CVE-2020-36128

CVE-2020-36128 affects Pax Technology PAXSTORE v7.0.8_20200511171508 and earlier. The vulnerability stems from token impersonation: each terminal uses an X-Terminal-Token to access the marketplace, and an attacker can intercept HTTPS requests to obtain the token assignment and craft a token to im...

Pax Technology PAXSTORE 安全漏洞

PAX Technology PAXSTORE is an application from China PAX PAX Inc. An ecosystem that connects 2.5 million endpoints, thousands of application developers and more than 180 marketplaces in more than 80 countries/regions around the world. A security vulnerability exists in Pax Technology PAXSTORE...

BTCPay Server Cross-Site Scripting Vulnerability (CNVD-2021-34111)

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A cross-site scripting vulnerability exists in BTCPay Server version 1.0.7.0 and prior versions, which stems from a weak method Next to generate pseudo-random values to generat...

Improper Privilege Management in monicahq/monica

✍️ Description Bypass payment verification and add more contact. From free account user can add only 10 contacts . but using this bug user can add more than 10 contacts for free 🕵️‍♂️ Proof of Concept 1. First goto https://app.monicahq.com/people from free account and add 10 contacts . Now you cant...

CVE-2021-24251

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status from pending to completed to...

Cross site request forgery (csrf)

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status from pending to completed ...

BTCPay Server Path Traversal Vulnerability

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A path traversal vulnerability exists in BTCPay Server version 1.0.7.0 and prior versions, which arises from a failure of a networked system or product to properly filter speci...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Business Directory Plugin versions...

CVE-2021-24251 Business Directory Plugin < 5.11.2 - Arbitrary Payment History Update

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status from pending to completed to...

cn.felord:payment-spring-boot-starter (>=1.0.0.RELEASE <=1.0.10.RELEASE), cn.hermesdi:api-crypto-spring-boot-starter (>=1.0.0 <=1.0.0.RELEASE) +150 more potentially affected by CVE-2020-28052 via org.bouncycastle:bcprov-jdk15to18 (>=1.65 <=1.66)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.65, =1.0.0.RELEASE, =1.0.0, =1.5.1, =2.0.0, =0.7.7, =0.7.7, =0.7.7, =0.7.7, =0.0.1, =0.0.1, =1.0.0, =5.23.1, =5.24.6 and more Source cves: CVE-2020-28052 Source advisory: OSV:GHSA-73XV-W5GP-FRXH...

BTCPay Server Information Disclosure Vulnerability

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. An information disclosure vulnerability exists in BTCPay Server versions prior to 1.0.6.0 that stems from a privacy vulnerability when using the payment button. No details of t...

City fined for tracking its citizens via their phones

The Dutch information watchdog—the Autoriteit Persoonsgegevens AP—has fined the city of Enschede for € 600,000 for tracking its citizens movements without permission. It is the first time that a Dutch government body has been fined by the AP. The investigation was set in motion after it received ...

Sea Cormorant Technology hospital food ordering applet has a flawed logic vulnerability

Guangzhou Hai Cormorant Network Technology Co., Ltd, referred to as: Hai Cormorant Technology, was founded on May 19, 2014, focusing on the healthcare industry, the main business includes the development and operation of intelligent mobile service platforms for WeChat Service Number, Alipay Life...

New QNAP NAS Flaws Exploited In Recent Ransomware Attacks - Patch It!

A new ransomware strain called "Qlocker" is targeting QNAP network attached storage NAS devices as part of an ongoing campaign and encrypting files in password-protected 7zip archives. First reports of the infections emerged on April 20, with the adversaries behind the operations demanding a...

Hackers threaten to leak stolen Apple blueprints if $50 million ransom isn't paid

Prominent Apple supplier Quanta on Wednesday said it suffered a ransomware attack from the REvil ransomware group, which is now demanding the iPhone maker pay a ransom of $50 million to prevent leaking sensitive files on the dark web. In a post shared on its deep web "Happy Blog" portal, the thre...

Information leakage vulnerability in KTO's fully intelligent parking video payment system

Xiamen Corto Communication Technology Co., Ltd Corto Parking is a professional intelligent parking value operator, providing intelligent parking services to customers. There is an information leakage vulnerability in Kerto's fully intelligent parking video charging system. Attackers can utilize t...

Unspecified Vulnerability in BTCPay Server

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A security vulnerability exists in BTCPay Server versions prior to 1.0.7.1, which stems from incorrectly handling policy settings that allow users to register. No details of th...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Financial Transaction Manager for Corporate Payment Services

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by Financial Transaction Manager for Corporate Payment Services. The applicable CVEs have been addressed. If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluate yo...

Insecure Transaction Verification

shopware/core does not perform secure transaction verification. An attacker is able to manipulate the order payment process...

GHSA-88RC-3P98-RGVX After order payment process manipulation in shopware/platform and shopware/core

Impact After order payment process manipulation Patches We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of...