U.S. DoJ Indicts North Korean Hacker for Ransomware Attacks on Hospitals

The U.S. Department of Justice DoJ on Thursday unsealed an indictment against a North Korean military intelligence operative for allegedly carrying out ransomware attacks against healthcare facilities in the country and funneling the payments to orchestrate additional intrusions into defense,...

CVE-2024-6175

The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the multiple functions called via AJAX like savefieldssettings, bupdeleteuseravatar, bupcropavataruserprofileimage, and more in a...

PT-2024-37434 · WordPress · Booking Ultra Pro Appointments Booking Calendar Plugin

Name of the Vulnerable Software and Affected Versions: The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress versions up to, and including, 1.1.13 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify and delete multiple...

WordPress Viva Payments plugin <= 1.2 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Viva Payments versions = 1.2...

WordPress Viva Payments Plugin <= 1.2 is vulnerable to Backdoor

Software Viva Payments Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 655c4e982e2a Credits Sansec.io Required privilege Unauthenticated Published 3 July, 2024...

CVE-2024-34694 LNbits improperly handles potential network and payment failures when using Eclair backend

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout about 30s lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. Th...

CVE-2024-34694 LNbits improperly handles potential network and payment failures when using Eclair backend

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout about 30s lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. Th...

PT-2024-26111

Name of the Vulnerable Software and Affected Versions LNbits versions prior to 0.12.6 Description Paying invoices in Eclair that do not get settled within the internal timeout about 30s can lead to a payment being considered failed, even though it may still be in flight. This issue can result in ...

Malicious code in icon-reactjs (npm)

This package is considered malicious because it contains code to spam Telegram channels and Whatsapp channels with fake payment confirmations...

CVE-2024-34691

Manage Incoming Payment Files F1680 of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availability of the system...

CVE-2024-1175

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deletepayment' function in all versions up to, and including, 16.26.6. This makes it possible for unauthenticated attackers to delete...

CVE-2024-1175

CVE-2024-1175 affects WP-Recall – Registration, Profile, Commerce & More for WordPress. Red Hat advisory RH:CVE-2024-1175 confirms an unauthenticated data loss vulnerability caused by a missing capability check in the delete_payment function, exploitable on all versions up to 16.26.6. The vulnera...

CVE-2024-1175 WP-Recall – Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_payment

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deletepayment' function in all versions up to, and including, 16.26.6. This makes it possible for unauthenticated attackers to delete...

PT-2024-17229 · WordPress · Wp-Recall

Name of the Vulnerable Software and Affected Versions: WP-Recall – Registration, Profile, Commerce & More plugin for WordPress versions up to, and including, 16.26.6 Description: The issue is related to unauthorized loss of data due to a missing capability check on the delete payment function. Th...

CVE-2023-48285

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This issue affects Stripe Payments: from n/a through 2.0.79...

CVE-2023-48285 WordPress Accept Stripe Payments plugin <= 2.0.79 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This issue affects Stripe Payments: from n/a through 2.0.79...

CVE-2023-48285 WordPress Accept Stripe Payments plugin <= 2.0.79 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This issue affects Stripe Payments: from n/a through 2.0.79...

PT-2024-40115 · Sylius · Sylius

Name of the Vulnerable Software and Affected Versions: Sylius versions 1.0.0 through 1.0.16 Sylius versions 1.1.0 through 1.1.8 Sylius versions 1.2.0 through 1.2.1 Description: The issue affects certain actions in the admin panel that did not require a CSRF token, including marking order's paymen...

PT-2024-40210 · Sylius · Sylius

Name of the Vulnerable Software and Affected Versions: Sylius versions 1.0.0 through 1.0.16 Sylius versions 1.1.0 through 1.1.8 Sylius versions 1.2.0 through 1.2.1 Description: The issue affects certain actions in the admin panel that did not require a CSRF token, including marking order's paymen...

CVE-2024-30527

Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout Accept PayPal Payments allows Manipulating Hidden Fields.This issue affects WP Express Checkout Accept PayPal Payments: from n/a through 2.3.7...