Hackers Stole Customers' Payment Card Details From Over 700 Wawa Stores

Have you stopped at any Wawa convenience store and used your payment card to buy gas or snacks in the last nine months? If yes, your credit and debit card details may have been stolen by cybercriminals. Wawa, the Philadelphia-based gas and convenience store chain, disclosed a data breach incident...

Hackers Stole Customers' Payment Card Details From Over 700 Wawa Stores

Have you stopped at any Wawa convenience store and used your payment card to buy gas or snacks in the last nine months? If yes, your credit and debit card details may have been stolen by cybercriminals. Wawa, the Philadelphia-based gas and convenience store chain, disclosed a data breach incident...

Payment Logic Vulnerability in Cloud Industry CMS ca***.php File

Yunye CMS is an enterprise website building system developed by Luoyang Yunye Information Technology Co. Payment logic vulnerability exists in the CMS ca.php file. Attackers can use this vulnerability to arbitrarily modify the size of the payment amount...

Logic flaws exist in the website building system of China Enterprise Dynamics Technology Co.

Based on PaaS+SaaS service model, CEC Technology Co., Ltd. integrates Portal Cloud, Business Cloud, Marketing Cloud, Management Cloud and Design Cloud into one-stop Internet intelligent operation services and industry solutions to meet the personalized and diversified Internet transformation need...

A week in security (December 9 – 15)

Last week on Malwarebytes Labs, we cautioned readers against purchasing potentially privacy-invasive, cyber-insecure smart doorbells, warned about a new credit card skimmer vulnerability embedded within hundreds of fraudulent web sites selling supposedly name-brand shoes, and looked at the newest...

Ransomware response—to pay or not to pay?

The increased connectivity of computers and the growth of Bring Your Own Device BYOD in most organizations is making the distribution of malicious software malware easier. Unlike other types of malicious programs that may usually go undetected for a longer period, a ransomware attack is usually...

SQL Injection Vulnerability in Jinwei Intelligent Food Order Payment Management System

Jinwei Smart Order Payment Management System is a free restaurant management software. It is suitable for all kinds of large and small restaurants, as well as fast food, Chinese food, western food, hot pot restaurant and other kinds of catering business. SQL injection vulnerability exists in Jinw...

File Upload Vulnerability in Golden Flavor Smart Order Payment Management System

Golden Taste Intelligent Ordering System is an electronic ordering system that integrates traditional menu and wireless ordering informationization. A file upload vulnerability exists in the Golden Taste Intelligent Ordering and Payment Management System, which can be exploited by attackers to...

5iSNS Content Payment System 1.0.9 suffers from XSS vulnerability

The 5iSNS content payment system integrates functional modules such as post articles and documents with social features. An XSS vulnerability exists in 5iSNS Paid-for-Content System 1.0.9, which can be exploited by an attacker to obtain administrator cookie information and log into the backend of...

DEBIAN-CVE-2019-13763

Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page...

Download: The 2020 Cybersecurity Salary Survey Results

The 2020 Cybersecurity Salary Survey was an online survey published in The Hacker News and created to provide insight into the details related to cybersecurity compensation. There were over 1,500 security professionals who completed the survey. Today you can access the aggregated and analyzed 202...

Decentralized Anonymous Payment System Data Forgery Issue Vulnerability

Decentralized Anonymous Payment System DAPS is a decentralized anonymous payment system. A Data Forgery Issue vulnerability exists in DAPS 2019-08-26 and prior versions, which stems from the program's use of a weak signature mechanism that can be exploited by an attacker to reuse signatures...

Decentralized Anonymous Payment System Cross-Site Request Forgery Vulnerability

Decentralized Anonymous Payment System DAPS is a decentralized anonymous payment system. A cross-site request forgery vulnerability exists in DAPS 2019-08-26 and prior versions that can be exploited by an attacker to obtain information...

CVE-2019-16752

An issue was discovered in Decentralized Anonymous Payment System DAPS through 2019-08-26. It is possible to force wallets to send HTTP requests to arbitrary locations, both on the local network and on the internet. This is a serious threat to user privacy, since it can possibly leak their IP...

CVE-2019-16753

An issue was discovered in Decentralized Anonymous Payment System DAPS through 2019-08-26. The content to be signed is composed of a representation of strings, rather than being composed of their binary representations. This is a weak signature scheme design that would allow the reuse of signatur...

CVE-2019-16753

An issue was discovered in Decentralized Anonymous Payment System DAPS through 2019-08-26. The content to be signed is composed of a representation of strings, rather than being composed of their binary representations. This is a weak signature scheme design that would allow the reuse of signatur...

Design/Logic Flaw

An issue was discovered in Decentralized Anonymous Payment System DAPS through 2019-08-26. The content to be signed is composed of a representation of strings, rather than being composed of their binary representations. This is a weak signature scheme design that would allow the reuse of signatur...

Design/Logic Flaw

An issue was discovered in Decentralized Anonymous Payment System DAPS through 2019-08-26. It is possible to force wallets to send HTTP requests to arbitrary locations, both on the local network and on the internet. This is a serious threat to user privacy, since it can possibly leak their IP...

Nord Security: IDOR allow access to payments data of any user

simple send this POST request no need any auth: POST /api/v1/orders HTTP/1.1 Host: join.nordvpn.com Accept: application/json Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 179 DNT: 1 Connection: close...

Showmax: Open Redirect in secure.showmax.com

The hacker submitted open redirect vulnerability in one of our payment method flows. The vulnerability could have been also used to perform XSS attack. write-up: https://medium.com/@ahmadbrainworks/bug-bounty-how-i-earned-550-in-less-than-5-minutes-open-redirect-chained-with-rxss-8957979070e5...