6189 matches found
CVE-2020-26810
SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerc...
CVE-2020-26810
CVE-2020-26810 affects SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905, 2005. An unauthenticated attacker can submit a crafted request to a specific SAP Commerce module URL that is processed with no further interaction, causing the SAP Commerce service to become unavailabl...
CVE-2020-26811
CVE-2020-26811 affects SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905, and 2005. The cited issue is a Server-Side Request Forgery (SSRF) where an unauthenticated attacker can submit a crafted request to a specific SAP Commerce module URL, which is processed without furthe...
WordPress Sites Open to Code Injection Attacks via Welcart e-Commerce Bug
A security vulnerability in the Welcart e-Commerce plugin opens up websites to code injection. This can lead to payment skimmers being installed, crashing of the site or information retrieval via SQL injection, researchers said. Welcart e-Commerce is a free WordPress plugin that has more than...
Why Paying to Delete Stolen Data is Bonkers
Companies hit by ransomware often face a dual threat: Even if they avoid paying the ransom and can restore things from scratch, about half the time the attackers also threaten to release sensitive stolen data unless the victim pays for a promise to have the data deleted. Leaving aside the notion...
CVE-2020-22273
Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...
Cross site request forgery (csrf)
Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...
CVE-2020-22273
Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...
CVE-2020-22273
The CVE-2020-22273 entry concerns Neoflex Video Subscription System Version 2.0, where a CSRF flaw enables unauthorized changes to Website Settings (e.g., Payment Settings). The root cause is CSRF allowing state-changing requests without proper user verification. Documents consistently identify t...
CVE-2020-15967
CVE-2020-15967 affects Chromium/Google Chrome prior to 86.0.4240.75, with a use-after-free in the payments component that could potentially lead to remote code execution and sandbox escape. Debian/FreeBSD/Arch Fedora advisories confirm the issue and provide a fixed version: 86.0.4240.75 (or newer...
payment.site123.me Cross Site Scripting vulnerability OBB-1478065
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Texas Gold-Dealer Mined for Payment Details in Months-Long Data Breach
A popular precious-metals dealer, JM Bullion, has been the victim of a payment-skimmer attack. The company’s response was less than solid gold — it took months to notify its users of the breach. The Dallas-based company sells gold, platinum, silver, copper and palladium bullion, in the form of...
File Upload Vulnerability in CRMEB Knowledge Payment System Backend
CRMEB based on ThinkPhp5.0 + Vue + EasyWeChat development of a CRMEB new retail mall system. A file upload vulnerability exists in the backend of CRMEB Knowledge Payment System, which can be exploited by attackers to gain control of the server...
CS Money: Attacker can generate cancelled transctions in a user's transaction history using only Steam ID
Summary: The API endpoint /create-payment requires only the steam ID of the account to create the payment. When this endpoint is called using the cardpay flow, it returns a transaction ID on the Cardpay system. The attacker can access this transaction, and immediately cancel it or pay it ; , whic...
Nando's Hackers Feast on Customer Accounts
Diners at a popular chicken-dinner chain have seen hundreds of dollars siphoned out of their bank accounts, after cybercriminals were able to access their restaurant ordering credentials. The issue though is that payment-card information is not stored within Nando’s accounts, leaving some questio...
CVE-2019-14719
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager...
CVE-2019-14713
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages...
CVE-2019-14713
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages...