Threat Outbreak Alert RuleID18693: Email Messages Distributing Malicious Software on October 14, 2015

Medium Alert ID: 41514 First Published: 2015 October 14 18:54 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18693 may contain the following files: Name |...

WordPress Payment Form for PayPal Pro Plugin <= 1.0.1 - XSS

This WordPress plugin is prone to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary script or HTML. Solution Update the plugin...

Payment Form for PayPal Pro <= 1.0.1 - Multiple Reflected Cross-Site Scripting (XSS)

The Payment Form for PayPal Pro WordPress plugin was affected by a Multiple Reflected Cross-Site Scripting XSS security vulnerability...

Threat Outbreak Alert RuleID18587: Email Messages Distributing Malicious Software on October 9, 2015

Medium Alert ID: 41463 First Published: 2015 October 9 15:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18587 may contain the following files: Name |...

Samsung LoopPay Hacked, but 'Samsung Pay' is Safe

Samsung has been surrounded by a lot of controversies since the past few years, but that has not influenced its productivity. But this report has raised a few eyebrows... Samsung's mobile payment system company, LoopPay, was hacked back in March this year, just a month after Samsung bought it to...

Report from the PCI SSC North American Community Meeting

The Payment Card Industry Security Standards Council held their 2015 North American Community Meeting this year in Vancouver, BC, from September 29 - October 1. Coalfire was well represented at the meeting, with Dan Fritsche, Managing Director, Application Security, making two presentations at th...

Shopify: Accessing Payments page and adding payment methods with limited access accounts

Users with the Orders permission were allowed to see the store's payment gateway information. This page should have been restricted to users with the Settings permission only. Using this vulnerability a User with limited access/ No access to Settings could add/alter/change Payment settings while...

Threat Outbreak Alert RuleID18354: Email Messages Distributing Malicious Software on September 30, 2015

Medium Alert ID: 41299 First Published: 2015 October 2 13:48 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18354 may contain the following files: Name |...

Chip-and-PIN Credit Cards and The Deadline: Here's What You need To Know

October 1 Liability shift ENDS! Today, 1st October 2015, is the deadline for US-based Banks and Retailers to roll out Chip-embedded Credit Cards powered by EVM Technology to customers that will make transactions more secure. EVM Technology stands for Europay, MasterCard and Visa -- a global...

Threat Outbreak Alert RuleID18300: Email Messages Distributing Malicious Software on September 28, 2015

Medium Alert ID: 41239 First Published: 2015 September 28 13:27 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18300 may contain the following files: Name ...

Design/Logic Flaw

The Commerce Commonwealth CBA module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."...

CVE-2015-7231

The Drupal Commerce Commonwealth (CBA) module for Drupal 7.x-1.x is affected by an input validation flaw in payment processing. Specifically, versions prior to 7.x-1.5 do not sufficiently validate gateway interactions, allowing a remote attacker to craft a URL that makes a failed payment appear v...

Threat Outbreak Alert RuleID17959: Email Messages Distributing Malicious Software on September 12, 2015

Medium Alert ID: 40984 First Published: 2015 September 14 13:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17959 may contain the following files: Name ...

Threat Outbreak Alert RuleID17838: Email Messages Distributing Malicious Software on August 2, 2016

Medium Alert ID: 40911 First Published: 2015 September 9 16:05 GMT Last Updated: 2016 August 3 12:52 GMT Version: 27 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17838...

PayPal Inc - SecApproval & 2FA Auth Bypass Vulnerability

Document Title: =============== PayPal Inc - SecApproval & 2FA Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1486 Video: http://www.vulnerability-lab.com/getcontent.php?id=1485 Watch Video:...

Threat Outbreak Alert RuleID17672: Email Messages Distributing Malicious Software on August 31, 2015

Medium Alert ID: 40746 First Published: 2015 August 31 20:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17672 may contain the following files: Name |...

Threat Outbreak Alert RuleID17656: Email Messages Distributing Malicious Software on August 29, 2015

Medium Alert ID: 40731 First Published: 2015 August 31 13:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17656 may contain the following files: Name |...

PayPal Stored Cross Site Scripting

Document Title: =============== PayPal Bug Bounty 119 - Stored Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1588 Video: http://www.vulnerability-lab.com/getcontent.php?id=1587 Vulnerability Magazine:...

Mail.ru: Content spoofing в http://my.mail.ru/cgi-bin/app/paymentm

Text injection into http://my.mail.ru/cgi-bin/app/paymentm could assist phishing attack. Under current practice, text injection reports are only accepted as an exeption, for vectors with high potential for phishing attacks in-the-wild...

Web.com Data Breach

Update Florida-based web hosting company Web.com on Tuesday announced that it had suffered a data breach and payment card and personal information belonging to 93,000 customers was accessed. The company did not say in a statement or press release whether the stolen data was encrypted, nor how it...