CVE-2021-29249

BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability...

Design/Logic Flaw

BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability...

CVE-2021-29249

BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability...

CVE-2021-29249

CVE-2021-29249 affects BTCPay Server prior to 1.0.6.0, with a privacy-oriented information disclosure when the payment button is used. The issue impacts confidentiality (partial) per NVD, with CVSS scores of 5.0 (2.0) and 7.5 (3.1) depending on metrics. A fix is available in version 1.0.6.0; upgr...

BTCPay Server 安全漏洞

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. An information disclosure vulnerability exists in BTCPay Server versions prior to 1.0.6.0 that stems from a privacy vulnerability when using the payment button. No details of t...

SQL Injection Vulnerability in the Campus Payment Platform of Beijing Dike Yuanwang Technology Co.

The Campus Payment Platform is developed by Beijing DIKE Farsighted Technology Co., Ltd. to solve various problems in payment of fees in colleges and universities, to reduce the workload of school financial managers, and to facilitate all kinds of fee-paying personnel both inside and outside the...

CVE-2021-28110

/exec in TranzWare e-Commerce Payment Gateway TWEC PG before 3.1.27.5 had a vulnerability in its XML parser...

CVE-2021-28110

/exec in TranzWare e-Commerce Payment Gateway TWEC PG before 3.1.27.5 had a vulnerability in its XML parser...

Code injection

/exec in TranzWare e-Commerce Payment Gateway TWEC PG before 3.1.27.5 had a vulnerability in its XML parser...

CVE-2021-28126

The CVE-2021-28126 entry concerns TranzWare e-Commerce Payment Gateway (TWEC PG) prior to version 3.1.27.5, where index.jsp contains a stored XSS vulnerability. This is documented across multiple connected records (Red Hat, NVD, CVE lists, and regional advisories) and is specific to the TWEC PG’s...

CVE-2021-28110

CVE-2021-28110 affects TranzWare e-Commerce Payment Gateway (TWEC PG) prior to version 3.1.27.5, due to a vulnerability in its XML parser. The issue is described without exploitation details in the provided sources, with CVSSv3.1 base score 7.5 (Network attack, no privileges required, high availa...

CVE-2021-28110

/exec in TranzWare e-Commerce Payment Gateway TWEC PG before 3.1.27.5 had a vulnerability in its XML parser...

Compass Plus e-Commerce Payment Gateway 代码问题漏洞

Compass Plus e-Commerce Payment Gateway is an application interface of the Russian company Compass Plus. It provides an API interface for payment functions. A security vulnerability exists in TranzWare e-Commerce Payment Gateway before 3.1.27.5, which is caused by a vulnerability in the XML parse...

Royal Mail scam says your parcel is waiting for delivery

Expecting a delivery? Watch out for phishing attempts warning of held packages and bogus shipping fees. This Royal Mail delivery scam begins with a text message out of the blue, claiming: Your Royal Mail parcel is waiting for delivery. Please confirm the settlement amount of 2.99 GBP via:...

WeLeakInfo Leaked Customer Payment Info

A little over a year ago, the FBI and law enforcement partners overseas seized WeLeakInfo.com, a wildly popular service that sold access to more than 12 billion usernames and passwords stolen from thousands of hacked websites. In an ironic turn of events, a lapsed domain registration tied to...

Molson Coors Cracks Open a Cyberattack Investigation

Another high-profile company has been hit with a cyber attack that’s causing a major disruption to its business. Brewing company Molson Coors acknowledged on Thursday that it has “experienced a systems outage that was caused by a cybersecurity incident,” according to a Form 8-K filed with the SEC...

Samsung Pay mini information disclosure vulnerability (CNVD-2021-30505)

Samsung Pay mini is a mobile application from Samsung South Korea. It provides a mobile payment function. The Samsung Pay mini application prior to v4.0.14 suffers from an information disclosure vulnerability that allows access to contact information via the lock screen under certain circumstance...

REvil ransomware’s calling, and it’s not good news

The REvil ransomware AKA Sodinokibi, which operates as a Ransomware as a Service is adopting some outreach techniques after initial compromise, designed to shame victims into paying up. Shaming victims into action Malware authors and social engineers have relied on shame and the threat of exposur...

Stripe: Verifying email bypass

A vulnerability was discovered in Stripe's Connect API that allowed an attacker to create an account without verifying the email address. This allowed the attacker to impersonate a real company and generate invoices and payments on their behalf. The invoices appeared valid as they were sent by...

SAP Payment Engine Elevation of Privilege Vulnerability

SAP Payment Engine is a software application from SAP. It provides a simplified end-to-end payment processing on a centralized platform. A security vulnerability exists in SAP Payment Engine version 500, which can be exploited by an attacker to perform the necessary authorization checks, resultin...