Shopify: Payment gateway status transferred to Shopify without authentication

Note: This issue was originally reported to our self-hosted bug bounty program, and was transferred to HackerOne. One of the third-party payment gateways that can be used with Shopify did not offer a secure means of reporting transaction status to Shopify. As a result, it was possible for an...

CHARGE Anywhere Breached, Plain Text Data Accessed

CHARGE Anywhere, a New Jersey-based developer of payment gateway and mobile payment applications, on Tuesday disclosed that it had been breached and that hackers had access to transactions leaving its network, perhaps going back as far as 2009. Most of the traffic was encrypted, the company said ...

WooCommerce SagePay Direct Payment Gateway 0.1.6.6 - pages/3DComplete.php Multiple Parameter Reflected XSS

The sagepay-direct-for-woocommerce-payment-gateway WordPress plugin was affected by a pages/3DComplete.php Multiple Parameter Reflected XSS security vulnerability...

CVE-2014-4549

Multiple cross-site scripting XSS vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 MD or 2 PARes parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 MD or 2 PARes parameter...

CVE-2014-4549

Multiple cross-site scripting XSS vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 MD or 2 PARes parameter...

CVE-2014-4549

CVE-2014-4549 affects the WordPress plugin WooCommerce SagePay Direct Payment Gateway (pages/3DComplete.php) with XSS via the (1) MD and (2) PARes parameters. Root cause is reflected HTML/script injection in that PHP page, leading to arbitrary script execution if exploited. Public sources indicat...

AWBS 2.9.2 (cart.php) Blind SQL Injection Vulnerability

No description provided by source. AWBS 2.9.2 Blind SQL Injection 0day ============================================================================================= Dork....: inurl:/cart?ca=addother&oid= Date....: 01-16-2011 Author..: ShivX Contact.: shivanxatgmaildotcom Vendor..:...

SA-CONTRIB-2014-056 - Commerce Moneris - Information Disclosure

Commerce Moneris is a payment module that integrates the Moneris payment system with Drupal Commerce. The module stores credit card data in a commerce order object unnecessarily for the purpose of passing the credit card information to the payment gateway. The credit card information is never...

PayPal Fixes Serious Account Hijacking Bug in Manager

PayPal patched a hole in its Manager portal this week that could have made it easy for an attacker to hijack an admin’s account, change their password and steal their personal information — not to mention their savings. Manager is a feature of the service that allows users to manage their Payflow...

Santander BillPay Security Vulnerabilities Patched

Security weaknesses on the Santander Group BillPay website and mobile banking application have been addressed by the financial services organization’s developer Headland after they were exposed less than a week ago. U.K. consultant Paul Moore of Cresona Corp., reported a number of serious...

Swoopo Gold Shop CMS 8.4.56 Cross Site Scripting / SQL Injection

Title: ====== Swoopo Gold Shop CMS v8.4.56 - Multiple Web Vulnerabilities Date: ===== 2012-05-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=515 VL-ID: ===== 515 Common Vulnerability Scoring System: ==================================== 8.5 Introduction: ============...

Swoopo Gold Shop CMS v8.4.56 - Multiple Web Vulnerabilities

Exploit for php platform in category web applications Title: ====== Swoopo Gold Shop CMS v8.4.56 - Multiple Web Vulnerabilities Common Vulnerability Scoring System: ==================================== 8.5 Introduction: ============= Swoopo Gold is a shop content management system coded with PHP,...

WordPress WP e-Commerce plugin <= 3.8.6 SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress WP e-Commerce plugin = 3.8.6 SQL Injection Vulnerability Date: 2011-09-13 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/wp-e-commerce.3.8.6.zip Version: 3.8.6 tested...

CCAvenue payment gateway hacked !

CCAvenue.com is a Commerce Service Provider, authorized as a Master Merchant, by Indian financial institutions, to appoint Sub Merchants, to accept and validate Internet payments via Credit Card, and Net banking facilities from the end-customers in real-time. Its one of the leading payment gatewa...

AWBS 2.9.2 Blind SQL Injection

AWBS 2.9.2 Blind SQL Injection 0day ============================================================================================= Dork....: inurl:/cart?ca=addother&oid= Date....: 01-16-2011 Author..: ShivX Contact.: shivanxatgmaildotcom Vendor..: http://www.awbs.com Link....:...

AWBS 2.9.2 (cart.php) Blind SQL Injection Vulnerability

Exploit for php platform in category web applications AWBS 2.9.2 Blind SQL Injection 0day ============================================================================================= Dork....: inurl:/cart?ca=addother&oid= Date....: 01-16-2011 Author..: ShivX Contact.: shivanxatgmaildotcom...

AWBS 2.9.2 - 'cart.php' Blind SQL Injection

AWBS 2.9.2 Blind SQL Injection 0day ============================================================================================= Dork....: inurl:/cart?ca=addother&oid= Date....: 01-16-2011 Author..: ShivX Contact.: shivanxatgmaildotcom Vendor..: http://www.awbs.com Link....:...

AWBS 2.9.2 - cart.php Blind SQL Injection

AWBS 2.9.2 - cart.php Blind SQL Injection AWBS 2.9.2 Blind SQL Injection 0day ============================================================================================= Dork....: inurl:/cart?ca=addother&oid= Date....: 01-16-2011 Author..: ShivX Contact.: shivanxatgmaildotcom Vendor..:...

BPJewelry Store SQL Injection

----------------------------------------------------------------------------------------- BPJewelry Store SQL-i Vulnerability ----------------------------------------------------------------------------------------- 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /'...