PayPal plugs mobile site phishing risk
XSS bug purged
Agentless Backup is Not a Myth
PayPal has fixed a cross-site scripting problem on its mobile payments site that, left unaddressed, had the potential for misuse in phishing attacks.
The vulnerability, discovered by hacking and security site Security-Shell, also created a possible mechanism for hackers to redirect surfers from mobile.paypal.com onto untrusted sites.
In a statement issued on Wednesday, PayPal said that it had plugged the website vulnerability.
We act very quickly whenever we discover any security issues and dealt with this issue within hours of finding out about it.
Cross-site scripting (XSS) vulnerabilities arise from web application development mistakes and mean that attackers can inject script or pop-ups from untrusted sites that would appear to surfers as originating from the site they are visiting. Cross-site scripting accounts for 51 per cent of all vulnerabilities uncovered by web application testing firm VeraCode, according to a recent survey. ®
COMMENTS
"We act very quickly whenever ..."
They sure do, especially when it comes to embezzling funds destined for their merchants - remember Cryptome?
PayPal collector and vendor of private information - one outfit to avoid at all costs, especially if you are a merchant who needs your collections paid over quickly to survive in these hard economic times.
new xss and redirect ( live poc )
http://security-sh3ll.blogspot.com/2010/10/paypal-xss-vulnerability.html
still vulnerable
what about another xss & redirect ? paypal site is still vulnerable
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
