Romanian POS Hackers Plead Guilty, Net $10 M from Scam

Two Romanian men pled guilty this week to charges they hacked into the point of sale systems of more than 200 restaurants, compromising the payment cards of 146,000 customers and amassing more than $10 million over the last few years. Included in those 200 stores were more than 150 Subway sandwic...

osCommerce v2.3.1 with PayPal website payments standard module v1.0 design vulnerability

Overview osCommerce 2.3.1 and possibly other versions with the PayPal website payments standard module is susceptible to a client-side attack that results in an attacker purchasing items without having to pay for them. Description It has been reported that osCommerce 2.3.1 using the PayPal websit...

NeoBill CMS 0.8 Alpha - Multiple Vulnerabilities

Title: ====== NeoBill CMS v0.8 Alpha - Multiple Web Vulnerabilities Date: ===== 2012-08-18 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=685 VL-ID: ===== 685 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

NeoBill CMS 0.8 Alpha Cross Site Scripting

Title: ====== NeoBill CMS v0.8 Alpha - Multiple Web Vulnerabilities Date: ===== 2012-08-18 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=685 VL-ID: ===== 685 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...

Malware Campaigns Impersonating U.S. Government Agencies

US-CERT is aware of multiple malware campaigns impersonating multiple U.S. government agencies, including the United States Cyber Command USCYBERCOM and the Federal Bureau of Investigation FBI. Once installed on a system, the malware displays a screen claiming that a Federal Government agency has...

NeoBill CMS v0.8 Alpha - Multiple Web Vulnerabilities

Document Title: =============== NeoBill CMS v0.8 Alpha - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=685 Release Date: ============= 2012-08-18 Vulnerability Laboratory ID VL-ID: ==================================== 685...

SA-CONTRIB-2012-112 - Ubercart SecureTrading - Failure to follow guideline/specification

The Ubercart SecureTrading Payment Method module provides an Ubercart payment method for the SecureTrading.com gateway. The module's payment method did not properly verify the validity of payment notification information. A malicious user could trick a site into thinking that an item has been pai...

Claims Of Attack On Visa, Mastercard Fizzle

One day after a hacker using the handle “Reckz0r” claims to have infiltrated 79 different banks and leaked information allegedly belonging to Visa and MasterCard customers, there are questions about whether a hack actually occurred. According to a post yesterday on Pastebin, the hacker Reckz0r...

Swoopo Gold Shop CMS 8.4.56 Cross Site Scripting / SQL Injection

Title: ====== Swoopo Gold Shop CMS v8.4.56 - Multiple Web Vulnerabilities Date: ===== 2012-05-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=515 VL-ID: ===== 515 Common Vulnerability Scoring System: ==================================== 8.5 Introduction: ============...

Threat Outbreak Alert: Fake Payment Receipt Email Messages on June 6, 2012

Low Alert ID: 26090 First Published: 2012 June 6 15:39 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam e-mail messages that claim to contain a payment receipt for the recipient. The text in the e-mail message attempts to convince the...

Study: Password Security Improves with Age

Baby Boomers may not be perceived as tech savvy as Millenials, but they apparently are better at protecting their digital assets. A new British study believed to be the largest of its kind shows those 55 and older tend to pick passwords with twice the strength of those under 25. It also indicates...

P2P Encryption Program now available from PCI Council

The PCI council has updated the Point-to-Point encryption P2PE program requirements PDF. The update impacts merchants, payment applications, point of sale vendors and service providers. As a participating organization of the PCI P2PE task force, providing input into the standard, I wanted to...

New P2P Zeus Variant Targets Popular Sites with Bogus Offers

Facebook, Gmail, Yahoo and Hotmail users should beware of rogue rebate offers and new secure payment options aimed at getting them to part with their debit card information. Earlier this week Amit Klein, CTO of Trusteer, announced the discovery of a peer-to-peer variant of the Zeus platform that...

Threat Outbreak Alert: Fake Payment Proof Details Email Messages on May 11, 2012

Low Alert ID: 25907 First Published: 2012 May 14 14:48 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam e-mail messages that claim to contain proof of payment for the recipient. The text in the e-mail message attempts to convince the...

Swoopo Gold Shop CMS v8.4.56 - Multiple Web Vulnerabilities

Exploit for php platform in category web applications Title: ====== Swoopo Gold Shop CMS v8.4.56 - Multiple Web Vulnerabilities Common Vulnerability Scoring System: ==================================== 8.5 Introduction: ============= Swoopo Gold is a shop content management system coded with PHP,...

Travelon Express CMS 6.2.2 XSS / Shell Upload / SQL Injection

Title: ====== Travelon Express CMS v6.2.2 - Multiple Web Vulnerabilities Date: ===== 2012-05-10 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=530 VL-ID: ===== 530 Common Vulnerability Scoring System: ==================================== 8.1 Introduction: =============...

FBI Concerned About Bitcoin Usage Among Cybercriminals

The Federal Bureau of Investigation has become increasingly concerned over the usage of the mostly-anonymous payment network Bitcoin by hackers and cybercriminals, according to an unclassified report obtained by Wired this week. The report, “Bitcoin Virtual Currency: Unique Features Present...

CVE-2008-7310

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

Security feature bypass

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

50K Cards Compromised using Credit Card Processor

50K Cards Compromised using Credit Card Processor Some 50,000 credit and debit cardholders may have their information exposed following a security breach at Global Payments. The breach occurred sometime between between Jan. 21, 2012 and Feb. 25, 2012. Both Visa and MasterCard have confirmed they...