Unsafe Dependency Resolution

Overview com.paypal.digraph:digraph-parser is a Java parser for digraph DSL Graphviz DOT language. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a...

ZRECore 1.3.1 Database Configuration Disclosure

Exploit Title : ZRECore 1.3.1 Database Config Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : zend.com Software Download Link : github.com/zrecore/ZRECore/archive/master.zip Software Information Link :...

Paypal Inc - Broken Authorization & CSRF Vulnerability

Document Title: =============== Paypal Inc - Broken Authorization & CSRF Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2181 Video: https://www.youtube.com/watch?v=52meFKU2Lqg Release Date: ============= 2019-02-08 Vulnerability Laboratory ID VL-ID:...

Paypal Inc - Broken Authorization & CSRF Vulnerability

Document Title: =============== Paypal Inc - Broken Authorization & CSRF Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2181 Video: https://www.youtube.com/watch?v=52meFKU2Lqg Release Date: ============= 2019-02-08 Vulnerability Laboratory ID VL-ID:...

PayPal Inc BB - Arbitrary File Upload Vulnerability

Document Title: =============== PayPal Inc BB - Arbitrary File Upload Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2180 Video: https://www.youtube.com/watch?v=kcnJMKXnW1k Release Date: ============= 2019-02-01 Vulnerability Laboratory ID VL-ID:...

PayPal Inc BB - Arbitrary File Upload Vulnerability

Document Title: =============== PayPal Inc BB - Arbitrary File Upload Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2180 Video: https://www.youtube.com/watch?v=kcnJMKXnW1k Release Date: ============= 2019-02-01 Vulnerability Laboratory ID VL-ID:...

PayPal: Stored XSS on https://paypal.com/signin via cache poisoning

Due to a configuration in frontend, caching servers, it was possible for a researcher to use request smuggling to convert a page request into a cached redirect. If the cached redirect were accessed by a legitimate user, an attacker's content would be rendered instead of the requested page. While...

New ransomware steals PayPal data with phishing link in ransom note

By Uzair Amir Ransomware is a reality and threat actors are using it quite avidly and frequently nowadays in order to make easy money. According to the new findings of MalwareHunterTeam, there is in-development ransomware that can encrypt your files, steal credit card information and steal PayPal...

Man In The Middle (MitM) Attacks Are Possible With Spoofed SSL Servers

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

Yet Another Bypass: Is 2FA Broken? Authentication Experts Weigh In

A penetration testing tool published by Polish security researcher Piotr Duszyński can bypass login protections for accounts protected by two-factor authentication 2FA. In his write-up on the tool, which is dubbed Modlishka, meaning “mantis” in English, he asked, “is 2FA broken?” It’s a question...

Fedora 28 : webkit2gtk3 (2018-118b9abf99)

This update addresses the following vulnerabilities : - CVE-2018-4190, CVE-2018-4199, CVE-2018-4218, CVE-2018-4222, CVE-2018-4232, CVE-2018-4233, CVE-2018-4246, CVE-2018-11646. Additional fixes : - Fix installation directory of API documentation. - Disable Gigacage if mmap fails to allocate in...

Happy 9th Birthday, KrebsOnSecurity!

Hard to believe we've gone another revolution around the Sun: Today marks the 9th anniversary of KrebsOnSecurity.com! This past year featured some 150 blog posts, but as usual the biggest contribution to this site came from the amazing community of readers here who have generously contributed the...

Android Trojan Targets PayPal Users

Want to download an Android battery utility app from a third-party Android app store? What could possibly go wrong? Last month researchers downloaded a power management app called “Optimization Android” from an undisclosed third-party app store. What they found was instead of optimizing the phone...

Nasty Android malware found stealing its victims’ PayPal funds

By Waqas Another day, another Android malware - This time, according to the latest findings of ESET's IT security researchers, there is a new malware in Google Play Store that hijacks PayPal account to steal money - Researchers assessed that the malware is specifically targeting Android users and...

WordPress Simple-E-Commerce-Shopping-Cart 2.2.5 Database Disclosure

Exploit Title : WordPress Simple-E-Commerce-Shopping-Cart Plugins 2.2.5 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 08/12/2018 Vendor Homepage : wordpress.org/plugins/simple-e-commerce-shopping-cart/ Owner of the Script : Niaz Showke...

WordPress Events Made Easy 2.0.68 Database Disclosure

Exploit Title : WordPress Events Made Easy Plugins 2.0.68 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 06/12/2018 Vendor Homepage : wordpress.org/plugins/events-made-easy/ Software Download Link :...

PayPal: Unsafe deserialization leads to token leakage in PayPal & PayPal for Business [Android]

A Bug Bounty researcher identified an issue where a JSON wrapper could be used to instantiate arbitrary Java objects. This could lead to circumstances where a class called in the PayPal Android app could be read by a malicious app on the same mobile device. A specific user’s session data could...

PayPal / Credit Card / Debit Card Payment 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: PayPal/Credit Card/Debit Card Payment 1.0 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

PayPal/Credit Card/Debit Card Payment 1.0 SQL Injection

Exploit Title: PayPal/Credit Card/Debit Card Payment 1.0 - SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/tubigangarden.zip Version...

PayPal-Credit Card-Debit Card Payment 1.0 - SQL Injection

Exploit Title: PayPal/Credit Card/Debit Card Payment 1.0 - SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/tubigangarden.zip Version...