EUVD-2021-21705

Malware in sbrugna...

The Hidden Threat: How Sensitive Information Leakage Puts Your Business at Risk

You Don't Know What You Don't Know – And That's the Problem Picture this: Your development team has built a robust e-commerce platform. Your security team has implemented comprehensive protection measures. Your compliance team has checked all the boxes. Yet somewhere in your application stack, fu...

Information disclosure

In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked screen mode due to a logic error in the code. This could lead to local information disclosure with no addition...

PT-2023-5280 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a logic error in the code of HostEmulationManager.java, specifically in the onHostEmulationData function. This error allows a general-purpose NFC reader to read the...

Hicos Citizen Certificate Client-side Component 缓冲区错误漏洞

Hicos Citizen Certificate Client-side Component is a citizen certificate client-side component. A security vulnerability exists in the Hicos Citizen Certificate Client-side Component that originates from insufficient validation of the length of the card number parameter and can be exploited by an...

CVE-2022-32960

HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for card number. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate...

Virtual credit cards coming to Chrome: What you need to know

When youre buying things online, reducing the exposure of payment details during transactions is one way to help reduce the risk of data theft. If you can hide this payment data and switch it out for something else entirely, even better. Google is proposing to do just that for customers in the US...

CVE-2021-35060

/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system...

CVE-2021-35060

/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system...

CVE-2021-35060

/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system...

PT-2021-20819

Name of the Vulnerable Software and Affected Versions: OpenWay WAY4 ACS versions prior to 1.2.278-2693 Description: The issue allows unauthenticated attackers to discover whether a specific payment card number is stored in the system by leveraging response differences. The "/way4acs/enroll"...

CVE-2021-35060: Generation of Error Message Containing Sensitive Information

/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system...

OpenWay Group WAY4 ACS 安全漏洞

OpenWay Group Way4 Acs is a digital payment solution from OpenWay Group Belgium. It is used for account management, digital wallets, card issuance, acquiring, interchange, e-commerce gateways and omni-channel digital banking. A security vulnerability exists in OpenWay Group WAY4 ACS prior to...

PT-2020-21174

Name of the Vulnerable Software and Affected Versions radic-util version 1.0.2 Description The issue concerns malicious code in the radic-util package that, when executed in a browser, can extract sensitive information such as password, cvc, and card number fields from forms. This information is...

PT-2020-20952

Name of the Vulnerable Software and Affected Versions ember-power-timepicker version 1.0.8 Description The issue concerns malicious code in the ember-power-timepicker package that, when executed in a browser, can extract sensitive information such as password, cvc, and card number fields from...

CVE-2018-17402

The PhonePe wallet aka com.PhonePe.app application 3.0.6 through 3.3.26 for Android might allow attackers to discover the Credit/Debit card number, expiration date, and CVV number. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide...

PT-2018-13126 · Ola Cabs · Ola Money

Name of the Vulnerable Software and Affected Versions: Ola Money aka com.olacabs.olamoney version 1.9.0 Description: An issue was discovered in the Ola Money application for Android. If an attacker controls an application with accessibility permissions, then the attacker can read certain Ola Mone...

Rimet Wifi Smart Temperature Control Android APP has an override access vulnerability

Rimet Wifi Smart Temperature Control Android APP is a management platform for smart hardware devices. Rimet Wifi Intelligent Temperature Control Android APP has an override access vulnerability. After logging into the client, the attacker can obtain sensitive information such as patient's name,...

Guizhou Provincial People's Hospital's Android App Has Override Access Vulnerability

Guizhou Provincial People's Hospital APP is a medical app for local people in Guizhou, making it easier and faster for people to see a doctor. Download Guizhou Provincial People's Hospital APP to utilize ID cards, visiting cards and other identification to get all the information about the visit,...

Hilton Hotels Fix CSRF Vulnerability That Exposed All Accounts

A cross-site request forgery CSRF vulnerability in the website of hotel chain Hilton Worldwide could have inadvertently compromised much of its users’ personal information. Ironically the since-fixed issue stemmed from a promotion the chain was offering to users if they changed their passwords on...