Server side request forgery (ssrf)

The Omni Commerce Connect API OCC of SAP Hybris Commerce, versions 6., is vulnerable to server-side request forgery SSRF attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC...

CVE-2018-2463

The Omni Commerce Connect API OCC of SAP Hybris Commerce, versions 6., is vulnerable to server-side request forgery SSRF attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC...

CVE-2018-2463

SAP Hybris Commerce OCC API (Omni Commerce Connect) in version 6.* is vulnerable to SSRF due to misconfiguration of the XML parser in the server-side implementation. The issue enables potential unauthorized operations by an attacker who can trigger SSRF requests from the OCC server; impact is des...

MagentoCore Card Skimmer Found on Mass Numbers of E-Commerce Sites

UPDATED A whopping 7,339 and counting individual e-commerce sites have been infested with the MagentoCore.net payment-card skimmer in the last six months, making the malicious script one of the most successful credit-card threats out there. The infections are part of a single effort, all tied bac...

CVE-2018-16157

waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart&a=save itemtotals parameter to zero, the entire cart is sold for free...

Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2018-057

This module enables you to build eCommerce websites and applications with Drupal. The module doesn't sufficiently check access for some of its entity types...

IBM WebSphere Commerce Information Disclosure Vulnerability (CNVD-2018-17090)

IBM WebSphere Commerce is a suite of e-business solutions from IBM in the United States. The solution supports all sales business models, including B2C, B2B and B2B2C, on a single customer interaction platform. An information disclosure vulnerability exists in IBM WebSphere Commerce. An attacker...

CVE-2018-1644

Technical details about CVE-2018-1644 (affected IBM WebSphere Commerce versions and remediation) are not publicly provided in the connected documents. Monitor for updates in trusted sources.

CVE-2018-1644

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8 could allow an authenticated user to obtain sensitive information about another user...

CVE-2018-1644

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8 could allow an authenticated user to obtain sensitive information about another user...

CVE-2018-1644

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8 could allow an authenticated user to obtain sensitive information about another user...

Design/Logic Flaw

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8 could allow an authenticated user to obtain sensitive information about another user...

Qibo B2B E-commerce System Stored Cross-site Scripting Vulnerability

Qibo B2B e-commerce system is based on PHP programs and Mysql database-based open source B2B industry portal e-commerce website builder . Qibo B2B e-commerce system stored cross-site scripting vulnerabilities. Attackers can insert malicious js code in the page to obtain user cookies and other...

SQL Injection Vulnerability in Zhejiang Instant E-commerce Co.

Ltd. is a website construction based on the integration of network marketing, bidding ranking, marketing hosting and other integrated e-commerce network marketing company. Ltd. building system there are SQL injection vulnerabilities, attackers can use the vulnerability to obtain sensitive...

Ticketmaster Breach: Just One Part of a Wide-Ranging Campaign

Ticketmaster’s announcement back on June 28 that it was the victim of a payment-card breach ‘turns out to be part of a much larger card-skimming campaign by the threat group Magecart. A whopping 800 e-commerce sites around the world have been targeted by the crooks so far, according to RiskIQ...

Commerce Custom Order Status - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-046

Commerce Custom Order Status provides forms for administrators to add, edit, and delete order statuses from the order settings screen. The module doesn't sufficiently sanitize the output of the status names. This vulnerability is mitigated by the fact that an attacker must have a role with the...

PayPal (Notify) - Bypass & Persistent Web Vulnerability

Document Title: =============== PayPal Notify - Bypass & Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1640 Video: http://www.vulnerability-lab.com/getcontent.php?id=1639 Release Date: ============= 2018-06-22 Vulnerability...

PayPal (Notify) - Bypass & Persistent Web Vulnerability

Document Title: =============== PayPal Notify - Bypass & Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1640 Video: http://www.vulnerability-lab.com/getcontent.php?id=1639 Release Date: ============= 2018-06-21 Vulnerability...

Magento Hackers Using Simple Evasion Trick to Reinfect Sites With Malware

Security researchers have been warning of a new trick that cybercriminals are leveraging to hide their malicious code designed to re-introduce the infection to steal confidential information from Magento based online e-commerce websites. So, if you have already cleaned up your hacked Magento...

Magento Products T1 - Bypass & Persistent Vulnerability

Document Title: =============== Magento Products T1 - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1919 Release Date: ============= 2018-06-20 Vulnerability Laboratory ID VL-ID: ==================================== 19...