CVE-2009-4771

The CVE-2009-4771 issue affects the Drupal Ubercart PayPal Website Payments Standard integration. Specifically, Ubercart 5.x prior to 5.x-1.9 and 6.x prior to 6.x-2.1 do not properly validate orders, which can allow remote attackers to trigger unspecified “duplicate actions” via unknown vectors. ...

CVE-2009-4772

The CVE-2009-4772 entry concerns a vulnerability in Drupal’s Ubercart PayPal Website Payments Standard integration. Affected are Ubercart 5.x (before 5.x-1.9) and 6.x (before 6.x-2.1) when a custom checkout completion message is enabled. The flaw is described as an unspecified vulnerability that ...

CVE-2009-4771: Improper Input Validation

The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors...

CVE-2009-4772: Undefined Security Weakness

Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal, when a custom checkout completion message is enabled, allows attackers to obtain sensitive information via unknown vectors...

Unfixed XSS vulnerability at secure.schedulepayments.net

Security researcher Xylitol, has submitted on 02/06/2010 a cross-site-scripting XSS vulnerability affecting secure.schedulepayments.net, which at the time of submission ranked 14034960 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/07/2010...

Inside the Pay-Per-Install Malware Economy

Stevens provides considerable details on the methods and tools used by cyber-criminals, the seedboxes and crypters that are used to get around anti-malware detection and the clever black hat SEO Search Engine Optimization techniques used in social engineering attacks. An example of one affiliate...

Sql injection

Multiple SQL injection vulnerabilities in Qsoft K-Rate Premium allow remote attackers to execute arbitrary SQL commands via 1 the $id variable in admin/includes/delecpac.php, 2 $ordorderid variable in payments/paymentreceived.php, 3 $id variable in includes/functions.php, and 4 unspecified...

CVE-2008-7097: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Qsoft K-Rate Premium allow remote attackers to execute arbitrary SQL commands via 1 the $id variable in admin/includes/delecpac.php, 2 $ordorderid variable in payments/paymentreceived.php, 3 $id variable in includes/functions.php, and 4 unspecified...

New Security Standards for Mobile Payments Coming

From SC Magazine Angela Moscaritolo A financial services technology group is developing standards for making secure mobile payment transactions. The goal of the project, an effort of the Financial Services Technology Consortium FSTC, is to develop standards and processes so that banking customers...

K-Rate (SQL/XSS) Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ================================================ K-Rate SQL/XSS Multiple Remote Vulnerabilities ================================================ ================================================================================ || K-Rate...

ashop-sql.txt

usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; use Getopt::Long; use URI::Escape; -------------------------------------------------------------------------------------------------------------------------------------------------------- x AShop Deluxe 4.x Remote SQL inJection Exploit x Ditemuk...

AShop Deluxe 4.x (catalogue.php cat) Remote SQL Injection Exploit

No description provided by source. usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; use Getopt::Long; use URI::Escape; -------------------------------------------------------------------------------------------------------------------------------------------------------- x AShop Deluxe 4.x...

AShop Deluxe 4.x (catalogue.php cat) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================= AShop Deluxe 4.x catalogue.php cat Remote SQL Injection Exploit ================================================================= usr/bin/perl use LWP::UserAgent; use...

PHP Classifieds 6.20 - Multiple Cross-Site Scripting Authentication Bypass Vulnerabilities

PHP Classifieds 6.20 - Multiple Cross-Site Scripting Authentication Bypass Vulnerabilities source: https://www.securityfocus.com/bid/28521/info PHP Classifieds is prone to multiple cross-site scripting vulnerabilities and an authentication-bypass vulnerability. An attacker may leverage these issu...

CVE-2007-5364: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in payments/idealprocess.php in the iDEAL transaction handler in ViArt Shopping Cart allows remote attackers to have an unknown impact via directory traversal sequences in the filename parameter to the createCertFingerprint function. NOTE: this issue is disputed ...

Viart Shopping Cart Directory Transversal Vuln

Aria-Security Team ---------------------- Viart Shopping Cart Directory Transversal Vuln Vendor: http://www.viart.com/ POC: function createCertFingerprint$filename $fp = fopen$filename, "r"; http://target/path/payments/idealprocess.php Credits Goes To Aria-Security Team Thanks To Aura Regards,...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 have unknown impact and attack vectors, related to 1 APPS04, 2 APPS05, and 3 APPS06 in a Oracle Application Object Library, 4 APPS07 in Oracle Customer Intelligence, 5 APPS08 in Oracle Payments, 7 APPS10 in Oracle Human...

CVE-2007-3867

Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 have unknown impact and attack vectors, related to 1 APPS04, 2 APPS05, and 3 APPS06 in a Oracle Application Object Library, 4 APPS07 in Oracle Customer Intelligence, 5 APPS08 in Oracle Payments, 7 APPS10 in Oracle Human...

CVE-2007-3867

Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 have unknown impact and attack vectors, related to 1 APPS04, 2 APPS05, and 3 APPS06 in a Oracle Application Object Library, 4 APPS07 in Oracle Customer Intelligence, 5 APPS08 in Oracle Payments, 7 APPS10 in Oracle Human...

CVE-2007-3867: Undefined Security Weakness

Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 have unknown impact and attack vectors, related to 1 APPS04, 2 APPS05, and 3 APPS06 in a Oracle Application Object Library, 4 APPS07 in Oracle Customer Intelligence, 5 APPS08 in Oracle Payments, 7 APPS10 in Oracle Human...