PT-2018-17806 · WordPress · Bookly

Name of the Vulnerable Software and Affected Versions: Bookly 1 WordPress Booking Plugin Lite versions prior to 14.5 Description: The issue concerns a cross-site scripting XSS flaw. It is triggered by a jQuery.ajax request to the ng-payment details dialog.js file. Recommendations: For Bookly 1...

PHPCMS backend has SQL injection vulnerability

PHPCMS is a web content management system based on PHP and Mysql architecture. The system includes modules such as news, pictures, downloads, information and products. A SQL injection vulnerability exists in the page phpcms/modules/pay/payment.php in the backend of PHPCMS, which can be exploited ...

Threat Outbreak Alert RuleID31922: Email Messages Distributing Malicious Software on February 6, 2018

Medium Alert ID: 56675 First Published: 2018 February 6 17:23 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31922 may contain the following files: Name |...

Boomerang spam bombs Malwarebytes forum—not a smart move

Tech support scammers are generally not the best and brightest. As such, they will occasionally post ads for their fake companies in the comment sections here or on the Malwarebytes forums. Last week, however, scammers struggled with configuring their spambots, resulting in spam bombs on the foru...

Scarab ransomware: new variant changes tactics

The Scarab ransomware was discovered in June 2017. Since then, several variants have been created and discovered in the wild. The most popular or widespread versions were distributed via the Necurs botnet and initially written in Visual C compiled. However, after unpacking, we've found that anoth...

Critical Oracle Micros POS Flaw Affects Over 300,000 Payment Systems

Oracle has released a security patch update to address a critical remotely exploitable vulnerability that affects its MICROS point-of-sale POS business solutions for the hospitality industry. The fix has been released as part of Oracle's January 2018 update that patches a total of 238 security...

Tor Proxy Used By Cybercriminals To Initiate Bitcoin Theft

By Waqas Tor proxy owners are replacing Bitcoin payment addresses to divert payments This is a post from HackRead.com Read the original post: Tor Proxy Used By Cybercriminals To Initiate Bitcoin Theft...

Sagepay - Critical - Access Bypass - SA-CONTRIB-2018-005

This module integrates the Sagepay payment service. Some of the URLs used while processing the payment are not sufficiently secured. This might allow attackers to resume a previously failed payment attempt or to view content that should only be shown after a succesful payment. This affects all...

HackerOne: While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal)

Description: As you know hackerone allows us to add payout method. On selecting paypal we are asked to add paypal email id. On saving new email id. A hackerone account holder i.e account from which payout method was changed gets a notification email saying that "The payout method was changed form...

X-Cart < 4.1.3 - Arbitrary Variable Overwrite Vulnerability

Exploit for php platform in category web applications X-Cart Arbitrary Variable Overwrite Vendor: Qualiteam Product: X-Cart Version: $value $$var = $value; As we can see every single post variable is dynamically evaluated. This is especially dangerous because register globals and magic q...

OnePlus confirms up to 40,000 customers affected by Credit Card Breach

OnePlus has finally confirmed that its online payment system was breached, following several complaints of fraudulent credit card transactions from its customers who made purchases on the company's official website. In a statement released today, Chinese smartphone manufacturer admitted that cred...

OnePlus Site’s Payment System Reportedly Hacked to Steal Credit Card Details

This year's first bad news for OnePlus users—a large number of OnePlus customers are reporting of fraudulent credit card transactions after buying products from the Chinese smartphone manufacturer's official online store. The claim initially surfaced on the OnePlus support forum over the weekend...

Interview with CTO Michael Viscuso – Ransomware: The Problem That Won’t Go Away

Editor's Note: This article originally appeared on BankInfoSecurity.com Click here to listen to the full podcast Dealing with ransomware is a lot like dealing with mosquitos: The best approach is to anticipate getting bit and take steps to try to fend off attacks. But the growth of ransomware int...

Website Glitch Let Me Overstock My Coinbase

Coinbase and Overstock.com just fixed a serious glitch that allowed Overstock customers to buy any item at a tiny fraction of the listed price. Potentially more punishing, the flaw let anyone paying with bitcoin reap many times the authorized bitcoin refund amount on any canceled Overstock orders...

Forever 21 Says PoS Systems Exposed Customer Data for 8 Months

Fashion retailer Forever 21 confirmed a breach made public in November resulted in the theft of credit card data belonging to an undisclosed number of customers. The company had stated that a lack of encryption used on some of its point-of-sales payment terminals could have resulted in unauthoriz...

4 Years After Target, the Little Guy is the Target

Dec. 18 marked the fourth anniversary of this site breaking the news about a breach at Target involving some 40 million customer credit and debit cards. It has been fascinating in the years since that epic intrusion to see how organized cyber thieves have shifted from targeting big box retailers ...

CVE-2015-7666

Multiple cross-site scripting XSS vulnerabilities in the 1 cpupdateMessageItem and 2 cpdeleteMessageItem functions in cppppadminintmessagelist.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal...

CVE-2015-7666: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the 1 cpupdateMessageItem and 2 cpdeleteMessageItem functions in cppppadminintmessagelist.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal...

PT-2017-7252

Name of the Vulnerable Software and Affected Versions Payment Form for PayPal Pro plugin versions prior to 1.0.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the cp ppp admin int message list.inc.php file. These vulnerabilities are located in the 1 cp...

New Spider Ransomware Comes With 96-Hour Deadline

A new ransomware strain called Spider is targeting victims located in the Balkans in what is called a “mid-scale” campaign. The Spider ransomware is unique in that attackers are given a 96-hour deadline to pay. Attackers also attempt to calm victims, assuring them the ransom payment and file...