Bitcoin / AltCoin Payment Gateway <= 1.7.1 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users Setup: 1. Install woocommerce dependency, no setup required 2. Install the vulnerable plugin woo-altcoin-payment-gateway version 1.7.1 3. ...

Bitcoin / AltCoin Payment Gateway <= 1.7.1 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users PoC Setup: 1. Install woocommerce dependency, no setup required 2. Install the vulnerable plugin woo-altcoin-payment-gateway version 1.7.1...

CVE-2023-26980

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher wil...

CVE-2023-26980

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher wil...

Race condition

DISPUTED PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home...

PT-2023-20886 · Pax Technology · Pax A920 Pro Paydroid

Name of the Vulnerable Software and Affected Versions: PAX Technology PAX A920 Pro PayDroid version 8.1 Description: The issue allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. It is a Race Condition vulnerability. The vendor...

WordPress Paytm Payment Donation Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Paytm Payment Donation Type Plugin Vulnerable versions = 2.2.0 Fixed in 2.2.1 OWASP Top 10 A8: Cross Site Request Forgery CSRF Classification Cross Site Request Forgery CSRF CVE CVE-2023-28535 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 0cde2dab29f5 Credits...

PAX Technology PAX A920 Pro PayDroid 竞争条件问题漏洞

PAX Technology PAX A920 Pro PayDroid is an Android payment terminal with a large HD screen, high-quality camera and scanner, and a high-speed printer from PAX Global PAX Technology, China. PAX Technology PAX A920 Pro PayDroid version 8.1 suffers from a Competitive Condition Issue vulnerability th...

CVE-2023-26980

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher wil...

CVE-2023-26980

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher wil...

Overview of Google Play threats sold on the dark web

In 2022, Kaspersky security solutions detected 1,661,743 malware or unwanted software installers, targeting mobile users. Although the most common way of distributing such installers is through third-party websites and dubious app stores, their authors every now and then manage to upload them to...

send-payment.com Cross Site Scripting vulnerability OBB-3233527

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

OpenAI Reveals Redis Bug Behind ChatGPT User Data Exposure Incident

OpenAI on Friday disclosed that a bug in the Redis open source library was responsible for the exposure of other users' personal information and chat titles in the upstart's ChatGPT service earlier this week. The glitch, which came to light on March 20, 2023, enabled certain users to view brief...

ChatGPT Bug Exposed Payment Details of Paid Users

By Habiba Rashid OpenAI has apologized and reached out to affected users about the potential data breach. This is a post from HackRead.com Read the original post: ChatGPT Bug Exposed Payment Details of Paid Users...

Ferrari Discloses Ransomware Attack; Refuses to Pay Ransom

By Habiba Rashid Ferrari, the renowned Italian luxury car manufacturer, suffered a cyber incident that compromised the companys client data. According… This is a post from HackRead.com Read the original post: Ferrari Discloses Ransomware Attack; Refuses to Pay Ransom...

A look at a Magecart skimmer using the Hunter obfuscator

Threat actors are notorious for trying to hide their code in various ways, from binary packers to obfuscators. On their own, these tools are not always malicious as they can also be be used by companies or individuals who wish to keep their work safe from piracy, but overall they tend to be large...

WordPress Bangladeshi Payment Gateways Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Bangladeshi Payment Gateways Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID db46a03412a9 Credits István...

CVE-2021-36821

Summary of CVE-2021-36821 – WordPress Forminator stored XSS : The vulnerability affects the Forminator plugin for WordPress, with versions up to and including 1.14.11. The underlying issue is improper neutralization of input during web page generation, resulting in stored Cross-Site Scripting (XS...

payment-technology.com Cross Site Scripting vulnerability OBB-3222137

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-47422 WordPress WordPress Stripe Donation and Payment Plugin Plugin <= 3.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in HM Plugin Accept Stripe Donation – AidWP plugin = 3.1.5 versions...