PT-2020-12488

Name of the Vulnerable Software and Affected Versions Shopizer versions prior to 2.11.0 Description The issue arises from inadequate validation of negative quantity when using API or Controller based versions, leading to incorrect shopping cart and order totals. This allows for the creation of a...

CVE-2020-2810

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: Shopping Cart. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore...

CVE-2020-2810: Undefined Security Weakness

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: Shopping Cart. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore...

PT-2020-2112

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite component: Shopping Cart versions 12.1.1 through 12.1.3 Oracle E-Business Suite component: Shopping Cart versions 12.2.3 through 12.2.9 Description The issue is related to inadequate access control in the Shopping Cart...

Node.js third-party modules: [express-cart] Wide CSRF in application

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report CSRF in...

Shopping Cart Component Oracle iStore Privilege Escalation

The vulnerability of the Shopping Cart component in the Oracle iStore system, which is used for creating, managing, and personalizing online stores, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete...

Cross site request forgery (csrf)

The downloadfromurl function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a request to download a cart...

CVE-2020-2582

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: Shopping Cart. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iStore...

CVE-2020-2582

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: Shopping Cart. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iStore...

Design/Logic Flaw

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: Shopping Cart. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iStore...

CVE-2020-2582

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: Shopping Cart. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iStore...

CVE-2020-2582

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: Shopping Cart. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iStore...

CVE-2020-2582: Undefined Security Weakness

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: Shopping Cart. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle iStore...

PT-2020-1455

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite component: Shopping Cart versions 12.1.1 through 12.1.3 Oracle E-Business Suite component: Shopping Cart versions 12.2.3 through 12.2.9 Description The issue is related to inadequate access control in the Shopping Cart...

Pairing Privacy and Security with Digital Identities in Retail

As today’s customer expectations for digital shopping continue to escalate, many online retailers are leveraging consumers’ unique digital identities to provide a seamless and secure account registration and login process. However, it’s important to recognize the security and privacy implications...

WordPress YITH WooCommerce Cart Messages plugin <=1.4.4 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Cart Messages plugin versions =1.4.4. Solution Update the WordPress YITH WooCommerce Cart Messages plugin to the latest available version at least 1.4.5...

WordPress YITH WooCommerce Recover Abandoned Cart plugin <=1.3.3 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Recover Abandoned Cart plugin versions =1.3.3. Solution Update the WordPress YITH WooCommerce Recover Abandoned Cart plugin to the latest available version at least 1.3....

CVE-2019-18608

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...

CVE-2019-18608: Undefined Security Weakness

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...

PT-2019-15534

Name of the Vulnerable Software and Affected Versions Cezerin version 0.33.0 Description The issue allows unauthorized modification of order information because internal attributes can be overwritten via conflicting names when processing order requests. A malicious customer can manipulate an orde...