5613 matches found
CVE-2014-0669
The Wireless Session Protocol WSP feature in the Gateway GPRS Support Node GGSN component on Cisco ASR 5000 series devices allows remote attackers to bypass intended Top-Up payment restrictions via unspecified WSP packets, aka Bug ID CSCuh28371...
Threat Outbreak Alert: Fake Payment Confirmation Email Messages on January 20, 2014
Medium Alert ID: 32498 First Published: 2014 January 21 21:05 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment confirmation notice for the recipient. The text in the email message attempts to convince the...
Threat Outbreak Alert: Fake Online Bill Payment Notification Email Messages on January 20, 2014
Medium Alert ID: 32495 First Published: 2014 January 21 16:10 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an online bill payment notification for the recipient. The text in the email message attempts to convince the...
Threat Outbreak Alert: Fake TT Payment Copy Attachment Email Messages on January 17, 2014
Medium Alert ID: 32485 First Published: 2014 January 21 16:01 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain telegraphic transfer TT payment copy attachment confirmation for the recipient. The text in the email message...
Private Messaging App Vendor Wickr Offers Hackers $100,000 for Bugs
Bug bounty programs, for the most part, have been the domain of large software vendors and Web companies such as Google, Mozilla, Microsoft, PayPal and Facebook. But some smaller companies are now getting involved, with the latest one to announce a bounty being Wickr, the maker of secure messagin...
Detecting and Preventing Compromises in Retail Payment Systems
Information Weeks Matthew Swartz published an article on the recently- confirmed payment card breaches at Target, Nieman Marcus and three other unnamed retailers. This article and many others reveal that these attacks involve sophisticated malware and some even suggest it is the work of the same...
Threat Outbreak Alert: Fake Payment Slip Attachment Email Messages on January 9, 2014
Medium Alert ID: 32398 First Published: 2014 January 10 15:36 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment slip attachment for the recipient. The text in the email message attempts to convince the recipient ...
RAM Scrapers and the Target Data Breach
The retail and hospitality industries have a painful history with wonky point-of-sale systems and malware known as RAM scrapers. These attacks, which date back as many as six years, are designed to be injected into running processes and steal payment card data before it’s encrypted by a...
UAEPD Shopping Script SQL Injection
uaepd script Multiple Sql Injection Vulnerabilty ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.uaepd.net/ .:. Dork :...
Threat Outbreak Alert: Fake Invoice Payment Confirmation Email Messages on January 6, 2014
Medium Alert ID: 32329 First Published: 2014 January 6 21:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an invoice confirmation notification for the recipient. The text in the email message attempts to convince the...
PrisonLocker Ransomware Emerges From Criminal Underground
Security researchers from Malware Must Die uncovered new ransomware called PrisonLocker, and said the malware author is either a legitimate security researcher or is posing as one via a personal blog and Twitter handle. Malware Must Die has monitored PrisonLocker’s development since spotting it f...
Threat Outbreak Alert: Fake Account Payment Information Email Messages on April 24, 2014
Medium Alert ID: 32294 First Published: 2014 January 2 19:14 GMT Last Updated: 2014 April 25 12:30 GMT Version: 70 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment information for the recipient. The text in the email message...
Use of 3DES to Encrypt Stolen Target PIN Data Invites Worry
Target Corp.’s admission that encrypted PIN data was stolen in the Black Friday breach was bad news for consumers. For security experts, especially cryptographers, particular exception was taken to the retail giant’s use of Triple DES 3DES encryption to keep the PIN data safe. With all crypto...
[CVE-2013-6986] Insecure Data Storage in Subway Ordering for California (ZippyYum) 3.4 iOS mobile application
Title: CVE-2013-6986 Insecure Data Storage in Subway Ordering for California ZippyYum 3.4 iOS mobile application Published: December 7, 2013 Reported to Vendor: May 2013 CVE Reference: CVE-2013-6986 https://vulners.com/cve/CVE-2013-6986 CVSS v2 Base Score: 4.9 CVSS v2 Vector...
Threat Outbreak Alert: Fake Payment Slip Notification Email Messages on December 19, 2013
Medium Alert ID: 32245 First Published: 2013 December 20 14:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment transfer details for the recipient. The text in the email message attempts to convince the recipient ...
CryptoLocker Creators Infected Nearly 250,000 Systems, Earned $30 M Since September
UPDATE: The math in this and other reports was simply tabulated incorrectly. New American presidents often are measured by what they accomplish in their first 100 days. By that yardstick, the crew behind the CryptoLocker ransomware have been a raging success. The unknown group of attackers have...
Target Corp. Suffers Black Friday Data Breach
UPDATE – TJX and Heartland Payment Systems may soon have company atop the list of the worst retail data breaches in U.S. history after reports surfaced that Target Corp. was breached around Black Friday and millions of credit and debit cards were stolen. Target confirmed the breach this morning a...
jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...
Santander BillPay Security Vulnerabilities Patched
Security weaknesses on the Santander Group BillPay website and mobile banking application have been addressed by the financial services organization’s developer Headland after they were exposed less than a week ago. U.K. consultant Paul Moore of Cresona Corp., reported a number of serious...
