PayPal plugs mobile site phishing risk

PayPal has fixed a cross-site scripting problem on its mobile payments site that, left unaddressed, had the potential for misuse in phishing attacks.

The vulnerability, discovered by hacking and security site Security-Shell, also created a possible mechanism for hackers to redirect surfers from mobile.paypal.com onto untrusted sites.

In a statement issued on Wednesday, PayPal said that it had plugged the website vulnerability.

We act very quickly whenever we discover any security issues and dealt with this issue within hours of finding out about it.

Cross-site scripting (XSS) vulnerabilities arise from web application development mistakes and mean that attackers can inject script or pop-ups from untrusted sites that would appear to surfers as originating from the site they are visiting. Cross-site scripting accounts for 51 per cent of all vulnerabilities uncovered by web application testing firm VeraCode, according to a recent survey.

Source: Theregister

• Google, Meta, Apple receive FCC approval to tap into airwaves for VR and AR
• State-sponsored hackers are leveraging WinRAR bug
• Amazon launches drug delivery by drone
• Unpatched Zero-Day being exploited in the wild, Cisco warns
• Apple plans to update iPhones in-store without opening the boxes
• Microsoft just bought Activision Blizzard for $69 billion