Drupal Novalnet Payment - Ubercart Module SQL Injection Vulnerability

Drupal is a free and open source content management system developed in PHP.Novalnet Payment is a payment module. A SQL injection vulnerability exists in the Drupal Novalnet Payment - Ubercart module due to the program failing to adequately filter user-supplied input. The vulnerability allows...

Drupal Novalnet Payment Module SQL Injection Vulnerability

Drupal is a free and open source content management system developed in PHP.Novalnet Payment is a payment module. Drupal Novalnet Payment has a SQL injection vulnerability due to the program failing to adequately filter user-supplied input. The vulnerability allows remote attackers to submit...

HackerOne: mailto: link injection on https://hackerone.com/directory

I just found that entering a non-existing porogram returns the following response: The Directory doesn't have a profile matching these criteria. If an organization has published security contact information or a vulnerability disclosure policy, please let us know. The bold part has a mailto: link...

Novalnet Payment Module Drupal Commerce - Critical - SQL Injection - Unsupported - SA-CONTRIB-2015-117

This module enables you add the Novalnet payment service provider to Drupal Commerce. The module fails to sanitize a database query by not using the database API properly, thereby leading to a SQL Injection vulnerability. Since the affected path is not protected against CSRF, a malicious user can...

Charter Communications Fixes Data Leaking Vulnerability

Internet-cable-television provider Charter Communications recently fixed an issue with its website that was inadvertently leaking the information of tens of thousands of customers. Customers’ payment details, modem serial numbers, device names, account numbers, home addresses, were being spilled...

Simple Invoice 2011 Cross Site Scripting

Affected software: simple invoice Type of vulnerability:stored xss URL:simpleinvoices.org Discovered by: provensec Website: provensec.com version:2011 Proof of concept goto http://demo.simpleinvoices.org/index.php?module=paymenttypes&view=manage add new or edit some older payment type and fill th...

Evolving Financial Services Security Requirements: Part 1

Through the end of the year, the New York State Department of Financial Services NYSDFS, or DFS for short, expects to proceed with a number of initiatives to help strengthen cybersecurity at its regulated companies. Among these changes will be integration of regular, targeted assessments of...

WordPress Payment Gateways Caller Plugin <= 0.1.0 - Local file Inclusion

This plugin is prone to a loadmerchant parameter traversal local file inclusion vulnerability. Solution Update the plugin...

WordPress SagePay Direct Payment Gateway Plugin <= 0.1.6.6 - Reflected XSS

This plugin is prone to a reflected cross site scripting vulnerability in pages/3DRedirect.php, pages/3DCallBack.php and pages/3DComplete.php multiple parameter. Solution Update the plugin...

PCI Compliance Simplified: Get Trained and Avoid Security Breaches

Target’s data breach is a chilling example: After the widely publicized hack, 12% of loyal shoppers no longer shop at that retailer, and 36% shop at the retailer less frequently. For those who continue to shop, 79% are more likely to use cash instead of credit cards. According to DeMeo, Vice...

Angler Exploit Kit Pushing New, Unnamed Ransomware

Attackers are using the infamous Angler exploit kit to disseminate a new, yet unnamed variant of the TeslaCrypt and AlphaCrypt ransomware, according to Rackspace security researcher Brad Duncan. Duncan analyzed the threat on the SANS Internet Storm Center, saying that the malware presents its...

Threat Outbreak Alert RuleID15126: Email Messages Distributing Malicious Software on May 6, 2015

Medium Alert ID: 38722 First Published: 2015 May 7 14:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15126 may contain the following files: Name | Size ...

Sally Beauty Investigating Second Data Breach

Sally Beauty Supply, a seller of beauty products in the U.S., says it is investigating reports of fraudulent activities involving payment cards used at some of the chain’s retail locations. In March 2014, Sally Beauty admitted that hackers compromised its payment systems, exposing the sensitive...

Threat Outbreak Alert RuleID15020: Email Messages Distributing Malicious Software on May 11, 2015

Medium Alert ID: 38599 First Published: 2015 April 30 18:07 GMT Last Updated: 2015 May 13 12:49 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15020 may...

PayPal Inc Bug Bounty #114 - JDWP RCE Vulnerability

Document Title: =============== PayPal Inc Bug Bounty 114 - JDWP RCE Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1474 Video: http://www.vulnerability-lab.com/getcontent.php?id=1474 Release Date: ============= 2015-04-28 Vulnerability...

Shopify: Multiple issues on Checkout Process

Description While reviewing the Shopify POS application we found that the application was encrypting the CHD information, but it was leaving the amount outside of the payload and the post lacked any sort of HMAC signature preventing replay attacks. In addition, given the application does not...

Shopify: Payment gateway status transferred to Shopify without authentication

Note: This issue was originally reported to our self-hosted bug bounty program, and was transferred to HackerOne. One of the third-party payment gateways that can be used with Shopify did not offer a secure means of reporting transaction status to Shopify. As a result, it was possible for an...

Coinbase: iframes considered harmful

The Coinbase API offers an iframe payment option. iframes are attractive because they allow Coinbase's customers to give the illusion that the Bitcoin transaction is embedded entirely within the customer's website. But customers can and do refer to that iframe on insecure connections. Hijacking a...

Thousands of Hacked Uber Accounts Selling on Dark Web for $1

$US1 may be a very little amount, but it is enough to buy you a stolen Uber account and free car rides around the city. Two separate vendors on AlphaBay, a relatively new Dark Web marketplace launched in late 2014, are selling active Uber accounts with usernames and passwords for $1 each,...

Threat Outbreak Alert RuleID14277: Email Messages Distributing Malicious Software on March 26, 2015

Medium Alert ID: 38066 First Published: 2015 March 26 15:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14277 may contain the following files: Name | Si...