The vulnerability of the sub-component of the Dynamo Application Framework within the component of the Oracle Commerce Platform of the e-commerce platform Oracle Commerce allows a perpetrator to execute arbitrary code and gain full control over the application.

The vulnerability of the sub-component of the Dynamo Application Framework within the Oracle Commerce Platform of the e-commerce platform Oracle Commerce exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

nopCommerce Cross-Site Scripting Vulnerability (CNVD-2022-70103)

nopCommerce is an open source general-purpose e-commerce platform. nopCommerce version 4.50.1 is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied and output data in the "Text" parameter when creating a new post. An attacker...

GHSA-9WRV-G75H-8CCC Improper Access Control in Shopware

Shopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 1.500 community extensions. Permissions set to sales channel context by admin-api are still useable within normal user session. We recommend updating to the current...

Design/Logic Flaw

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security...

CVE-2022-24872 Improper Access Control in shopware

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security...

CVE-2022-24872

Shopware CVE-2022-24872 is an improper access‑control issue in the admin-api where permissions set to the sales channel context can be used within a normal user session. Affects Shopware platform (Symfony/Vue) across affected releases; remediation is to update to version 6.4.10.1. For 6.1–6.3, se...

Design/Logic Flaw

Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3...

CVE-2022-24871 Server-Side Request Forgery (SSRF) in Shopware

Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3...

The vulnerability of the sub-component of the Dynamo Application Framework within the component of the Oracle Commerce Platform of the e-commerce platform Oracle Commerce allows a perpetrator to gain access to data.

The vulnerability of the sub-component of the Dynamo Application Framework within the Oracle Commerce Platform, an e-commerce platform, exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to gain access to data by using specially crafted...

Sylius 信息泄露漏洞

Sylius is a set of open source e-commerce platform based on the Symfony framework from the Polish company Sylius. Sylius has an information disclosure vulnerability, and no details of the vulnerability are currently available...

Design/Logic Flaw

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgra...

CVE-2022-24744

CVE-2022-24744 – Shopware Affected: Shopware (open commerce platform based on Symfony and Vue) where, in affected versions, user sessions remain active after a password reset via the recovery flow. Root cause (as described in security docs): insufficient session expiration management allowing a u...

CVE-2022-24745

CVE-2022-24745 affects Shopware (Shopware platform) when HTTP caching is enabled. The issue allows guest sessions to be shared between customers due to improper handling of HTTP cache headers in affected versions (Varnish setups are not affected). Root cause is related to caching behavior that ex...

CVE-2022-24746

Shopware’s CVE-2022-24746 affects the voucher code form, enabling HTML/code injection due to insufficient input filtering. Root cause: vulnerable voucher code handling in Shopware core; impact is code injection via that form. A fix is available in version 6.4.8.1 (and advisories suggest newer 6.4...

CVE-2022-24746 HTML injection possibility in voucher code form

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue...

CVE-2022-24748

CVE-2022-24748 affects Shopware: before version 6.4.8.2, an improper API route check allows modifying customers and creating orders without App Permission. Root cause: inadequate authorization in API routing. Impact: unauthorized actions with no privileges; no exploitation details provided in the...

S-cart 路径遍历漏洞

S-cart, a Php-based e-commerce management platform from the S-cart community, suffers from a path traversal vulnerability that stems from the failure of a web-based system or product to properly filter special elements in the path of a resource or file. An attacker could exploit the vulnerability...

CVE-2022-21686 Server Side Twig Template Injection in PrestaShop

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds...

CVE-2022-21387

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce component: Dynamo Application Framework. Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2022-21387

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce component: Dynamo Application Framework. Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...