Cross-Site Request Forgery (CSRF) in opensourcepos/opensourcepos

Description Attacker able to delete supplier with CSRF attack Proof of Concept //PoC.html history.pushState'', '', '/'...

FIN7 Hackers Using Windows 11 Themed Documents to Drop Javascript Backdoor

A recent wave of spear-phishing campaigns leveraged weaponized Windows 11 Alpha-themed Word documents with Visual Basic macros to drop malicious payloads, including a JavaScript implant, against a point-of-sale PoS service provider located in the U.S. The attacks, which are believed to have taken...

Researchers Uncover FIN8's New Backdoor Targeting Financial Institutions

A financially motivated threat actor notorious for setting its sights on retail, hospitality, and entertainment industries has been observed deploying a completely new backdoor on infected systems, indicating the operators are continuously retooling their malware arsenal to avoid detection and st...

Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr

✍️ Description In Bank section the POS part, you don't protect resources from delete with CSRF attacks and then I able to delete/close arbitrary POS cash desk control entities only with knowing their ids. 🕵️‍♂️ Proof of Concept // PoC.html history.pushState'', '', '/' 💥 Impact This vulnerability is...

Oracle Hospitality Reporting and Analytics has an unspecified vulnerability (CNVD-2021-56433)

Oracle Hospitality Reporting and Analytics is a web-based application that centralizes point-of-sale POS data, provides operational and analytical insight into business operations, and improves efficiency by delivering information to all roles within the organization. and Analytics version 9.1.0...

NFC Flaws in POS Devices and ATMs

Its a series of vulnerabilities: Josep Rodriguez, a researcher and consultant at security firm IOActive, has spent the last year digging up and reporting vulnerabilities in the so-called near-field communications reader chips used in millions of ATMs and point-of-sale systems worldwide. NFC syste...

FIN7 ‘Pen Tester’ Headed to Jail Amid $1B in Losses

A so-called “pen-tester” for the financial cybergang known as FIN7 will spend seven years in the slammer after being convicted for payment-card theft. According to the Department of Justice, Andrii Kolpakov, a Ukrainian national, was also ordered to pay a tidy $2.5 million in restitution for his...

IT threat evolution Q1 2021. Non-mobile statistics

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data. Quarterly figures According to Kaspersky Security Network, in Q1 2021: Kaspersky solutions blocked 2,023,556,082 attacks launched from online resources across the...

XSS vulnerability in cyberbiz website builder system

Cyberbiz is to provide a one-stop new retail solution, from the official website rack station, intelligent POS system, to the intelligent warehouse, which can be strung together with multiple gold logistics and so on. There is an XSS vulnerability in the cyberbiz website builder system, which can...

CVE-2021-30170

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

Cross site scripting

Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

Cross site scripting

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2021-30170

CVE-2021-30170 affects Jun-He (ERP POS) customer profile page. The vulnerability is a stored XSS flaw caused by special characters in user input not being filtered, enabling remote authenticated attackers to inject malicious JavaScript and access/manipulate customer information. The available sou...

CVE-2021-30171 Jun-He Technology Ltd. ERP POS - Stored XSS-2

Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2021-30171

CVE-2021-30171 affects Jun-He Technology / Junghwa ERP POS: special characters on the ERP POS news page are not filtered, allowing remote authenticated attackers to inject JavaScript and perform stored XSS, with potential access to and manipulation of customer information. Root cause: unfiltered ...

CVE-2021-29250

BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting XSS vulnerability within the POS Add Products functionality. This enables cookie stealing...

Cross site scripting

BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting XSS vulnerability within the POS Add Products functionality. This enables cookie stealing...

CVE-2021-29250

BTCPay Server (product: BTCPay Server)

BTCPay Server 跨站脚本漏洞

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A stored cross-site scripting vulnerability exists in the "POS Add Products" feature in BTCPay Server 1.0.7.0 and earlier versions. An attacker could exploit this vulnerability...

File Upload Vulnerability in Zhongke Yunlian ERP System

Ltd. is a limited company with CloudLink POS-ERP management system and FoodMaker restaurant management system as its main business. A file upload vulnerability exists in Zhongke Yunlian ERP system, which can be exploited by attackers to gain control of the server...