CVE-2019-3958

Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks via a crafted sales transaction...

CVE-2019-3958

Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks via a crafted sales transaction...

Cross site scripting

DISPUTED In Joget Workflow 6.0.20, CSV Injection, also known as Formula Injection, exists, as demonstrated by jw/web/userview/crmcommunity/crmuserviewsales//accountnew with the Account ID or Account Name field. NOTE: the vendor disputes the relevance of this finding because CSV is not the intende...

Amazon Prime Day is Now a Major Holiday, Driving up Traffic by More Than 14% in the U.S.

For the just-completed Amazon Prime Day a full 48 hours this year, published reports indicate that it was the largest shopping event in Amazon's history, exceeding their own 2018 sales for both Black Friday and Cyber Monday combined. And this year, there were more than 250 other retailers that...

Sahi Pro 8.x File Disclosure

File disclosure vulnerability in Sahi Pro href parameter Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

GrandNode File Disclosure

File disclosure vulnerability in GrandNode fileName parameter Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Smart TV and then exposed vulnerabilities--Supra Smart Cloud TV vulnerability can cause the device to be hijacking-vulnerability warning-the black bar safety net

An attacker can take advantage of a smart TV vulnerability, the attack connected to the home router to get remote access. Supra smart TV in a not patched the vulnerability so that the same Wi-Fi network, the attacker can hijack the TV device, play their own content, such as a fake emergency...

Say hello to Baldr, a new stealer on the market

By William Tsing, Vasilios Hioureas, and Jérôme Segura Over the past few months, we have noticed increased activity and development of new stealers. Unlike many banking Trojans that wait for the victim to log into their bank's website, stealers typically operate in grab-and-go mode. This means th...

Magento 2 SQL Injection

SQL Injection vulnerability in Magento 2 Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Imperva Wins CRN 5-Star Partner Program 3rd Year in a Row. Here are Some Stats Behind Why.

A lot goes into building a good IT channel program. A truly-effective program should meet the vendor’s needs while also delivering attractive benefits to our partners. A successful channel program should deliver a number of key elements, including: partner profitability partner self-service acces...

Rails File Disclosure

File disclosure vulnerability in Rails Action View Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Confluence File Disclosure

File disclosure vulnerability in Confluence widget connector macro Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Using Gmail "Dot Addresses" to Commit Fraud

In Gmail addresses, the dots don't matter. The account "[email protected]" maps to the exact same address as "[email protected]" and "[email protected]" -- and so on. Note: I own none of those addresses, if they are actually valid. This fact can be used to commit fraud:...

Care2x SQL Injection

SQL Injection vulnerability in Care2x ckconfig cookie Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Targeted Security Attacks Impact Holiday Shopping

Part 2 - Security In the first post, web performance was discussed, especially for the mobile visitor. While web performance is critically important, security is also a vital area of focus and investment because, threat actors don't take holidays. They're always out on the internet probing sites,...

Carriers Swore They'd Stop Selling Location Data. Will They Ever?

Months after Sprint, AT, T-Mobile, and Verizon promised to stop selling user location data, the practice continues...

Christmas Day was Quiet for Online Retailers But Picked Up Immediately on Boxing Day

Christmas Holiday Retail Sales In early November, eMarketer forecast that the 2018 U.S. online retail holiday sales would be $106 billion, a healthy increase of 16.6% over 2017. The Black Friday & Cyber Monday sales results confirmed that optimistic forecast with a combined total of nearly $14b i...

Spring MVC File Disclosure

File disclosure vulnerability in Spring MVC on Windows Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

How to Market an Online Store

By Carolina If you own an online store, then you, more than likely, already know how hard it can be at times to make those all-important sales. What with the sheer volume of different retailers dotted around the Internet in this day and age, it can be incredibly difficult to stand out. It is not...

Welcome, Brooke Motta!

By Ivan Novikov I am excited to announce a great addition to our Go-To-Market team. Brooke Motta has joined Wallarm as Vice President of Sales. Brooke brings 15 years of Cyber Security Sales Experience to the team. She has experience selling up and down the organization from an individual securit...