5942 matches found
Cross site request forgery (csrf)
Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...
CVE-2020-22273
Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...
CVE-2020-22273
The CVE-2020-22273 entry concerns Neoflex Video Subscription System Version 2.0, where a CSRF flaw enables unauthorized changes to Website Settings (e.g., Payment Settings). The root cause is CSRF allowing state-changing requests without proper user verification. Documents consistently identify t...
CVE-2020-15967
CVE-2020-15967 affects Chromium/Google Chrome prior to 86.0.4240.75, with a use-after-free in the payments component that could potentially lead to remote code execution and sandbox escape. Debian/FreeBSD/Arch Fedora advisories confirm the issue and provide a fixed version: 86.0.4240.75 (or newer...
payment.site123.me Cross Site Scripting vulnerability OBB-1478065
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Texas Gold-Dealer Mined for Payment Details in Months-Long Data Breach
A popular precious-metals dealer, JM Bullion, has been the victim of a payment-skimmer attack. The company’s response was less than solid gold — it took months to notify its users of the breach. The Dallas-based company sells gold, platinum, silver, copper and palladium bullion, in the form of...
File Upload Vulnerability in CRMEB Knowledge Payment System Backend
CRMEB based on ThinkPhp5.0 + Vue + EasyWeChat development of a CRMEB new retail mall system. A file upload vulnerability exists in the backend of CRMEB Knowledge Payment System, which can be exploited by attackers to gain control of the server...
CS Money: Attacker can generate cancelled transctions in a user's transaction history using only Steam ID
Summary: The API endpoint /create-payment requires only the steam ID of the account to create the payment. When this endpoint is called using the cardpay flow, it returns a transaction ID on the Cardpay system. The attacker can access this transaction, and immediately cancel it or pay it ; , whic...
Nando's Hackers Feast on Customer Accounts
Diners at a popular chicken-dinner chain have seen hundreds of dollars siphoned out of their bank accounts, after cybercriminals were able to access their restaurant ordering credentials. The issue though is that payment-card information is not stored within Nando’s accounts, leaving some questio...
CVE-2019-14719
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager...
CVE-2019-14713
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages...
CVE-2019-14713
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages...
CVE-2019-14718
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svcnetcontrol arbitrary command injection and privilege escalation...
CVE-2019-14715
Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation...
CVE-2019-14711
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass...
Command injection
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager...
Race condition
Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass...
Design/Logic Flaw
Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generation...