SA-CONTRIB-2012-112 - Ubercart SecureTrading - Failure to follow guideline/specification

The Ubercart SecureTrading Payment Method module provides an Ubercart payment method for the SecureTrading.com gateway. The module's payment method did not properly verify the validity of payment notification information. A malicious user could trick a site into thinking that an item has been pai...

Claims Of Attack On Visa, Mastercard Fizzle

One day after a hacker using the handle “Reckz0r” claims to have infiltrated 79 different banks and leaked information allegedly belonging to Visa and MasterCard customers, there are questions about whether a hack actually occurred. According to a post yesterday on Pastebin, the hacker Reckz0r...

Swoopo Gold Shop CMS 8.4.56 Cross Site Scripting / SQL Injection

Title: ====== Swoopo Gold Shop CMS v8.4.56 - Multiple Web Vulnerabilities Date: ===== 2012-05-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=515 VL-ID: ===== 515 Common Vulnerability Scoring System: ==================================== 8.5 Introduction: ============...

Threat Outbreak Alert: Fake Payment Receipt Email Messages on June 6, 2012

Low Alert ID: 26090 First Published: 2012 June 6 15:39 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam e-mail messages that claim to contain a payment receipt for the recipient. The text in the e-mail message attempts to convince the...

Study: Password Security Improves with Age

Baby Boomers may not be perceived as tech savvy as Millenials, but they apparently are better at protecting their digital assets. A new British study believed to be the largest of its kind shows those 55 and older tend to pick passwords with twice the strength of those under 25. It also indicates...

P2P Encryption Program now available from PCI Council

The PCI council has updated the Point-to-Point encryption P2PE program requirements PDF. The update impacts merchants, payment applications, point of sale vendors and service providers. As a participating organization of the PCI P2PE task force, providing input into the standard, I wanted to...

New P2P Zeus Variant Targets Popular Sites with Bogus Offers

Facebook, Gmail, Yahoo and Hotmail users should beware of rogue rebate offers and new secure payment options aimed at getting them to part with their debit card information. Earlier this week Amit Klein, CTO of Trusteer, announced the discovery of a peer-to-peer variant of the Zeus platform that...

Threat Outbreak Alert: Fake Payment Proof Details Email Messages on May 11, 2012

Low Alert ID: 25907 First Published: 2012 May 14 14:48 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam e-mail messages that claim to contain proof of payment for the recipient. The text in the e-mail message attempts to convince the...

Swoopo Gold Shop CMS v8.4.56 - Multiple Web Vulnerabilities

Exploit for php platform in category web applications Title: ====== Swoopo Gold Shop CMS v8.4.56 - Multiple Web Vulnerabilities Common Vulnerability Scoring System: ==================================== 8.5 Introduction: ============= Swoopo Gold is a shop content management system coded with PHP,...

Travelon Express CMS 6.2.2 XSS / Shell Upload / SQL Injection

Title: ====== Travelon Express CMS v6.2.2 - Multiple Web Vulnerabilities Date: ===== 2012-05-10 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=530 VL-ID: ===== 530 Common Vulnerability Scoring System: ==================================== 8.1 Introduction: =============...

FBI Concerned About Bitcoin Usage Among Cybercriminals

The Federal Bureau of Investigation has become increasingly concerned over the usage of the mostly-anonymous payment network Bitcoin by hackers and cybercriminals, according to an unclassified report obtained by Wired this week. The report, “Bitcoin Virtual Currency: Unique Features Present...

CVE-2008-7310

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

Security feature bypass

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

CVE-2008-7310

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

CVE-2008-7310: Undefined Security Weakness

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

PT-2012-1266

Name of the Vulnerable Software and Affected Versions Spree version 0.2.0 Description The issue allows remote attackers to bypass the intended payment step by modifying a URL, related to a mass assignment vulnerability. This occurs because the software does not properly restrict the use of a hash...

50K Cards Compromised using Credit Card Processor

50K Cards Compromised using Credit Card Processor Some 50,000 credit and debit cardholders may have their information exposed following a security breach at Global Payments. The breach occurred sometime between between Jan. 21, 2012 and Feb. 25, 2012. Both Visa and MasterCard have confirmed they...

Visa, MasterCard Warn Of Breach At Card Processor

UPDATE–MasterCard and Visa have confirmed that they are investigating a potentially huge data breach at one of the companies’ payment processors, which the Wall Street Journal has identified as Global Payments Inc. The credit card giants are alerting banks about a breach at a U.S. based card...

Fortune Favors the Bold? Man Steals Microsoft Founder's Identity, Credit Card

When one Pennsylvanian man couldn’t foot his bills, he opted to steal the identity of someone that could – one of the world’s richest men, Microsoft co-founder and billionaire Paul Allen. An AWOL solider from Pittsburgh swiped Allen’s Citibank credit card account information earlier this year to...

Iciniti Store - SQL Injection

Sense of Security - Security Advisory - SOS-12-003 Release Date. 06-Mar-2012 Last Update. - Vendor Notification Date. 28-Jul-2011 Product. Iciniti Store Platform. Windows Affected versions. 4.3.3683.31484 verified, and possibly others Severity Rating. High Impact. Manipulation of data Attack...