ewire Payment Client 1.60/1.70 Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/25683/info ewire Payment Client is prone to a vulnerability that allows attackers to execute arbitrary shell commands because the software fails to sanitize user-supplied input. An attacker may leverage this issue to...

Crowdsourcing a Tool for Application Vulnerability Research

Pulling in security help on a project has traditionally meant either hiring more full-time help, or bringing in an outside consultant. Enterprises and vendors alike, however, are starting to really go outside the perimeter these days and are taking advantage of crowdsourcing. Given the paranoia i...

Emerging Threats and Going Beyond Compliance

I recently presented to a C-level gathering of retail finance executives about the industrys changing threat landscape and the emerging threats facing omni-channel sellers. The retail security environment has changed dramatically in the past few years. Not that long ago, retailers mostly worried...

Uzbey: Price Manipulation

Hey guys, I put this down as a 2nd bug as it may have been overlooked from the previous report and I figured it'd be easier to track a fix and add comments separately... When completing an order it looks like it may be possible to pay an arbitrary amount - what happens is a request is generated t...

WordPress SagePay Direct Payment Gateway Plugin <= 0.1.6.7 - Multiple XSS

Because of these vulnerabilities in pages/3DComplete.php, the attackers to inject arbitrary web script or HTML. Solution Update the plugin...

FBI, NYPD Form Financial Cybercrime Task Force

The FBI has formed a new cybercrime task force with the New York Police Department and the Metropolitan Transit Authority whose job will be to go after high-level financial cyber crimes, employing a model of interagency cooperation that the bureau and other federal law enforcement agencies have...

ecshop最新版本存储XSS至后台

简要描述： 存储XSS 直接打后台。对电商网站比较容易中 详细说明： 问题出现在用户充值页面，充值如果没有付款成功的话，后台查看充值记录位置调用的是act=check，此页面已经过滤 但是如果充值了并且完成付款，后台查看充值记录位置 变成act=edit 此页面没有过滤，所以导致问题发生。 user.php 1424行 / 变量初始化 / $surplus = array 'userid' = $userid, 'recid' = !empty$POST'recid' ? intval$POST'recid' : 0, 'processtype' =...

CUUMALL 注入 5-8

简要描述： 来了个新厂商。 挖一下把。 开放+封闭源代码 封闭源代码，普通用户使用加密后的代码，付费用户使用开放的源代码，使商城更安全 对于我这种屌丝只能用免费版 就是zend后的代码。 不过还是有几个文件没zend。 就只看这几个文件了。 详细说明： 第五处 kuaiqian/receivemall.php中 $dealTime=trim$REQUEST'dealTime'; //获取实际支付金额 ///单位为分 ///比方 2 ，代表0.02元 $payAmount=trim$REQUEST'payAmount'; //获取交易手续费 ///单位为分 ///比方 2 ，代表0.02元...

Threat Outbreak Alert RuleID10325: Email Messages Distributing Malicious Software on June 15, 2014

Medium Alert ID: 34620 First Published: 2014 June 16 17:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID10325 may contain the following files: Name | Siz...

Soraya Malware Packs Form Grabbing, Memory Scraping Functionality

Malware capable of infecting point-of-sale devices once was a novelty, but it’s quickly becoming more common. Researchers at Arbor Networks have unearthed a new strain of PoS malware called Soraya that can scrape memory and has the ability to intercept information sent from Web forms, a specialty...

Threat Outbreak Alert: Fake Payment Information Email Messages on May 29, 2014

Medium Alert ID: 34409 First Published: 2014 May 29 13:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product inquiry notification for the recipient. The text in the email message attempts to convince the recipient...

Threat Outbreak Alert: Fake Payment Details Email Messages on May 28, 2014

Medium Alert ID: 34404 First Published: 2014 May 29 13:13 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment details for the recipient. The email message attempts to convince the recipient to open the attachment and...

Threat Outbreak Alert: Fake Late Payment Notification Email Messages on May 28, 2014

Medium Alert ID: 34397 First Published: 2014 May 28 18:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a late payment notice for the recipient. The text in the email message attempts to convince the recipient to open...

Threat Outbreak Alert: Email Messages with Malicious Attachments on May 28, 2014

Medium Alert ID: 34390 First Published: 2014 May 28 16:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that contain an attachment relating to a purchase order payment for the recipient. The email message attempts to convince the recipient ...

Threat Outbreak Alert: Fake Invoice Payment Notice Email Messages on May 27, 2014

Medium Alert ID: 34355 First Published: 2014 May 27 13:33 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment slip notification for the recipient. The text in the email message attempts to convince the recipient to...

Threat Outbreak Alert: Fake Payment Confirmation Email Messages on May 22, 2014

Medium Alert ID: 34336 First Published: 2014 May 22 13:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment confirmation for the recipient. The text in the email message attempts to convince the recipient to open...

Chip and PIN EMV Protocol security vulnerabilities found

Chip-and-PIN payment cards are coming to the United States after a long head start as a standard card-present payment method in Europe and Asia. Already, retailer Target accelerated its plan to move its branded debit and credit cards to chip-and-PIN, also known as EMV Europay, MasterCard and Visa...

SA-CONTRIB-2014-056 - Commerce Moneris - Information Disclosure

Commerce Moneris is a payment module that integrates the Moneris payment system with Drupal Commerce. The module stores credit card data in a commerce order object unnecessarily for the purpose of passing the credit card information to the payment gateway. The credit card information is never...

Threat Outbreak Alert: Fake Financial Transaction Notification Email Messages on May 20, 2014

Medium Alert ID: 34308 First Published: 2014 May 20 18:35 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain an electronic payment invoice for the recipient. The text in the email message attempts to...

Threat Outbreak Alert: Fake Bank Account Payment Notification Email Messages on May 20, 2014

Medium Alert ID: 34301 First Published: 2014 May 20 16:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank payment invoice for the recipient. The text in the email message attempts to convince the recipient to open...