5649 matches found
Security Bulletin: Financial Transaction Manager for Corporate Payment Services v2.1.1 is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-1871)
Summary IBM Financial Transaction Manager for Corporate Payment Services FTM CPS for Multi-Platform v2.1.1 has addressed the following vulnerability. A potential cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionali...
Security Bulletin: Financial Transaction Manager for Corporate Payment Services for Multi-Platform v2.1.1 is affected by vulnerabilities in IBM Java Runtime
Summary Financial Transaction Manager for Corporate Payment Services for Multi-Platform FTM CPS v2.1.1 has addressed the following vulnerability. There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 that has addressed the applicable CVEs. Vulnerability Details CVEID:...
Bitcoin Bomb Scare Associated with Sextortion Scammers
This blog was written by Jaeson Schultz. Organizations across the country are on edge today after a flurry of phony bomb threats hit several public entities Thursday, such as universities, schools and news outlets, among others. The attackers distributed malicious emails claiming to have placed...
A week in security (December 3 – 9)
Last week on Malwarebytes Labs, we gave readers an FYI on multiple breaches that affected Humble Bundle, Quora, and Dunkin' Donuts, to name a few. This follows the announcement from Marriott about a four-year-long breach that impacted half a billion of its patrons. We also pushed out the report,...
What Happens When Victims Pay Ransomware Attackers?
For many hackers around the globe, ransomware infections have become a lucrative business. Although these types of malware samples have been around for years now, they continue to spur success - and high monetary profits - for attackers. In fact, according to a statement from U.S. Deputy Attorney...
Weak Password Vulnerability in Chengdu Zhihui Campus Security Payment Platform
Campus Secure Payment Platform is an internet and mobile internet financial application platform for domestic universities. A weak password vulnerability exists in the Campus Pay platform. An attacker can exploit the vulnerability to obtain sensitive information and also perform unauthorized...
1-800-Flowers Becomes Latest Payment Breach Victim
Those buying flowers for Mother’s Day or looking to send a plant for a birthday could find their thoughtful gestures reaping a crop of misery: Payment card data has been lifted from the Canadian online outpost of 1-800-Flowers, in an incident that has persisted for four years. The site’s operatin...
iOS Fitness Apps Robbing Money From Apple Victims
Two apps that were posing as fitness-tracking tools were actually using Apple’s Touch ID feature to loot money from unassuming iOS victims. The two impacted apps were the “Fitness Balance App” and “Calories Tracker App.” Both apps looked normal, and served functions like calculating BMI, tracking...
SamSam Ransomware
Summary The Department of Homeland Security DHS National Cybersecurity and Communications Integration Center NCCIC and the Federal Bureau of Investigation FBI are issuing this activity alert to inform computer network defenders about SamSam ransomware, also known as MSIL/Samas.A. Specifically, th...
Marriott: Data on 500 Million Guests Stolen in 4-Year Breach
Hospitality giant Marriott today disclosed a massive data breach exposing the personal and financial information on as many as a half billion customers who made reservations at any of its Starwood properties over the past four years. Marriott said the breach involved unauthorized access to a...
Dell Resets All Customers' Passwords After Potential Security Breach
Multinational computer technology company Dell disclosed Wednesday that its online electronics marketplace experienced a "cybersecurity incident" earlier this month when an unknown group of hackers infiltrated its internal network. On November 9, Dell detected and disrupted unauthorized activity ...
Dell Resets All Customers' Passwords After Potential Security Breach
Multinational computer technology company Dell disclosed Wednesday that its online electronics marketplace experienced a "cybersecurity incident" earlier this month when an unknown group of hackers infiltrated its internal network. On November 9, Dell detected and disrupted unauthorized activity ...
Uber fined $1.1 million by UK and Dutch regulators over 2016 data breach
British and Dutch data protection regulators Tuesday hit the ride-sharing company Uber with a total fine of $1,170,892 1.1 million for failing to protect its customers' personal information during a 2016 cyber attack involving millions of users. Late last year, Uber unveiled that the company had...
Magecart Credit Card Stealer
Magecart is a malicious javascript code injected into e-commerce websites in order to steal payment details. A compromised website containing the malicious code may leak the customer's payment details to the attacker...
A week in security (November 19 – 25)
Last week on Malwarebytes Labs, we took a look at a devastating business email compromise attack, web skimming antics, and the fresh perils of Deepfakes. We also checked out some Chrome bug issues, and took the deepest of deep dives into DNA testing. Other cybersecurity news Adobe Flash bug—get...
Py-EVM is vulnerable to arbitrary bytecode injection
Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.executebytecode call that triggers computation.stack.values with '"stack": 100, 100, 0' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed...
6 security concerns to consider when automating your business
Automation is an increasingly-enticing option for businesses, especially when those in operations are in a perpetual cycle of "too much to do and not enough time to do it." When considering an automation strategy, business representatives must be aware of any security risks involved. Here are six...
CVE-2018-19189
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement...