Pacific Software Carello 1.2.1 Shopping Cart - Command Execution

source: https://www.securityfocus.com/bid/2729/info It is possible for a remote user to execute arbitrary commands on a host using Carello Shopping Cart software. A specially crafted HTTP request could cause inetinfo.exe to consume all available system resources, refusing any new connections. If...

CVE-1999-0608

The CVE concerns the PDG Shopping Cart CGI program “shopper.cgi,” where an incorrect configuration can disclose private information. In the provided documents, the affected component is the shopper.cgi CGI script; vulnerability cause is misconfiguration leading to partial confidentiality impact. ...

CVE-1999-0608

An incorrect configuration of the PDG Shopping Cart CGI program "shopper.cgi" could disclose private information...

CVE-1999-0608: Undefined Security Weakness

An incorrect configuration of the PDG Shopping Cart CGI program "shopper.cgi" could disclose private information...

CVE-2000-0252

The CVE-2000-0252 entry concerns the Dansie Shopping Cart (cart.pl/cart.cgi). An input in a form variable allows remote command execution through shell metacharacters, due to insufficient input sanitization. This yields the potential for arbitrary commands to be run on affected systems. Public re...

CVE-2000-0253

CVE-2000-0253 affects the Dansie Shopping Cart, specifically the cart.pl component, where remote attackers can modify sensitive purchase information through hidden form fields. The CVSSv2 vector (AV:N/AC:L/Au:N/C:C/I:C/A:C) yields a base score of 10.0 (HIGH), indicating complete confidentiality, ...

CVE-2000-0254

The CVE-2000-0254 entry concerns the Dansie Shopping Cart. The connected Nessus plugin notes that the script /cart/cart.cgi is present and, if the Dansie Shopping Cart is older than version 3.0.8, it very likely contains a backdoor that allows arbitrary command execution on the remote host. The C...

CVE-2000-0252

The dansie shopping cart application cart.pl allows remote attackers to execute commands via a shell metacharacters in a form variable...

CVE-2000-0253

The dansie shopping cart application cart.pl allows remote attackers to modify sensitive purchase information via hidden form fields...

CVE-2000-0254

The dansie shopping cart application cart.pl allows remote attackers to obtain the shopping cart database and configuration information via a URL that references either the env, db, or vars form variables...

CVE-2000-0921

Directory traversal vulnerability in Hassan Consulting shop.cgi shopping cart program allows remote attackers to read arbitrary files via a .. dot dot attack on the page parameter...

CVE-2000-0922

Directory traversal vulnerability in Bytes Interactive Web Shopper shopping cart program shopper.cgi 2.0 and earlier allows remote attackers to read arbitrary files via a .. dot dot attack on the newpage parameter...

CVE-2000-0925

The CVE-2000-0925 entry concerns SmartWin CyberOffice Shopping Cart 2 (CyberShop). The available documents state that the default installation creates a _private directory with world-readable permissions, which allows remote attackers to obtain sensitive information. No further technical specific...

CVE-2000-0926

The CVE-2000-0926 entry concerns SmartWin CyberOffice Shopping Cart 2 (CyberShop). Vulnerability: remote attackers can modify price information by altering the hidden Price form variable. Affected component: the shopping cart/web interface that processes the Price field. Impact: data integrity co...

CVE-2000-0252: Undefined Security Weakness

The dansie shopping cart application cart.pl allows remote attackers to execute commands via a shell metacharacters in a form variable...

CVE-2000-0254: Undefined Security Weakness

The dansie shopping cart application cart.pl allows remote attackers to obtain the shopping cart database and configuration information via a URL that references either the env, db, or vars form variables...

CVE-2000-0253: Undefined Security Weakness

The dansie shopping cart application cart.pl allows remote attackers to modify sensitive purchase information via hidden form fields...

CVE-2000-1243

Privacy leak in Dansie Shopping Cart 3.04, and probably earlier versions, sends sensitive information such as user credentials to an e-mail address controlled by the product developers...

CVE-2000-1243: Undefined Security Weakness

Privacy leak in Dansie Shopping Cart 3.04, and probably earlier versions, sends sensitive information such as user credentials to an e-mail address controlled by the product developers...

CVE-2000-0921

Directory traversal vulnerability in Hassan Consulting shop.cgi shopping cart program allows remote attackers to read arbitrary files via a .. dot dot attack on the page parameter...