6152 matches found
CVE-2017-7992
Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...
CVE-2017-7992
Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI (cavv parameter). Root cause: unsanitized input echoed in the response, enabling injection of arbitrary scripts. Impact per provi...
MasterCard launches Credit Card with Built-In Fingerprint Scanner
MasterCard has unveiled its brand new payment card that has a built-in biometric fingerprint scanner, allowing customers to authorize payments with their fingerprint, without requiring a PIN code or a signature. The company is already testing the new biometric payment cards, combined with the...
Threat Outbreak Alert RuleID28821: Email Messages Distributing Malicious Software on April 20, 2017
Medium Alert ID: 53521 First Published: 2017 April 20 17:27 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28821 may contain the following files: Name | Si...
Hackers Steal Payment Card Data From Over 1,150 InterContinental Hotels
InterContinental Hotels Group IHG is notifying its customers that credit card numbers and other sensitive information may have been stolen after it found malware on payment card systems at 1,174 franchise hotels in the United States. It's the second data breach that U.K.-based IHG, which owns...
InterContinental Hotel Chain Breach Expands
In December 2016, KrebsOnSecurity broke the news that fraud experts at various banks were seeing a pattern suggesting a widespread credit card breach across some 5,000 hotels worldwide owned by InterContinental Hotels Group IHG. In February, IHG acknowledged a breach but said it appeared to invol...
Oracle PeopleSoft Enterprise SCM eBill Payment Remote Vulnerability
Oracle PeopleSoft Products is a set of enterprise human capital management solutions from Oracle, which provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise SCM eBill Payment is one of the electronic billing display solution...
IHG Confirms Second Credit Card Breach Impacting 1,000-Plus Hotels
In what’s becoming a familiar refrain to guests, InterContinental Hotels Group, said late last week that payment card systems at more than 1,000 of its hotels had been breached. It’s the second breach that IHG, a multinational hotel conglomerate that counts Holiday Inn and Crowne Plaza among its...
ShadowBrokers' Windows Zero-Days Already Patched
Hours after what was thought to be a damaging release of NSA hacking tools for Windows systems, Microsoft quelled some anxiety with a late-night statement on Friday that most of the vulnerabilities disclosed by the ShadowBrokers had already been patched. The biggest surprise was that the most...
Word Directory Script 2.1 Cross Site Scripting / SQL Injection Vulnerabilities
Exploit for php platform in category web applications Title: Word Directory Script v 2.1 - Cross Site Scripting / SQL Injection Credit: Bilal KARDADOU Vendor: http://www.phponly.com/ Vendor URL: http://www.phponly.com/words.html Product: Word Directory Script v 2.1 Google Dork: N/A Product &...
live.bibiclub.net XSS vulnerability
Vulnerable URL: http://live.bibiclub.net/payment.php?id=1...
Word Directory Script 2.1 Cross Site Scripting / SQL Injection
Title: Word Directory Script v 2.1 - Cross Site Scripting / SQL Injection Credit: Bilal KARDADOU Vendor: http://www.phponly.com/ Vendor URL: http://www.phponly.com/words.html Product: Word Directory Script v 2.1 Google Dork: N/A Product & Service Introduction: "Word Directory Script" The big...
New Relic: Manipulation of submit payment request allows me to obtain Infrastructure Pro/Other Services for free or at greatly reduced price
@jonbottarini discovered an issue with our purchase process validation. This allowed subscription purchases to complete, even when they did not equal the intended price for the service provided. I wanted to test the New Relic pro features. I didn't want to pay full price I hacked the payment page...
Gratipay: CSV injection in gratipay.com via payment history export feature.
I discovered this issues thanks to Matt who pointed out that the participant's name is directly placed into a CSV file: https://github.com/gratipay/gratipay.com/issues/4399issuecomment-292250609 Summary --- Gratipay allows users to export payment history as a .csv file. By injecting a payload int...
Harvest: Client can redirect payment, causing payment discrepancy between Harvest and PayPal
Vulnerability details When a client views an invoice through the web interface, it'll show a "Pay with PayPal" button when a standard PayPal integration has been enabled. Clicking this button will submit a POST request to PayPal. This request contains a business parameter, which is the receiver o...
We asked 170 cyber security pros about ransomware. Here’s what they had to say.
The first week of January, my daughter called to say she couldn’t get into her college website to make changes to her spring schedule. Assuming servers were probably struggling to keep up with increased traffic, I told her to keep trying. However, it soon became apparent what the issue was. An...
Uber: deleting payment profile during active trip puts account into arrears but active trip is temporarily “free”
Deleting a payment profile for an account that is actively taking a trip results in the trip not being charged, but moves the user's account into arrears and when a payment profile is added back, the account is charged the unpaid amount...
Membership Pro and other OS Solution extensions
Os Solution products have fixed an issue in the Paypal payment gateway in five of their extensions and made new releases to fix it:- 1. Events Booking version 2.14.2 https://www.joomdonation.com/forum/events-booking-general-discussion/57320-events-booking-version-2-14-2-released.html 2...
Tax-themed phishing and malware attacks proliferate during the tax filing season
Tax-themed scams and social engineering attacks are as certain as death or tax itself. Every year we see these attacks, and 2017 is no different. These attacks circulate year-round as cybercriminals take advantage of the different country and region tax schedules, but they peak in the months...