Threat Outbreak Alert RuleID15126: Email Messages Distributing Malicious Software on May 6, 2015

Medium Alert ID: 38722 First Published: 2015 May 7 14:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15126 may contain the following files: Name | Size ...

Sally Beauty Investigating Second Data Breach

Sally Beauty Supply, a seller of beauty products in the U.S., says it is investigating reports of fraudulent activities involving payment cards used at some of the chain’s retail locations. In March 2014, Sally Beauty admitted that hackers compromised its payment systems, exposing the sensitive...

Threat Outbreak Alert RuleID15020: Email Messages Distributing Malicious Software on May 11, 2015

Medium Alert ID: 38599 First Published: 2015 April 30 18:07 GMT Last Updated: 2015 May 13 12:49 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15020 may...

PayPal Inc Bug Bounty #114 - JDWP RCE Vulnerability

Document Title: =============== PayPal Inc Bug Bounty 114 - JDWP RCE Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1474 Video: http://www.vulnerability-lab.com/getcontent.php?id=1474 Release Date: ============= 2015-04-28 Vulnerability...

Shopify: Multiple issues on Checkout Process

Description While reviewing the Shopify POS application we found that the application was encrypting the CHD information, but it was leaving the amount outside of the payload and the post lacked any sort of HMAC signature preventing replay attacks. In addition, given the application does not...

Shopify: Payment gateway status transferred to Shopify without authentication

Note: This issue was originally reported to our self-hosted bug bounty program, and was transferred to HackerOne. One of the third-party payment gateways that can be used with Shopify did not offer a secure means of reporting transaction status to Shopify. As a result, it was possible for an...

Coinbase: iframes considered harmful

The Coinbase API offers an iframe payment option. iframes are attractive because they allow Coinbase's customers to give the illusion that the Bitcoin transaction is embedded entirely within the customer's website. But customers can and do refer to that iframe on insecure connections. Hijacking a...

Thousands of Hacked Uber Accounts Selling on Dark Web for $1

$US1 may be a very little amount, but it is enough to buy you a stolen Uber account and free car rides around the city. Two separate vendors on AlphaBay, a relatively new Dark Web marketplace launched in late 2014, are selling active Uber accounts with usernames and passwords for $1 each,...

Threat Outbreak Alert RuleID14277: Email Messages Distributing Malicious Software on March 26, 2015

Medium Alert ID: 38066 First Published: 2015 March 26 15:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14277 may contain the following files: Name | Si...

YXcms1.2.7 刷账户预存款余额

简要描述： YXcms1.2.7 刷账户预存款余额 详细说明： 问题存在于protested/apps/member/controller/shopcarController.php 只判断了数目不能为负，但没有判断价格不能为负。 访问链接http://127.0.0.1/YXcmsApp1.2.7/index.php?r=member/shopcar/caradd post: 'code' = int 1 'name' = int 1 'price' = float -100 'num' = int 1 就向购物车里塞了一个负数价格的商品。 生成订单然后支付，就可以刷余额了。...

SA-CONTRIB-2015-072 - Commerce Ogone - Access bypass

This module enables you to use Ogone Ingenico as a payment method for Drupal Commerce. Malicious users can trick Commerce Ogone into proceeding with the checkout process without actually going through the Ogone payment process, causing the order status to be set to checkout complete, even though ...

Threat Outbreak Alert RuleID13760: Email Messages Distributing Malicious Software on February 28, 2015

Medium Alert ID: 37679 First Published: 2015 March 2 14:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13760 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID13734: Email Messages Distributing Malicious Software on February 26, 2015

Medium Alert ID: 37604 First Published: 2015 February 26 18:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13734 may contain the following files: Name |...

Ransomware Looming As Major Long-Term Threat

On May 30, 2014, law enforcement officials from the FBI and Europol seized a series of servers that were being used to help operate the GameOver Zeus botnet, an especially pernicious and troublesome piece of malware. The authorities also began an international manhunt for a Russian man they said...

Threat Outbreak Alert RuleID13576: Email Messages Distributing Malicious Software on February 16, 2015

Medium Alert ID: 37479 First Published: 2015 February 16 13:28 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13576 may contain the following files: Name |...

Threat Outbreak Alert RuleID13563: Email Messages Distributing Malicious Software on February 13, 2015

Medium Alert ID: 37473 First Published: 2015 February 13 21:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13563 may contain the following files: Name |...

Mobile Vikings: Enum phone numbers thru /en/sims/topup/add/

Using request: POST /en/sims/topup/add/? HTTP/1.1 Host: mobilevikings.be User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:35.0 Gecko/20100101 Firefox/35.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3...

Emerging Payment Technologies and Due Diligence: A Warning about “Silver Bullets”

2015 will be an exciting year for the payments industry, especially for merchants that now have a number of new payment technologies at their disposal. Emerging payment technologies such as Point-to-Point-Encryption P2PE, Tokenization, EMV/Chip and Signature and Mobile Payment Acceptance are...

SA-CONTRIB-2015-034 - Commerce WeDeal - Open Redirect

Commerce WeDeal module enables you to do Commerce payments through the payment provider WeDeal. The module doesn't sufficiently check a query parameter used for page redirection, thereby leading to an Open Redirect vulnerability. CVE identifiers issued CVE-2015-3393 Versions affected Commerce...

Threat Outbreak Alert RuleID13387: Email Messages Distributing Malicious Software on February 3, 2015

Medium Alert ID: 37329 First Published: 2015 February 3 15:23 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13387 may contain the following files: Name |...