WordPress SagePay Direct Payment Gateway Plugin <= 0.1.6.7 - Multiple XSS

Because of these vulnerabilities in pages/3DComplete.php, the attackers to inject arbitrary web script or HTML. Solution Update the plugin...

FBI, NYPD Form Financial Cybercrime Task Force

The FBI has formed a new cybercrime task force with the New York Police Department and the Metropolitan Transit Authority whose job will be to go after high-level financial cyber crimes, employing a model of interagency cooperation that the bureau and other federal law enforcement agencies have...

ecshop最新版本存储XSS至后台

简要描述： 存储XSS 直接打后台。对电商网站比较容易中 详细说明： 问题出现在用户充值页面，充值如果没有付款成功的话，后台查看充值记录位置调用的是act=check，此页面已经过滤 但是如果充值了并且完成付款，后台查看充值记录位置 变成act=edit 此页面没有过滤，所以导致问题发生。 user.php 1424行 / 变量初始化 / $surplus = array 'userid' = $userid, 'recid' = !empty$POST'recid' ? intval$POST'recid' : 0, 'processtype' =...

CUUMALL 注入 5-8

简要描述： 来了个新厂商。 挖一下把。 开放+封闭源代码 封闭源代码，普通用户使用加密后的代码，付费用户使用开放的源代码，使商城更安全 对于我这种屌丝只能用免费版 就是zend后的代码。 不过还是有几个文件没zend。 就只看这几个文件了。 详细说明： 第五处 kuaiqian/receivemall.php中 $dealTime=trim$REQUEST'dealTime'; //获取实际支付金额 ///单位为分 ///比方 2 ，代表0.02元 $payAmount=trim$REQUEST'payAmount'; //获取交易手续费 ///单位为分 ///比方 2 ，代表0.02元...

Threat Outbreak Alert RuleID10325: Email Messages Distributing Malicious Software on June 15, 2014

Medium Alert ID: 34620 First Published: 2014 June 16 17:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID10325 may contain the following files: Name | Siz...

Soraya Malware Packs Form Grabbing, Memory Scraping Functionality

Malware capable of infecting point-of-sale devices once was a novelty, but it’s quickly becoming more common. Researchers at Arbor Networks have unearthed a new strain of PoS malware called Soraya that can scrape memory and has the ability to intercept information sent from Web forms, a specialty...

Threat Outbreak Alert: Fake Payment Information Email Messages on May 29, 2014

Medium Alert ID: 34409 First Published: 2014 May 29 13:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product inquiry notification for the recipient. The text in the email message attempts to convince the recipient...

Threat Outbreak Alert: Fake Payment Details Email Messages on May 28, 2014

Medium Alert ID: 34404 First Published: 2014 May 29 13:13 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment details for the recipient. The email message attempts to convince the recipient to open the attachment and...

Threat Outbreak Alert: Fake Late Payment Notification Email Messages on May 28, 2014

Medium Alert ID: 34397 First Published: 2014 May 28 18:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a late payment notice for the recipient. The text in the email message attempts to convince the recipient to open...

Threat Outbreak Alert: Email Messages with Malicious Attachments on May 28, 2014

Medium Alert ID: 34390 First Published: 2014 May 28 16:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that contain an attachment relating to a purchase order payment for the recipient. The email message attempts to convince the recipient ...

Threat Outbreak Alert: Fake Invoice Payment Notice Email Messages on May 27, 2014

Medium Alert ID: 34355 First Published: 2014 May 27 13:33 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment slip notification for the recipient. The text in the email message attempts to convince the recipient to...

Threat Outbreak Alert: Fake Payment Confirmation Email Messages on May 22, 2014

Medium Alert ID: 34336 First Published: 2014 May 22 13:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment confirmation for the recipient. The text in the email message attempts to convince the recipient to open...

Chip and PIN EMV Protocol security vulnerabilities found

Chip-and-PIN payment cards are coming to the United States after a long head start as a standard card-present payment method in Europe and Asia. Already, retailer Target accelerated its plan to move its branded debit and credit cards to chip-and-PIN, also known as EMV Europay, MasterCard and Visa...

SA-CONTRIB-2014-056 - Commerce Moneris - Information Disclosure

Commerce Moneris is a payment module that integrates the Moneris payment system with Drupal Commerce. The module stores credit card data in a commerce order object unnecessarily for the purpose of passing the credit card information to the payment gateway. The credit card information is never...

Threat Outbreak Alert: Fake Financial Transaction Notification Email Messages on May 20, 2014

Medium Alert ID: 34308 First Published: 2014 May 20 18:35 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain an electronic payment invoice for the recipient. The text in the email message attempts to...

Threat Outbreak Alert: Fake Bank Account Payment Notification Email Messages on May 20, 2014

Medium Alert ID: 34301 First Published: 2014 May 20 16:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank payment invoice for the recipient. The text in the email message attempts to convince the recipient to open...

Book Review: Hacking Point of Sale, In-Depth Study on Payment Applications

Point-of-sale POS is the hottest topic in payment structures and its one of the most popular technology topics as well. A Point-of-sale POS machine is a computerized replacement for a cash register. It has ability to quickly process a customer's transaction, accurately keep the records, process...

Threat Outbreak Alert: Fake Bill Payment Processing Email Messages on May 19, 2014

Medium Alert ID: 34277 First Published: 2014 May 19 20:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a failed bill payment notice for the recipient. The text in the email message attempts to convince the recipient t...

PayPal Fixes Serious Account Hijacking Bug in Manager

PayPal patched a hole in its Manager portal this week that could have made it easy for an attacker to hijack an admin’s account, change their password and steal their personal information — not to mention their savings. Manager is a feature of the service that allows users to manage their Payflow...

SA-CONTRIB-2014-050 - Commerce Postfinance ePayment - Access Bypass

The Commerce Postfinance ePayment module provides commerce payment methods for the Postfinance e-Payment service provider. The module doesn't sufficiently validate incoming payment notification IPN messages. Sending a specifically crafted IPN message to an affected site allows an attacker to crea...