chromium-browser: ui spoofing in payments dialog

Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page...

Hunan Ding Ding Easily Builds App with Multiple Vulnerabilities

Hunan Ding Ding Easily Build APP is an order-taking tool for engineers. Hunan Ding Ding Easy Build APP has arbitrary user registration, payment flaws and arbitrary password reset vulnerability. Attackers can use the vulnerability to register any cell phone number, modify any user order informatio...

vc movie app has a payment logic design flaw

vc movie app is a movie information software on the phone. The vc movie app has a payment logic design vulnerability. Attackers use the vulnerability to bypass the payment verification mechanism to modify the payment amount...

Zomato: [www.zomato.com/dubai/gold] CRITICAL - Allowing arbitrary amount to become a GOLD Member

Hacker was able to find the internal testing Zomato Gold membership. I was able to purchase the PREMIUM GOLD MEMBERSHIP by selecting the amount of our own choice, here it required two conditions first is that you must have a valid premium membership. So, when I looked up the cost of the membershi...

Zomato: Restaurant payment information leakage

An endpoint was leaking banking information of restaurant owners: Bank Name, Account number etc. Thanks @nbsp for reporting this...

secure.onpay.ru Open Redirect vulnerability

Vulnerable URL: https://secure.onpay.ru/coupons/248aad1af7d346c8236e51bbfaa9b81a/savetoken?userurl=http://openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at 31.07.2017 Latest check for patch:| 31.07.2017 09:58 GMT Vulnerability type:| Open Redirect Vulnerability status:|...

Micro Market Vendor Warns of Bankcard And Biometric Data Breach

Avanti Markets, which specializes in self-serve food kiosks typically located in company breakrooms, said an undisclosed number of its 1.5 million customers may have had their personal and bankcard data compromised along with stored biometric data. The company, based in Tukwila, WA, said on July ...

Self-Service Food Kiosk Vendor Avanti Hacked

Avanti Markets, a company whose self-service payment kiosks sit beside shelves of snacks and drinks in thousands of corporate breakrooms across America, has suffered of breach of its internal networks in which hackers were able to push malicious software out to those payment devices, the company...

Snapchat: [spectacles.com] Bypassing quantity limit in orders

Hi Snapchat team, In the https://www.spectacles.com the quantity of orders has limited for spectacles is 6 and for accessories is 10 according to help support page. But it can easily be manipulated by editing the URL. Problem originates from limiting the quantity of the items is with just the UI...

secure.brophyprep.org XSS vulnerability

Vulnerable URL: https://secure.brophyprep.org/payment/dev/giving/index.php?appeal=1"...

BBCBuilder e-commerce system has design flaws

BBCbuilder is a new model of b2b2c e-commerce system built by Yuanfeng Company. BBCBuilder e-commerce system has a logical design vulnerability. An attacker can modify the number of products purchased after logging in and then modify the payment amount by grabbing packets...

Petya-esque ransomware is spreading across the world

UPDATE 6/29/2017 1045 PST: According to information uncovered within Malwarebytes Labs, we have determined that this ransomware variant is coded to erase a unique and randomly generated key that is used to encrypt the MFT Master File Table. The destruction of the Salsa20 key makes it very unlikel...

IRS Warns of Summertime Scams

The Internal Revenue Service IRS has released an alert warning of various types of scams targeting taxpayers this summer. The alert describes common features of these cyber crimes, including robocalls, demands for immediate payment, and threats to have taxpayers arrested immediately. Taxpayers an...

Web Hosting Company Pays $1 Million to Ransomware Hackers to Get Files Back

South Korean web hosting provider has agreed to pay $1 million in bitcoins to hackers after a Linux ransomware infected its 153 servers, encrypting 3,400 business websites and their data, hosted on them. According to a blog post published by NAYANA, the web hosting company, this unfortunate event...

FIN10: Anatomy of a Cyber Extortion Operation

FireEye has identified a set of financially motivated intrusion operations being carried out by a threat actor we have dubbed FIN10. FIN10 is known for compromising networks, stealing sensitive data, and directly engaging victim executives and board members in an attempt to extort them into payin...

HackerOne: Updating payout preference to CurrencyCloud doesn't notify user via email

When change payment method in user's payments, then a notification about Change payment method is sent to the user email. However, user not always gets a notification about change payment method - when change payment method via add payout method on Payout Methods, then such a notification is not...

Threat Outbreak Alert RuleID29474: Email Messages Distributing Malicious Software on June 13, 2017

Medium Alert ID: 54185 First Published: 2017 June 13 13:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29474 may contain the following files: Name | Siz...

Ctrip APP payment passwords suffer from a plaintext transmission vulnerability

Ctrip APP is a mobile client that provides users with mobile booking services for special hotels, discounted air tickets and train tickets. A plaintext transmission vulnerability exists in the payment password of Ctrip APP. Since the client does not encrypt the user's payment password, an attacke...

GameStop Online Shoppers Officially Warned of Breach

GameStop customers received breach notification warnings this week, cautioning them that their personal and financial information could have been compromised nine months ago. According to postal letters sent to customers, GameStop said an undisclosed number of online customers had their credit ca...

Threat Outbreak Alert RuleID29458: Email Messages Distributing Malicious Software on June 9, 2017

Medium Alert ID: 54166 First Published: 2017 June 9 15:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29458 may contain the following files: Name | Size...