Kimpton Hotels Investigating Payment Card Fraud

Kimpton Hotels & Restaurants, a nationwide chain of 62 boutique hotels, is investigating a string of unauthorized charges on payment cards used at a number of its locations. It’s unknown how many cards are involved, nor at which locations. A Kimpton representative told Threatpost that an...

Uber: Can add employee in business.uber.com without add payment method

Dear Uber, I found that modify html from https://business.uber.com/organization/org-id/employees can make I create employee without adding payment method. Step to reproduce: 1. Edit html, remove overlay alert. 2. Create employee in website. Or: Use post form: POST...

Amazon Same Day Credential Shipping

FireEye has identified a campaign involving phishing websites that appear as legitimate Amazon sites. Amazon is the largest online retailer and threat actors frequently target its customers. In this attack, a person browsing the internet would be directed to authentic looking – yet fake – Amazon...

Threat Outbreak Alert RuleID23863: Email Messages Distributing Malicious Software on July 16, 2016

Medium Alert ID: 47107 First Published: 2016 July 18 14:01 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23863 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID23832: Email Messages Distributing Malicious Software on July 14, 2016

Medium Alert ID: 47072 First Published: 2016 July 14 17:18 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23832 may contain the following files: Name | Siz...

CryptXXX Ransomware Updates Ransom Note, Payment Site

For the second time since June 1, the handlers of CryptXXX ransomware have changed their ransom note and Tor payment site. More importantly to those developing detection signatures and administrators, this update no longer makes changes to the file extensions of encrypted files. “To make it more...

Ktools Photostore 4.7.5 - Multiple Vulnerabilities

Ktools Photostore 4.7.5 - Multiple Vulnerabilities -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Ktools Photostore = 4.7.5 Multiple Vulnerabilities Bug discovered by Yakir Wizman Date 01/07/2016 Affected versions prior to 4.7.5 Vendor Homepage - http://www.ktools.net...

u.nysid.edu XSS vulnerability

Vulnerable URL: http://u.nysid.edu/payment/paywithentry.asp?amount=100.00=1%22--%3E%3Csvg/onload=;prompt/OPENBUGBOUNTY/;%3EApplication%20Fee Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alex...

Threat Outbreak Alert RuleID23635: Email Messages Distributing Malicious Software on June 30, 2016

Medium Alert ID: 46905 First Published: 2016 June 30 13:29 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23635 may contain the following files: Name | Siz...

WordPress Ultimate Membership Pro 3.3 Plugin - SQL Injection

Exploit for php platform in category web applications Vendor Homepage: http://wpindeed.com/ Software Link: http://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253 Version: 3.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Unauthenticated Blind SQLi, Unauthenticated Payment Bypass...

WordPress Plugin Ultimate Membership Pro 3.3 - SQL Injection

Vendor Homepage: http://wpindeed.com/ Software Link: http://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253 Version: 3.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Unauthenticated Blind SQLi, Unauthenticated Payment Bypass Time line: Found 07-Jun-2016, Vendor notified...

iBilling 3.7.0 Cross Site Scripting

Cross Site Scripting Stored: http://localhost/ibilling/index.php Parameters: msg, desc, account, phone, company, address, city, state, zip, tags, description, ref POST...

iBilling 3.7.0 - Persistent Cross-Site Scripting / Reflected Cross-Site Scripting

Exploit for php platform in category web applications iBilling v3.7.0 Multiple Stored and Reflected Cross Site Scripting Vulnerabilities Vendor: iBilling Product web page: http://www.ibilling.io/ Affected version: 3.7.0 Summary: The features you want, the simplicity you need! Beautifully designed...

jewishfairlawn.org XSS vulnerability

Vulnerable URL: http://www.jewishfairlawn.org/payment.php?notes=%3C/stYle/%3C/titLe/%3C/teXtarEa/%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 25.06.2016 Latest check for patch:| 25.06.2016 11:36 GMT Vulnerability type:| XSS Vulnerability...

bayt.ca XSS vulnerability

Vulnerable URL: http://www.bayt.ca/payment.php?notes=%3C/stYle/%3C/titLe/%3C/teXtarEa/%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2996612 VIP website status:...

bethelbinah.org XSS vulnerability

Vulnerable URL: http://www.bethelbinah.org/payment.php?notes=%3C/stYle/%3C/titLe/%3C/teXtarEa/%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20095482 VIP websit...

University of Calgary Pays $20,000 Following Ransomware Attack

Officials at the University of Calgary admitted this week that the school recently paid $20,000 CDN to rid its systems of ransomware that hampered productivity for 10 days. Linda Dalgetty, the school’s VP of Finance and Services, acknowledged via press release on Wednesday that the school paid th...

Philippines Bank hit by SWIFT Hacking Group allegedly linked to North Korea

SWIFT Bank Hackers have attacked another bank in the Philippines using the same modus operandi as that in the $81 Million Bangladesh Bank heist. Security researchers at Symantec have found evidence that malware used by the hacking group shares code similarities with the malware families used in...

Threat Outbreak Alert RuleID23029: Email Messages Distributing Malicious Software on May 21, 2016

Medium Alert ID: 46329 First Published: 2016 May 23 14:09 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23029 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID23009: Email Messages Distributing Malicious Software on May 20, 2016

Medium Alert ID: 46315 First Published: 2016 May 20 17:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23009 may contain the following files: Name | Size...