NCR Aloha POS SOAP API Detection

Binary data ncralohaposwebdetect.nbin...

NCR Aloha POS SMB Default Credentials

The remote NCR Aloha POS device is running with default credentials aloha / aloha. A remote, unauthenticated attacker could exploit this to take control of the system. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid108716; scriptversion"1.2"; scriptcvsdate"Date:...

PCI DSS Compliance : Point-of-Sale (POS) Software

Due to increased risk to the cardholder data environment when a point-of-sale system is visible on the Internet, 1 confirm that this system needs to be visible on the Internet, that the system is implemented securely, and that original default passwords have been changed to complex passwords, or ...

New POS Malware PinkKite Takes Flight

A new family of point-of-sale malware, dubbed PinkKite, has been identified by researchers who say the malware is tiny in size, but can delivered a hefty blow to POS endpoints. Researchers at Kroll Cyber Security first identified PinkKite in 2017 during a nine-month investigation into a large POS...

POS Malware Found at 160 Applebee’s Restaurant Locations

Malware was discovered on point of sales systems at more than 160 Applebee’s restaurants, exposing credit card information from unknowing diners. RMH Franchise Holdings, which owns and operates more than 160 Applebee’s stores across the U.S., said that it recently discovered malware infecting its...

A week in security (February 5 – February 11)

Last week on Malwarebytes Labs, we featured a new Flash Player zero-day that has been found in recent targeted attacks. And we talked about a new trick to cripple browsers that came out of the hat of tech support scammers. We also covered several methods of stealing cryptocurrencies, including on...

February 9, 2018 – Morning Cyber Coffee Headlines – “Opening Ceremony” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! February 9, 2018 - Headlines Carbon Black in the News: 10 Questions Today’s CEO...

cardfellow.com XSS vulnerability

Open Bug Bounty ID: OBB-553502 Description| Value ---|--- Affected Website:| cardfellow.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Oracle MICROS POS Vulnerability Puts 300,000 Systems at Risk

Point-of-sale systems are rich targets for attackers, given their status as a gateway to credit card information, customer and back-office data and other goodies. A recently patched vulnerability in Oracle’s MICROS POS system software can lead to attackers gaining full access to the systems, say...

Critical Oracle Micros POS Flaw Affects Over 300,000 Payment Systems

Oracle has released a security patch update to address a critical remotely exploitable vulnerability that affects its MICROS point-of-sale POS business solutions for the hospitality industry. The fix has been released as part of Oracle's January 2018 update that patches a total of 238 security...

CVE-2018-2672

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: POS. Supported versions that are affected are 2.7, 2.8 and 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitalit...

CVE-2018-2672

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: POS. Supported versions that are affected are 2.7, 2.8 and 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitalit...

CVE-2018-2672

CVE-2018-2672 concerns Oracle Hospitality Simphony (POS) with affected versions 2.7–2.9. The vulnerability enables an unauthenticated attacker who can reach the system over HTTP to access data, per the NVD description. The CVSS3 base score is 7.5 (High) with high confidentiality impact and no int...

CVE-2018-2672

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: POS. Supported versions that are affected are 2.7, 2.8 and 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitalit...

CVE-2018-2673

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: POS. Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

UBUNTU-CVE-2018-5269

In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast...

Forever 21 Says PoS Systems Exposed Customer Data for 8 Months

Fashion retailer Forever 21 confirmed a breach made public in November resulted in the theft of credit card data belonging to an undisclosed number of customers. The company had stated that a lack of encryption used on some of its point-of-sales payment terminals could have resulted in unauthoriz...

Forever 21 Confirms Security Breach Exposed Customer Credit Card Details

First notified in November of a data breach incident, popular clothing retailer Forever 21 has now confirmed that hackers stole credit card information from its stores throughout the country for several months during 2017. Although the company did not yet specify the total number of its customers...

die-pos-experten.de XSS vulnerability

Open Bug Bounty ID: OBB-449950 Description| Value ---|--- Affected Website:| die-pos-experten.de Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

Forever 21 Warns Shoppers of Payment Card Breach at Some Stores

Another day, another data breach. This time a fast-fashion retailer has fallen victim to payment card breach. American clothes retailer Forever 21 announced on Tuesday that the company had suffered a security breach that allowed unknown hackers to gain unauthorized access to data from payment car...