CVE-2004-0681

CVE-2004-0681 involves multiple cross-site scripting (XSS) vulnerabilities in Comersus Cart 5.09. The affected pages are comersus_customerAuthenticateForm.asp, comersus_backoffice_message.asp, comersus_supportError.asp, and comersus_message.asp. The underlying issue is non-sanitized input in the ...

CVE-2004-0675

CVE-2004-0675 is a cross-site scripting (XSS) vulnerability in Cart32 shopping cart components cart32.exe and c32web.exe. The flaw allows an attacker to inject arbitrary script via the cart32 parameter to the GetLatestBuilds command, with CVSS v2 base score 6.8 (network, medium complexity, no pri...

Comersus Cart Improper Request Handling

Comersus Cart Improper Request Handling Release Date: July 6, 2004 Severity: Medium Vendor: Comersus Open Technologies Software: Tested on Comersus Cart 5.09 Previous versions may also be affected. Remote: Remotely executed from any web browser Technical Details: The unethical user is able to...

Comersus Cart Cross-Site Scripting Vulnerability

Comersus Cart Cross-Site Scripting Vulnerability Release Date: July 6, 2004 Severity: High Vendor: Comersus Open Technologies Software: Tested on Comersus Cart 5.09 Previous versions may also be affected. Remote: Remotely executed from any web browser Technical Details: The malicious user is able...

Comersus Open Technologies Comersus 5.0 - 'comersus_gatewayPayPal.asp' Price Manipulation

source: https://www.securityfocus.com/bid/10674/info Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate parameters to change the price of an order. Comersus Cart version 5.09 is affected by...

Comersus Open Technologies Comersus 5.0 - comersus_gatewayPayPal.asp Price Manipulation

Comersus Open Technologies Comersus 5.0 - comersusgatewayPayPal.asp Price Manipulation source: https://www.securityfocus.com/bid/10674/info Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulat...

Comersus Open Technologies Comersus 5.0 - comersus_message.asp Cross-Site Scripting

Comersus Open Technologies Comersus 5.0 - comersusmessage.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/10674/info Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate...

Comersus Open Technologies Comersus 5.0 - 'comersus_message.asp' Cross-Site Scripting

source: https://www.securityfocus.com/bid/10674/info Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate parameters to change the price of an order. Comersus Cart version 5.09 is affected by...

vpasp5x.txt

VP-ASP Shopping Cart Multiple Vulnerabilities Release Date: June 14, 2004 Severity: High Vendor: Virtual Programming Software: VP-ASP Shopping Cart Version 5.x Remote: Remotely executable Vulnerabilities: Cross Site Scripting SQL Injection Technical Details: Cross Site Scripting Vulnerability was...

[Full-Disclosure] VP-ASP Shopping Cart Multiple Vulnerabilities

VP-ASP Shopping Cart Multiple Vulnerabilities Release Date: June 14, 2004 Severity: High Vendor: Virtual Programming Software: VP-ASP Shopping Cart Version 5.x Remote: Remotely executable Vulnerabilities: Cross Site Scripting SQL Injection Technical Details: Cross Site Scripting Vulnerability was...

Zen Cart login.php SQL Injection Vulnerability

Overview: "Zen Cart™ truly is the art of e-commerce; a free, user-friendly, open source shopping cart system." Description: An input validation vulnerability has been reported in Zen Cart, allowing a remote user to inject SQL commands. The '/admin/login.php' file does not properly validate...

A-CART Pro & A-CART 2.0 Input Validation Holes

Title: A-CART Pro & A-CART 2.0 Input Validation Holes Software: A-CART Pro & A-CART 2.0 Vendor: http://www.alanward.net Underlying OS: Windows. Description: A-CART is an ASP shopping cart application written in VBScript. The system allows a customer to browse through an inventory of products and...

CVE-2004-1874

Multiple cross-site scripting XSS vulnerabilities in 1 deliver.asp and 2 billing.asp in A-CART Pro and A-CART 2.0 allow remote attackers to inject arbitrary web script or HTML via the user information forms...

acartSQL.txt

Title: A-CART Pro & A-CART 2.0 Input Validation Holes Software: A-CART Pro & A-CART 2.0 Vendor: http://www.alanward.net Underlying OS: Windows. Description: A-CART is an ASP shopping cart application written in VBScript. The system allows a customer to browse through an inventory of products and...

CVE-2004-0240

Directory traversal vulnerability in X-Cart 3.4.3 allows remote attackers to view arbitrary files via a .. dot dot in the shopclosedfile argument to auth.php...

CVE-2004-0242

X-Cart 3.4.3 is affected by CVE-2004-0242. An attacker can remotely read sensitive information by supplying a mode parameter that triggers phpinfo or perlinfo commands. The vulnerability enables information disclosure in the affected product via the web interface; no exploitation or mitigations a...

CVE-2004-0350

The CVE-2004-0350 entry affects the SpiderSales shopping cart, which does not enforce a minimum length for the private key. This weakens key material quality and can let local users obtain the private key by factoring, with an in‑the‑wild risk limited by local access and a low base score (2.1). T...

CVE-2004-0240

CVE-2004-0240 describes a directory traversal vulnerability in X-Cart 3.4.3 where remote attackers can view arbitrary files by supplying a ".." sequence in the shop_closed_file parameter to auth.php . The root cause is insufficient input validation on the parameter leading to path traversal. The ...

CVE-2004-0241

X-Cart 3.4.3 allows remote attackers to execute arbitrary commands via the perlbinary argument in 1 upgrade.php or 2 general.php...

CVE-2004-0348

CVE-2004-0348 pertains to SpiderSales Shopping Cart software, affecting the viewCart.asp component. The root cause is an SQL injection via the userId parameter, enabling a remote attacker to execute arbitrary SQL statements with full impact on confidentiality, integrity, and availability (CVSS v2...