CVE-2017-10414: Undefined Security Weakness

Vulnerability in the Oracle iStore component of Oracle E-Business Suite subcomponent: Checkout and Order Placement. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with...

Unspecified Vulnerability in Oracle E-Business Suite Oracle iStore Component (CNVD-2017-31054)

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. Oracle iStore is one of the ability to allow merchant...

UBUNTU-CVE-2017-15041

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git...

Lyst: Bypassing one-time checkout router page (revealing payment information)

Description: ======== When user submits for a checkout, the checkout router page /checkout-router/ID/ is accessible only once, which can be bypassed by crafting the checkout ID in cookie basketkey send to the page /new/checkout/order/. combining with brute-force attack, if the ID is valid a resul...

mercurial: command injection on clients through malicious ssh URLs

A shell command injection flaw related to the handling of "ssh" URLs has been discovered in Mercurial. This can be exploited to execute shell commands with the privileges of the user running the Mercurial client, for example, when performing a "checkout" or "update" action on a sub-repository...

subversion: Command injection through clients via malicious svn+ssh URLs

A shell command injection flaw related to the handling of "svn+ssh" URLs has been discovered in Subversion. An attacker could use this flaw to execute shell commands with the privileges of the user running the Subversion client, for example when performing a "checkout" or "update" action on a...

elektronik-kompendium.de XSS vulnerability

Vulnerable URL: https://www.elektronik-kompendium.de/shop/kasse/adressen Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 53560 VIP website status:| No Check elektronik-kompendium.de...

lagerhotel.skat.dk XSS vulnerability

Vulnerable URL: http://lagerhotel.skat.dk/checkout/shopbasketcheckout.aspx Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinat...

PT-2017-6671

Name of the Vulnerable Software and Affected Versions Wordpress Eshop plugin versions 6.3.11 and earlier Description The issue concerns the eshop checkout function in the Wordpress Eshop plugin, which fails to validate variables in the "eshopcart" HTTP cookie. This allows remote attackers to...

Micro Market Vendor Warns of Bankcard And Biometric Data Breach

Avanti Markets, which specializes in self-serve food kiosks typically located in company breakrooms, said an undisclosed number of its 1.5 million customers may have had their personal and bankcard data compromised along with stored biometric data. The company, based in Tukwila, WA, said on July ...

Snapchat: [spectacles.com] Bypassing quantity limit in orders

Hi Snapchat team, In the https://www.spectacles.com the quantity of orders has limited for spectacles is 6 and for accessories is 10 according to help support page. But it can easily be manipulated by editing the URL. Problem originates from limiting the quantity of the items is with just the UI...

Inflection: XSS at https://app.goodhire.com/member/GH.aspx

Unescaped input from a URL parameter in the checkout flow was being used as a JavaScript variable for determining what cart contents to render. By manipulating the URL parameter, the researcher was able to execute arbitrary JavaScript on the page...

WordPress WP Checkout Plugins - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugins WP Checkout - Arbitrary File Upload Google Dork: inurl:/wp-content/plugins/wp-checkout Date: 13 June 2017 Exploit Author: x0id Tested on: Windows 7 1 Search target with Google Dorking...

rawnitro.com XSS vulnerability

Vulnerable URL: http://www.rawnitro.com/checkout.php?name=elite-green-coffee"';-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6387177 VIP website status:| No Coordinated...

diabazoleproducts.com XSS vulnerability

Vulnerable URL: https://diabazoleproducts.com/checkout.php?prd-id="';-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

safeshop.co.nz XSS vulnerability

Vulnerable URL: https://www.safeshop.co.nz/ccdsydney/bookstore/checkout.php?CartId=b0ed80655419d4649c0a0c255d5e46da...

CVE-2017-8768

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

my.tomtop.com XSS vulnerability

Vulnerable URL: https://my.tomtop.com/checkout/order/tracking Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinated Disclosure...

tailor4less.com XSS vulnerability

Vulnerable URL: https://www.tailor4less.com/en/checkout/cart/x"/?action=crosssell=1sell=manjacketliningproduct=p829 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 68897 VIP website...

simplycombo.com XSS vulnerability

Vulnerable URL: https://www.simplycombo.com/checkout/?paymentsuccpage=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3Elandingpage=/my-contentname=Simply%20Combosubmitted=Y=https%3A//www.simplycombo.com/checkout/=buynowlastupsell=YESgateway=stripe=Y=Y=N Details: Description| Value ---|--- Patched:| No...