Magecart Strikes Again, Siphoning Payment Info from Newegg

The Magecart threat actor, which just made headlines with the British Airways breach, has been racking up conquests lately and shows no signs of slowing down. This week, it added a new feather to its compromise cap: The Newegg online retailer. Newegg is a top online merchant with tens of millions...

Hackers Steal Customers' Credit Cards From Newegg Electronics Retailer

The notorious hacking group behind the Ticketmaster and British Airways data breaches has now victimized popular computer hardware and consumer electronics retailer Newegg. Magecart hacking group managed to infiltrate the Newegg website and steal the credit card details of all customers who enter...

Hackers Steal Customers' Credit Cards From Newegg Electronics Retailer

The notorious hacking group behind the Ticketmaster and British Airways data breaches has now victimized popular computer hardware and consumer electronics retailer Newegg. Magecart hacking group managed to infiltrate the Newegg website and steal the credit card details of all customers who enter...

Click It Up: Targeting Local Government Payment Portals

FireEye has been tracking a campaign this year targeting web payment portals that involves on-premise installations of Click2Gov. Click2Gov is a web-based, interactive self-service bill-pay software solution developed by Superion. It includes various modules that allow users to pay bills associat...

State Government Online Payment Service Exposes 14M Customers

Details on more than 14 million customer records have been exposed thanks to a security oversight at GovPayNow.com, which as its name implies provides a platform for online payment systems for state and local governments. The company, which according to its website “handles more than 2.1 million...

GovPayNow.com Leaks 14M+ Records

Government Payment Service Inc. — a company used by thousands of U.S. state and local governments to accept online payments for everything from traffic citations and licensing fees to bail payments and court-ordered fines — has leaked more than 14 million customer records dating back at least six...

Logic Design Vulnerability in Smart Fruit Content Payment System v2.0.0

Jigo Content Payment System is a professional content payment system for enterprise customers. A logical design vulnerability exists in Jigo Content Payment System v2.0.0. The vulnerability is due to improper handling of user input in the frontend, which can be exploited by an attacker to modify...

Canadian town forced to pay Bitcoin after nasty ransomware attack

By Uzair Amir The town of Midland, Ontario, Canada, has decided to pay cybercriminals after its servers were targeted and infected with a nasty ransomware on Saturday, September 1, at approximately 2 a.m. The total amount of ransom payment has not been disclosed but the demand from cybercriminals...

Magecart Threat Group Racks Up More Hack Victims

Days after Magecart adversaries were blamed for the British Airways breach, the threat group was also identified as behind hacking two additional victims this week – including customer engagement tool Feedify and boutique deal company Groopdealz. The hack of Feedify was disclosed after Twitter us...

Magecart Group Pinned in Recent British Airways Breach

The recent British Airways breach of up to 380,000 payment cards, has been attributed to the infamous Magecart threat actor. Last week, British Airways revealed that the bank card data was compromised after a security breach occurred on the company’s website and mobile app in August. While...

British Airways Hack Triggers GDPR Concerns, as World Awaits Windows 0-Day Patch

A swipe of confidential data from almost 400,000 British Airways customers. A string of app takedowns at the Mac App Store after exfiltration findings. A gargantuan data breach at a Chinese hotel chain. An unpatched zero-day Windows bug exploited in the wild. These are some of the security news...

CVE-2018-0658

Input validation issue in EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version 3.5.23 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.11 version 2.3.17 and earlier...

CVE-2018-0657

Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module PG Multi-Payment Service for EC-CUBE EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version...

CVE-2018-0657

Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module PG Multi-Payment Service for EC-CUBE EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version...

CVE-2018-0658

Input validation issue in EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version 3.5.23 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.11 version 2.3.17 and earlier...

Cross site scripting

Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module PG Multi-Payment Service for EC-CUBE EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version...

Input validation

Input validation issue in EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version 3.5.23 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.11 version 2.3.17 and earlier...

CVE-2018-0657

CVE-2018-0657 is a cross-site scripting vulnerability in the EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service). The issue affects: EC-CUBE Payment Module (2.12) up to version 3.5.23 and earlier; EC-CUBE Payment Module (2.11) up to version 2.3.17 and earlier; GMO-PG Payme...

CVE-2018-0658

Input validation issue in EC-CUBE Payment Module 2.12 version 3.5.23 and earlier, EC-CUBE Payment Module 2.11 version 2.3.17 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.12 version 3.5.23 and earlier, GMO-PG Payment Module PG Multi-Payment Service 2.11 version 2.3.17 and earlier...

CVE-2018-0658

CVE-2018-0658 concerns input validation bypass in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service). Affected: EC-CUBE Payment Module (2.12) up to version 3.5.23 and earlier; EC-CUBE Payment Module (2.11) up to 2.3.17 and earlier; GMO-PG Payment Module (PG Multi-Payment ...