2 POS terminals have an insecure TRACE protocol. This is fixed in Telium 2 SDK v9.32.03 patch N...

CVE-2018-17767

Ingenico Telium 2 POS terminals have hardcoded PPP credentials. This is fixed in Telium 2 SDK v9.32.03 patch N...

CVE-2018-17767

Summary : CVE-2018-17767 affects Ingenico Telium 2 POS terminals due to hardcoded PPP credentials. The connected sources confirm the vulnerability and state the issue is fixed in Telium 2 SDK v9.32.03 patch N. Affected component : Ingenico Telium 2 POS terminals (SDK level). Root cause : hardcode...

CVE-2018-17766

Ingenico Telium 2 POS Telium2 OS allow bypass of file-reading restrictions via the NTPT3 protocol. This is fixed in Telium 2 SDK v9.32.03 patch N...

CVE-2018-17766

The CVE-2018-17766 entry concerns Ingenico Telium 2 POS devices running Telium2 OS, where a flaw allows bypassing file-reading restrictions via the NTPT3 protocol. Multiple connected sources confirm the affected product family and the root cause is a file-access bypass within NTPT3. The vulnerabi...

CVE-2018-17765

CVE-2018-17765 affects Ingenico Telium 2 POS terminals where TRACE protocol commands were undeclared. Multiple connected sources confirm the issue lies in Telium 2 software prior to the Telium 2 SDK v9.32.03 patch N. The remediation is to upgrade to Telium 2 SDK v9.32.03 patch N (or later) to res...

CVE-2018-17765

Ingenico Telium 2 POS terminals have undeclared TRACE protocol commands. This is fixed in Telium 2 SDK v9.32.03 patch N...

PT-2020-8620 · Ingenico · Ingenico Telium 2 Pos

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS Telium2 OS versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue allows bypass of file-reading restrictions via the NTPT3 protocol. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch N,...

PT-2020-8625 · Ingenico · Ingenico Telium 2

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns hardcoded FTP credentials in Ingenico Telium 2 POS terminals. This allows unauthorized access. The problem is fixed in Telium 2 SD...

PT-2020-8628 · Ingenico · Ingenico Telium 2

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns an insecure NTPT3 protocol in Ingenico Telium 2 POS terminals. Recommendations: For versions prior to Telium 2 SDK v9.32.03 patch ...

PT-2020-8622 · Ingenico · Ingenico Telium 2

Name of the Vulnerable Software and Affected Versions: Ingenico Telium 2 POS terminals versions prior to Telium 2 SDK v9.32.03 patch N Description: The issue concerns an insecure TRACE protocol in Ingenico Telium 2 POS terminals. This problem is resolved in Telium 2 SDK v9.32.03 patch N...

Shopify: Stocky App Administrator can create a backdoor admin account by using an existing POS User

Details The Stocky App has POS Users that are being created once a POS Staff logs in into the application from the Point Of Sale application on a mobile device. From the users management page located at https://stocky.shopifyapps.com/users there's no visible way to edit those POS users. Although,...

Shopify: STAFF "No-Permissions" on the Store can retrieve the details Order via exchangeReceiptSend

I discovered a bug in an android mobile app that allowed STAFF No Permissions using Receipt Send to Mobile of any Order information in the Store. Steps to reproduce: 1 STAFF account is created and assigned "No Permissions" on a Shop by Owner/Admin 2 STAFF then login to shop. Notice that STAFF is...

Alina Point-of-Sale Malware Spotted in Ongoing Campaign

A venerable point-of-sale POS malware called Alina that’s been around since 2012 is back in circulation, with a new trick for stealing credit- and debit-card data: Domain Name System DNS tunneling. DNS is the mechanism by which numeric IP addresses are linked to website names; DNS translates...

Sodinokibi Ransomware Now Scans Networks For PoS Systems

Cybercriminals behind recent Sodinokibi ransomware attacks are now upping their ante and scanning their victims’ networks for credit card or point of sale PoS software. Researchers believe this is a new tactic designed to allow attackers to get the biggest bang for their buck – ransom payments an...

Shopify: Low Privileged user can add or remove cash to/from sales register

Low privileged user having no access to Shopify POS and very low permission set is not allowed to add cash to the sales register or remove cash from the sales register. But missing server-side permission checks on the vulnerable request allows a low privileged user to do this. A low privileged ca...

TAU Technical Report: New Attack Combines TinyPOS With Living-off-the-Land Techniques for Scraping Credit Card Data

In April of 2020 VMware Carbon Black Threat Analysis Unit TAU researchers worked with an Incident Response IR partner on a piece of malware that was discovered during an ongoing PCI investigation. The combined analysis showed that attackers who previously leveraged a malware family called TinyPOS...

Shopify: Takeover an account that doesn't have a Shopify ID and more

Details The https://pos-channel.shopifycloud.com/graphql-proxy/admin can be exploited to update a staff member email without any email confirmation. Using the partner dashboard, we've the ability to create a store that doesn't have a Shopify ID account on https://accounts.shopify.com. By using...

POS PHP 17.5 Cross Site Scripting

Document Title: =============== POS PHP v17.5 - Persistent Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2228 Release Date: ============= 2020-04-28 Vulnerability Laboratory ID VL-ID: ====================================...