1050 matches found
CVE-2017-15293
CVE-2017-15293 concerns the Xpress Server in SAP POS . The connected sources describe a lack of authentication for multiple operations: file read/erase, daemon shutdown, terminal read , and certain credential-related attacks. The root cause is the server’s failure to enforce authentication, enabl...
CVE-2017-15295
CVE-2017-15295 concerns the SAP Point of Sale Xpress Server, where the Xpress Server in SAP POS does not require authentication for read/write/delete file access. The vulnerability stems from a missing authentication check in Xpress Server, enabling potential unauthorized access to files. Documen...
CVE-2017-15295
Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064...
Amazon's Whole Foods Market Suffers Credit Card Breach In Some Stores
Another day, another data breach. This time Amazon-owned grocery chain has fallen victim to a credit card security breach. Whole Foods Market—acquired by Amazon for $13.7 billion in late August—disclosed Thursday that hackers were able to gain unauthorized access to credit card information for it...
A week in security (September 11 – September 17)
Last week, we dug into phishing campaigns done via Linkedin accounts, remediation versus prevention, issues with smart syringe pumps, and advised you to go patch against a Word 0day. We had some tips regarding identity theft protection, explored crowdsourced fraud, and explained YARA rules...
4,000 ElasticSearch servers found hosting PoS malware
By Waqas Kromtech’s security researchers have identified two point-of-sale POS malware strains This is a post from HackRead.com Read the original post: 4,000 ElasticSearch servers found hosting PoS malware...
Thousands of Elasticsearch Servers Hijacked to Host PoS Malware
Thousands of insecure Elasticsearch servers are hosting point-of-sale malware, according to an analysis by Kromtech Security Center. In total, researchers found 15,000 insecure Elasticsearch servers with 27 percent 4,000 hosting the PoS malware strains Alina and JackPoS. “The absence of...
Oracle MICROS POS missing authorisation check
Application: Oracle MICROS POS Versions Affected: Oracle Hospitality Simphony 2.7-2.9 Vendor URL: Oracle Bug: Missing Authentication for Critical Function Reported: 21.07.2017 Vendor response: 22.07.2017 Date of Public Advisory: 17.01.2018 Reference: Oracle CPU January 2018 Author: Dmitry Chastuh...
New Point-of-Sale Malware LockPoS Hitches Ride with FlokiBot
Botnets distributing FlokiBot point-of-sale malware have awoken from months of slumber and are back in business spewing a new malware dubbed LockPoS. Researchers say the malware is still flying under the radar of many antivirus and intrusion detection systems because it’s so new. Currently, LockP...
SAP Patches High-Risk Flaws in SAP POS, Host Agent
SAP fixed 23 vulnerabilities across roughly a dozen products on Tuesday, including a series of high-risk flaws that could allow an attacker to gain access to SAP POS, the company’s client/server point-of-sale PoS solution. The issues in SAP POS, a series of missing authorization checks, could let...
July 12, 2017 – Morning Cyber Coffee Headlines – “Henry David Thoreau” Edition
Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 12, 2017 - Headlines Carbon Black in the News: Closing Bell July 11, 2017 ...
Behind the CARBANAK Backdoor
In this blog, we will take a closer look at the powerful, versatile backdoor known as CARBANAK aka Anunak. Specifically, we will focus on the operational details of its use over the past few years, including its configuration, the minor variations observed from sample to sample, and its evolution...
Behind the CARBANAK Backdoor
In this blog, we will take a closer look at the powerful, versatile backdoor known as CARBANAK aka Anunak. Specifically, we will focus on the operational details of its use over the past few years, including its configuration, the minor variations observed from sample to sample, and its evolution...
SAP POS Missing Authentication in XpressServer
Application: SAP POS Xpress Server Vendor URL: SAP Bug: Missing Authentication Check Reported: 15.05.2017 Vendor response: 16.05.2017 Date of Public Advisory: 11.07.2017 Reference: SAP Security Note 2520064 Author: Vladimir Egorov ERPScan VULNERABILITY INFORMATION Class: Missing Authentication...
The continuing threat of POS malware
Point-of-sale systems have seen numerous changes in recent years. From the shift to chip-card readers and the inclusion of new technology for contactless mobile payments, POS systems aren't just for swiping cards anymore. At the same time, two important factors haven't changed - the criticality o...
US Court Sentences Russian Lawmaker's Son to 27 Years in Jail for Hacking
The son of a prominent Russian lawmaker was sentenced on Friday by a US federal court to 27 years in prison after being convicted of stealing millions of US credit card numbers and causing some $170 million in damages to businesses and individuals. This sentence is so far the longest sentence eve...
SAP POS Missing Authentication in XpressServer
Application: SAP POS Xpress Server Vendor URL: SAP Bugs: Missing Authentication Reported: 03.04.2017 Vendor response: 04.04.2017 Date of Public Advisory: 11.07.2017 Reference: SAP Security Note 2520064 Author: Dmitry Chastuhin ERPScan VULNERABILITY INFORMATION Class: Missing Authentication Check...
Multi Outlets POS 3.1 - id Parameter SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Point of Sales - Multi Outlets POS v3.1 Script - SQL Injection Google Dork: N/A Date: 08.02.2017 Vendor Homepage: http://prosoft-apps.com/ Software Buy: https://codecanyon.net/item/point-of-sales-multi-outlets-pos/17674742 Demo:...
Multi Outlets POS 3.1 - 'id' SQL Injection
Exploit Title: Point of Sales - Multi Outlets POS v3.1 Script - SQL Injection Google Dork: N/A Date: 08.02.2017 Vendor Homepage: http://prosoft-apps.com/ Software Buy: https://codecanyon.net/item/point-of-sales-multi-outlets-pos/17674742 Demo: http://pos.prosoft-apps.com/pos/ Version: N/A Tested...
