Alabama Hospitals Pay Up in Ransomware Attack

An Alabama hospital system has paid its attackers in a ransomware attack that knocked its systems offline on Oct. 1. Officials at the DCH Health System didn’t say how much the hospitals paid for the decryption key, but noted that they have started a “methodical” process of system restoration. “We...

Multiple vulnerabilities in EC-CUBE module "REMISE Payment module (2.11, 2.12 and 2.13)"

Overview EC-CUBE module "REMISE Payment module 2.11, 2.12 and 2.13" provided by REMISE Corporation contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2019-6016 Information disclosure CWE-200 - CVE-2019-6017 Gen Sato of Mitsui Bussan Secure Directions, Inc. reported...

REMISE Payment Module Cross-Site Scripting Vulnerability

REMISE Payment module for EC-CUBE is a payment gateway module for EC-CUBE e-commerce system from REMISE Japan. A cross-site scripting vulnerability exists in REMISE Payment Module 3.0.12 and earlier versions, which stems from the lack of proper validation of client-side data in the WEB applicatio...

REMISE Payment Module Information Disclosure Vulnerability

REMISE Payment module for EC-CUBE is a payment gateway module for EC-CUBE e-commerce system from REMISE Japan. An information disclosure vulnerability exists in REMISE Payment Module 3.0.12 and prior versions, which arises from errors in configuration or other errors in the operation of a network...

JVN#59436681: Multiple vulnerabilities in EC-CUBE module "REMISE Payment module (2.11, 2.12 and 2.13)"

EC-CUBE module "REMISE Payment module 2.11, 2.12 and 2.13" provided by REMISE Corporation contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2019-6016 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2|...

HackerOne: Disclosure of `payment_transactions` for programs via GraphQL query

Summary: payment transactions count of programs exposed Description: payment transactions details can be only accessed by program team members, but there is an flaw, with that, an unauthorized user can get payment transactions count of any program i have confirmed only with public program Steps T...

Razer: [pay.gold.razer.com] Stored XSS - Order payment

The tester discovered that the pay.gold.razer.com site suffered from a Stored XSS issue that could be used to steal a client id and key. The tester worked with team to provide multiple POCs to help them resolve the issue. Razer appreciates all the assistance from corraldev, which was above and...

cashlesspayment.jp Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-984721 Security Researcher devl00p Helped patch 3018 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting cashlesspayment.jp websit...

DoorDash Data Breach Impacts Personal Data of Almost 5M Users

Food delivery service DoorDash disclosed a data breach that affects almost 5 million customers, drivers and merchants using its platform. DoorDash, an on-demand food delivery service, connects end users with local restaurants and relies on contracted drivers who use their own vehicles for deliver...

Razer: Payment PIN Verification Bypass

The tester originally reported a PIN bypass in the Razer Pay MY client and provided a video POC which was very helpful. This was fixed in client version 2.11. Razer Fintech appreciates the tester's assistance and patience helping us resolve this issue...

Magecart Group Targets Routers Behind Public Wi-Fi Networks

A faction of the Magecart threat group is testing code that targets routers used to provide free or paid Wi-Fi services in public spaces and hotels. If successful, attackers would able to compromise these commercial-grade routers and be able to siphon payment data of users joining Wi-Fi networks ...

Hackers Hit Click2Gov Bill-Paying Portals in 8 Cities

The new wave of attacks comes after a previous Click2Gov hack compromised 300,000 payment cards...

Payment Card Breach Hits 8 Cities Using Vulnerable Bill Portal

A vulnerable municipality payment software, which previously led to the breach of hundreds of thousands of payment cards in 2017, has been targeted once again. This time it was part of a breach involving of eight cities in August. The hack targets a flaw in Click2Gov software, which is used in...

Security Bulletin: Financial Transaction Manager for Corporate Payment Services for Multi-Platform is affected by vulnerabilities in IBM Java Runtime

Summary Financial Transaction Manager for Corporate Payment Services for Multi-Platform FTM CPS has addressed the following vulnerability. There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 that has addressed the applicable CVEs. Vulnerability Details CVEID:...

Google Fined $170 Million For Violating Kids' Privacy On YouTube

Google has finally agreed to pay $170 million fine to settle allegations by the Federal Trade Commission and the New York attorney general that its YouTube service earned millions by illegally harvesting personal information from children without their parents' consent. The settlement requires...

SQL Injection Vulnerability in Payment Platform of Shanghai Fuzzy Wing Software Development Co.

Ltd. specializes in the development of software products and scientific and technological services in the field of Internet information technology. There is a SQL injection vulnerability in the payment platform of Shanghai Fuzzy Wing Computer Co., Ltd, which can be exploited by attackers to obtai...

CVE-2019-14979

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...

Code injection

DISPUTED cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true tha...

CVE-2019-14979

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the...

CVE-2019-14979

The CVE-2019-14979 entry concerns the WooCommerce PayPal Checkout Payment Gateway plugin for WordPress (version 1.6.17). The vulnerability is described as parameter tampering in the PayPal flow via the cgi-bin/webscr?cmd=_cart endpoint, where the amount parameter (e.g., amount_1) can be manipulat...