Uber: deleting payment profile during active trip puts account into arrears but active trip is temporarily “free”

Deleting a payment profile for an account that is actively taking a trip results in the trip not being charged, but moves the user's account into arrears and when a payment profile is added back, the account is charged the unpaid amount...

Membership Pro and other OS Solution extensions

Os Solution products have fixed an issue in the Paypal payment gateway in five of their extensions and made new releases to fix it:- 1. Events Booking version 2.14.2 https://www.joomdonation.com/forum/events-booking-general-discussion/57320-events-booking-version-2-14-2-released.html 2...

Tax-themed phishing and malware attacks proliferate during the tax filing season

Tax-themed scams and social engineering attacks are as certain as death or tax itself. Every year we see these attacks, and 2017 is no different. These attacks circulate year-round as cybercriminals take advantage of the different country and region tax schedules, but they peak in the months...

fttsecurepaymentgateway.com XSS vulnerability

Vulnerable URL: https://www.fttsecurepaymentgateway.com/TradingWeb/joinWelcomeInit.action?urlSource=CTT'"--!confirmOPENBUGBOUNTY...

How anyone could have used Uber to ride for free!

Note: This is being published with the permission of Uber under the responsible disclosure policy. The vulnerability was fixed in August 2016. Summary: This post is about an interesting bug on Uber which could have been used to ride for free anywhere in the world. Attackers could have misused thi...

QIWI: [wallet.rapida.ru] Mass SMS flood

... или сказ о том, как я опрометчиво заказал себе рассылку из 300 смс. Шаги для воспроизведения: 1 Логинимся в wallet.rapida.ru 2 Идём в шаблоны и создаём себе шаблон для оплаты мобилы 3 Если вы до этого нигде не вводили 2FA код - то сейчас самая фишка - нас просят его ввести. 4 Ловим запрос и...

TYPO3 Caddy Extension 'paymill/api/php/payment.php' Cross-Site Scripting Vulnerability

Typo3 is one of the leading brands of open source content management systems CMS and content management frameworks CMF based on PHP and MySQL databases and is a powerful open source solution. A cross-site scripting vulnerability exists in the TYPO3 Caddy extension that stems from the program...

CVE-2017-5963

An issue was discovered in caddy for TYPO3 before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. An attacker could execute...

secure.onlinepaymentstore.com XSS vulnerability

Vulnerable URL: https://secure.onlinepaymentstore.com/sitemaker/sites/Harvey1/?page=onlinestoreDOMAIN=%3C!%27/!%22/!%27/%22/--!%3E%3CInput/Autofocus/%0D/Onfocus=confirm1//%3E%3CSvg%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS...

InterContinental Hotels Confirms Credit Card Breach

InterContinental Hotels Group IHG, parent company to Crowne Plaza, Holiday Inn and Kimpton Hotels and Resorts, confirmed on Friday a breach of payment card systems used in 12 of its hotels located in North America and the Caribbean. According to IHG, which operates 5,000 hotels worldwide, malware...

Threat Outbreak Alert RuleID27625: Email Messages Distributing Malicious Software on February 6, 2017

Medium Alert ID: 52588 First Published: 2017 February 6 13:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID27625 may contain the following files: Name |...

Coinbase: Requestor Email Disclosure via Email Notification

When a Coinbase user requests money from another coinbase user, the user that receives the request sees an email that says, in part: John Smith [email protected] sent you a request to pay 1 BTC using Coinbase. Where John Smith is the sending account's display name meaning you can make it whatever you...

Threat Outbreak Alert RuleID27478: Email Messages Distributing Malicious Software on January 27, 2017

Medium Alert ID: 52458 First Published: 2017 January 27 21:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID27478 may contain the following files: Name |...

Half of Ransomware Victims Pay Criminals' Demands to Recover Data

A report on ransomware sheds new light on attacks in 2016, starting with the fact that 48 percent of businesses hit by ransomware said they paid the ransom. That’s in spite of pleas from cyber security experts and the FBI not to do so. Other insights include the average ransom payment was $2,500...

Charger Mobile Ransomware Removed from Google Play

Security researchers have identified a new and evasive mobile ransomware strain called Charger on the Google Play app store. The Charger malware was bundled with an SMS-snooping app called EnergyRescue that pawned itself off as a battery management utility, according to Check Point security...

Spora Ransomware Offers Unique Payment Options

Researchers are keeping close tabs on a new ransomware strain called Spora that offers victims unique payment options and comes with top-notch encryption. Spora was spotted last week by ransomware experts at BleepingComputer, who said after Spora encrypts files on your computer, it offers four...

iTechScripts Payment Gateway Script 8.46 SQL Injection

Exploit Title : Payment Gateway Script v8.46 - Multiple Vulnerability Author : Hasan Emre Ozer Google Dork : - Date : 18/01/2017 Type : webapps Platform: PHP Vendor Homepage : http://itechscripts.com/payment-gateway-script/ Sofware Price and Demo : $400 http://payment-gateway.itechscripts.com...

SHA-1 End Times Have Arrived

For the past couple of years, browser makers have raced to migrate from SHA-1 to SHA-2 as researchers have intensified warnings about collision attacks moving from theoretical to practical. In just weeks, a transition deadline set by Google, Mozilla and Microsoft for the deprecation of SHA-1 is u...

Hindu Matrimonial Script - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Vulnerability:: Admin Login Bypass & SQLi + Add/Edit Date: 13.01.2017 Vendor Homepage: http://www.phpmatrimonialscript.in/ Script Name: Hindu Matrimonial Script Script Buy Now: http://www.phpmatrimonialscript.in/product/hindu-matrimonial-scrip...

QIWI: [XSS/3dsecure.qiwi.com] 3DSecure XSS

При отправке POST запроса: POST https://3dsecure.qiwi.com/acs/pareq?network=VISA HTTP/1.1 Host: 3dsecure.qiwi.com Connection: keep-alive Content-Length: 37 Cache-Control: max-age=0 Origin: https://pay.qiwi.com Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...