CVE-2017-7992

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...

CVE-2017-7992

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...

CVE-2017-7992

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI (cavv parameter). Root cause: unsanitized input echoed in the response, enabling injection of arbitrary scripts. Impact per provi...

CVE-2017-7992

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...

PT-2017-18054

Name of the Vulnerable Software and Affected Versions Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php version 2.8.17 Description The issue concerns a reflected XSS in the examples/consumer-authentication/cruise.php file via the URI. Specifically, the cavv parameter is vulnerab...

CVE-2017-7992: Improper Neutralization of Input During Web Page Generation

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...

MasterCard launches Credit Card with Built-In Fingerprint Scanner

MasterCard has unveiled its brand new payment card that has a built-in biometric fingerprint scanner, allowing customers to authorize payments with their fingerprint, without requiring a PIN code or a signature. The company is already testing the new biometric payment cards, combined with the...

Threat Outbreak Alert RuleID28821: Email Messages Distributing Malicious Software on April 20, 2017

Medium Alert ID: 53521 First Published: 2017 April 20 17:27 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28821 may contain the following files: Name | Si...

Hackers Steal Payment Card Data From Over 1,150 InterContinental Hotels

InterContinental Hotels Group IHG is notifying its customers that credit card numbers and other sensitive information may have been stolen after it found malware on payment card systems at 1,174 franchise hotels in the United States. It's the second data breach that U.K.-based IHG, which owns...

InterContinental Hotel Chain Breach Expands

In December 2016, KrebsOnSecurity broke the news that fraud experts at various banks were seeing a pattern suggesting a widespread credit card breach across some 5,000 hotels worldwide owned by InterContinental Hotels Group IHG. In February, IHG acknowledged a breach but said it appeared to invol...

Oracle PeopleSoft Enterprise SCM eBill Payment Remote Vulnerability

Oracle PeopleSoft Products is a set of enterprise human capital management solutions from Oracle, which provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise SCM eBill Payment is one of the electronic billing display solution...

IHG Confirms Second Credit Card Breach Impacting 1,000-Plus Hotels

In what’s becoming a familiar refrain to guests, InterContinental Hotels Group, said late last week that payment card systems at more than 1,000 of its hotels had been breached. It’s the second breach that IHG, a multinational hotel conglomerate that counts Holiday Inn and Crowne Plaza among its...

ShadowBrokers' Windows Zero-Days Already Patched

Hours after what was thought to be a damaging release of NSA hacking tools for Windows systems, Microsoft quelled some anxiety with a late-night statement on Friday that most of the vulnerabilities disclosed by the ShadowBrokers had already been patched. The biggest surprise was that the most...

Word Directory Script 2.1 Cross Site Scripting / SQL Injection Vulnerabilities

Exploit for php platform in category web applications Title: Word Directory Script v 2.1 - Cross Site Scripting / SQL Injection Credit: Bilal KARDADOU Vendor: http://www.phponly.com/ Vendor URL: http://www.phponly.com/words.html Product: Word Directory Script v 2.1 Google Dork: N/A Product &...

live.bibiclub.net XSS vulnerability

Vulnerable URL: http://live.bibiclub.net/payment.php?id=1...

Word Directory Script 2.1 Cross Site Scripting / SQL Injection

Title: Word Directory Script v 2.1 - Cross Site Scripting / SQL Injection Credit: Bilal KARDADOU Vendor: http://www.phponly.com/ Vendor URL: http://www.phponly.com/words.html Product: Word Directory Script v 2.1 Google Dork: N/A Product & Service Introduction: "Word Directory Script" The big...

New Relic: Manipulation of submit payment request allows me to obtain Infrastructure Pro/Other Services for free or at greatly reduced price

@jonbottarini discovered an issue with our purchase process validation. This allowed subscription purchases to complete, even when they did not equal the intended price for the service provided. I wanted to test the New Relic pro features. I didn't want to pay full price I hacked the payment page...

Gratipay: CSV injection in gratipay.com via payment history export feature.

I discovered this issues thanks to Matt who pointed out that the participant's name is directly placed into a CSV file: https://github.com/gratipay/gratipay.com/issues/4399issuecomment-292250609 Summary --- Gratipay allows users to export payment history as a .csv file. By injecting a payload int...

Harvest: Client can redirect payment, causing payment discrepancy between Harvest and PayPal

Vulnerability details When a client views an invoice through the web interface, it'll show a "Pay with PayPal" button when a standard PayPal integration has been enabled. Clicking this button will submit a POST request to PayPal. This request contains a business parameter, which is the receiver o...

We asked 170 cyber security pros about ransomware. Here’s what they had to say.

The first week of January, my daughter called to say she couldn’t get into her college website to make changes to her spring schedule. Assuming servers were probably struggling to keep up with increased traffic, I told her to keep trying. However, it soon became apparent what the issue was. An...