Logic design flaws in DXN Global App

Dresdner Global App is a shopping software. There is a logical design vulnerability in the DXGlobal APP. An attacker can register any account, reset any password and change the payment amount by obtaining the verification code...

Gratipay: Adding Used Primary Email Address to attacker account and Account takeover

Summary I just found that the Gratipay is vulnerable for adding used Primary Email Address to attacker account and Account takeover of the Gratipay. Description I was looking at the source code of the application and I found that, "If the email address [email protected] is already added in the X...

Road to Health Android App Has Logic Design Flaws

Health Road APP is a medical service platform that provides users with services such as registration, consultation, physical examination and accompanying consultation. A logic design vulnerability exists in the Health Road Android APP. The vulnerability is due to the failure of the Alipay payment...

paymentgatewayonline.info XSS vulnerability

Vulnerable URL: http://paymentgatewayonline.info/sploit/view.php?where=%27%22%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Lyst: Bypassing one-time checkout router page (revealing payment information)

Description: ======== When user submits for a checkout, the checkout router page /checkout-router/ID/ is accessible only once, which can be bypassed by crafting the checkout ID in cookie basketkey send to the page /new/checkout/order/. combining with brute-force attack, if the ID is valid a resul...

Netflix scam warning

Always be on your toes While we are used to receiving scam attempts pretending to be from banks, online shops, credit card companies, and international courier services that does not mean all the other emails are safe. Far from it. To demonstrate this point we will show you a scam aimed at Netfli...

PT-2020-8062

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions prior to 0.14 Description: The issue allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actually occur. Completing the attack would...

Enterprise Edition Payment Processor Script 3.7 - SQL Injection

Enterprise Edition Payment Processor Script 3.7 - SQL Injection Exploit Title: Enterprise Edition Payment Processor Script 3.7 - SQL Injection Dork: N/A Date: 14.09.2017 Vendor Homepage: https://www.goterhosting.com/ Software Link: https://www.goterhosting.com/payment-processor-script.php Demo:...

Multiple Vulnerabilities in UZONE App

UZONE APP is a shopping application based on the UZONE product platform. An SMS bomb and logic design vulnerability exists in UZONE APP. The vulnerability is due to the number of SMS verification sends in the service side is not verified due to the attacker can be any cell phone number SMS attack...

Sql injection

Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the 1 checkdownload and possibly 2 checkfilename function in upload/admin2/model/products/modeladmindownload.php or remote authenticated users wit...

Payment Design Vulnerabilities in the Top-Up Function Module of EZZY APP Android Version

EZZY APP is a car intelligent sharing platform APP created by Beijing Daimeng Technology Co. There is a payment design vulnerability in the recharge function module of EZZY APP Android version. After logging into the system, an attacker can modify the amount in the payment packet by catching the...

PT-2017-7554

Name of the Vulnerable Software and Affected Versions AlegroCart version 1.2.8 Description The issue allows remote administrators to execute arbitrary SQL commands via the download parameter in the check download and possibly check filename function in upload/admin2/model/products/model admin...

EZZY APP Android version of the deposit function module has a payment design loophole

EZZY APP is a car intelligent sharing platform APP created by Beijing Daimeng Technology Co. The Android version of EZZY APP has a vulnerability in the amount payment design. After logging into the system, an attacker can arbitrarily modify the size of the payment amount by clicking on the paymen...

Unspecified Vulnerability in Oracle Payment Interface Component

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hospitality management from Oracle. The solution provides human resource cost management, provides tracking and management of services throughout the customer's journey to improve customer...

Lenovo to Pay $3.5m for Secretly Installing Adware in 750,000 Laptops

By Waqas A few years back Lenovo Inc., a world famous and This is a post from HackRead.com Read the original post: Lenovo to Pay $3.5m for Secretly Installing Adware in 750,000 Laptops...

Telekom Prepaid Shop - Multiple Persistent Vulnerabilities

Document Title: =============== Telekom Prepaid Shop - Multiple Persistent Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2051 Telekom Security ID: 20170407TLu04 Release Date: ============= 2017-09-05 Vulnerability Laboratory ID VL-ID:...

Fraudulent Donations Lead to Disbanding of Hutchins Legal Defense Fund

A legal defense fund established to ease Marcus Hutchins’ attorney costs has been disbanded after a sizable number of fraudulent donations were discovered. Hutchins, known as Malware Tech, is facing six counts for his alleged involvement in creating and distributing the Kronos banking malware. Th...

QIWI: [qiwi.com] XSS on payment form

Высылаем POST HACKED" В чем дело? Символы ", %BYTS фильтруются, но не фильтруется / символ Из за этого мы можем тупо закрыть скрипт при помощи и писать все, что угодно P.S. Можно забайпасить X-XSS-Auditor при помощи ваших обработок %00 и тп символов : Что в итоге выходит? F216159...

Threat Outbreak Alert RuleID30307: Email Messages Distributing Malicious Software on August 24, 2017

Medium Alert ID: 54938 First Published: 2017 August 24 17:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30307 may contain the following files: Name |...

WAP-billing Trojan-Clickers on rise

During the preparation of the "IT threat evolution Q2 2017" report I found several common Trojans in the "Top 20 mobile malware programs" list that were stealing money from users using WAP-billing - a form of mobile payment that charges costs directly to the user's mobile phone bill so they don't...