CVE-2021-24679

The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue...

Cardinity Payment Gateway for WooCommerce < 3.0.7 - Reflected Cross-Site Scripting

The plugin does not escape various parameter before outputting them in attributes, leading to Reflected Cross-Site Scripting issues PoC Vulnerable parameters: amount, country, currency, orderid, description, returnurl, projectid, signature...

WordPress 插件 Stripe for WooCommerce 安全漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress plugin Stripe for WooCommerce, which stems from a...

3.1M Neiman Marcus Customer Card Details Breached

Dallas-based Neiman Marcus Group is known worldwide as the go-to luxury retailer for the well-heeled. But their reputation for impeccable quality just took a big hit with revelations that the company was breached by an attacker back in May 2020. It took 17 months for the retailer to notice. Just...

Apple Pay vulnerable to wireless pickpockets

Researchers have shown that it is possible for attackers to bypass an Apple iPhones lock screen to access payment services and make contactless transactions. The issue, which only applies to Apple Pay and Visa, is caused by the use of so-called magic bytes, a unique code used to unlock Apple Pay...

Apple Pay Can be Abused to Make Contactless Payments From Locked iPhones

Cybersecurity researchers have disclosed an unpatched flaw in Apple Pay that attackers could abuse to make an unauthorized Visa payment with a locked iPhone by taking advantage of the Express Travel mode set up in the device's wallet. "An attacker only needs a stolen, powered on iPhone. The...

This Week in Security News – October 1, 2021

Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about Zloader, a notable recent ZBOT variant. Also, read on a recently introduced bill that would mandate ransom payment reporting...

This Week in Security News – October 1, 2021

Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about Zloader, a notable recent ZBOT variant. Also, read on a recently introduced bill that would mandate ransom payment reporting...

Apple Pay with Visa Hacked to Make Payments via Locked iPhones

An attacker who steals a locked iPhone can use a stored Visa card to make contactless payments worth up to thousands of dollars without unlocking the phone, researchers are warning. The problem is due to unpatched vulnerabilities in both the Apple Pay and Visa systems, according to an academic te...

Hackers Targeting Brazil's PIX Payment System to Drain Users' Bank Accounts

Two newly discovered malicious Android applications on Google Play Store have been used to target users of Brazil's instant payment ecosystem in a likely attempt to lure victims into fraudulently transferring their entire account balances into another bank account under cybercriminals' control...

btcpay server 跨站脚本漏洞

btcpay server is a free and open source bitcoin payment processor that allows you to accept bitcoins without fees or intermediaries. A cross-site scripting vulnerability exists in btcpay server. The vulnerability stems from the susceptibility to incorrect input neutralization "cross-site scriptin...

Indictment, Lawsuits Revive Trump-Alfa Bank Story

In October 2016, media outlets reported that data collected by some of the worlds most renowned cybersecurity experts had identified frequent and unexplained communications between an email server used by the Trump Organization and Alfa Bank, one of Russias largest financial institutions. Those...

Millions impacted as payment API vulnerabilities exposing transaction keys

By Deeba Ahmed Millions of users could have exposed their private, payment data due to API security vulnerabilities discovered in several applications. This is a post from HackRead.com Read the original post: Millions impacted as payment API vulnerabilities exposing transaction keys...

Crystal Valley Farm Coop Hit with Ransomware

Crystal Valley, a Minnesota-based farm supply and grain marketing cooperative, has become the second U.S. agriculture business to be hit with a ransomware attack this week. The company released a statement about the attack on its website on Tuesday afternoon, but as of Wednesday afternoon, the si...

Unhandled return value of transfer() could cause bounty payment failure

Handle 0xRajeev Vulnerability details Impact ERC20 implementations are not always consistent. Some implementations of transfer and transferFrom could return ‘false’ on failure instead of reverting. It is safer to wrap such calls into require statements or use safe wrapper functions implementing...

Payment API Bungling Exposes Millions of Users’ Payment Data

App developers have once again been accused of having butterfingers when it comes to API keys, leaving millions of mobile app users at risk of exposing their personal and payment data. CloudSEK, maker of artificial intelligence- AI- enabled digital threat protection, reported last week that the...

Cross site scripting

The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /includes/pluginsettings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10...

CVE-2021-38341

The CVE pertains to the WooCommerce Payment Gateway Per Category WordPress plugin (≤ 2.0.10) and describes a Reflected Cross‑Site Scripting flaw. The root cause is a reflected value in $_SERVER["PHP_SELF"] used by the plugin in includes/plugin_settings.php, enabling injection of arbitrary scripts...

CVE-2021-38341 WooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site Scripting

The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /includes/pluginsettings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10...

CVE-2021-38341 WooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site Scripting

The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /includes/pluginsettings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10...