Government Takes Second Look at US Wassenaar Rules

In spite of self-congratulatory pats on the back from several corners of the security world, this week’s decision from the Commerce Department’s Bureau of Industry and Security BIS to rewrite the proposed U.S. implementation of the Wassenaar Arrangement rules was an expected outcome—albeit an...

WordPress Welcart E-Commerce Plugin - Multiple Vulnerabilities

This plugin is prone to a cross site request forgery and cross site scripting vulnerabilities. Solution Update the plugin...

WordPress Welcart E-Commerce Plugin <= 1.3.12 - Cross Site Scripting

This plugin is prone to a DOM cross site scripting vulnerability. Solution Update the plugin...

Stakeholders Argue Against Restrictive Wassennaar Proposal

The commenting period regarding the Wassenaar Arrangement expired on Monday but the echo chamber around the largely maligned proposal continues to reverberate. Several stakeholders implicated in the proposal added their voices to that chamber on Friday morning, urging the government to revise...

Unspecified Vulnerability in Oracle Commerce Platform Commerce Guided Search/Oracle Commerce Experience Manager Component (CNVD-2015-04921)

Oracle Commerce Platform is a suite of e-business solution platforms from Oracle Corporation, USA. Oracle Commerce Guided Search/Oracle Commerce Experience Manager is one of the components that supports dynamic searching and finding of relevant and desired items for customers in a web site. Oracl...

Unspecified Vulnerability in Oracle Commerce Platform Commerce Guided Search/Oracle Commerce Experience Manager Component (CNVD-2015-04920)

Oracle Commerce Platform is a suite of e-business solutions platform from Oracle Corporation. Oracle Commerce Guided Search/Oracle Commerce Experience Manager is one of the components that supports dynamic searching and finding relevant and desired items for customers in a Web site. Oracle Commer...

Google Calls Proposed U.S. Wassenaar Rules 'Not Feasible'

As the clock winds down on the comment period for the United States government’s proposed implementation of the Wassenaar Arrangement export controls for intrusion software, Google officials say that the rules would have a “significant negative impact” on security research. The Department of...

KLA10639 Multiple vulnerabilities in Oracle products

Multiple vulnerabilities were found in Oracle Supply Chain Products Suite, Oracle Database Server, Oracle Commerce Platform and Oracle Enterprise Manager. By exploiting this vulnerability malicious users can affect confidentiality, integrity and availability. This vulnerabilities can be exploited...

CVE-2015-2653

Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Content Acquisition System...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Content Acquisition System...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.0.2, 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to affect confidentiality via unknown vectors related to Content Acquisition System...

CVE-2015-2607

CVE-2015-2607 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager within Oracle Commerce Platform (versions 3.0.2, 3.1.1, 3.1.2, 11.0, 11.1). The vulnerability is an authentication bypass in Oracle Endeca Tools and Frameworks session generation: if an auth parameter is prov...

CVE-2015-2607

Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.0.2, 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to affect confidentiality via unknown vectors related to Content Acquisition System...

CVE-2015-2653

Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Content Acquisition System...

CVE-2015-2653

The CVE-2015-2653 entry applies to Oracle Commerce Guided Search / Oracle Commerce Experience Manager within Oracle Commerce Platform. Affected products include Oracle Commerce Platform versions 3.1.1, 3.1.2, 11.0, and 11.1, specifically via the Content Acquisition System (CAS) interface. The con...

Coalition of Security Companies Forms to Oppose Wassenaar Rules

A large group of security companies have formed a coalition to oppose the proposed rules from the Department of Commerce that would regulate the export of so-called intrusion software, a broad term that researchers and legal experts are concerned would limit security research and development. The...

Welcart e-Commerce < 1.4.18 - Multiple Vulnerabilities

The Welcart e-Commerce WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

WordPress WP e-Commerce Shop Styling Plugin Arbitrary File Download Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.WP e-Commerce Shop Styling is one of the plugin used to improve the style of WP e-commerce store templates. An...

WordPress E-Commerce Shop Styling Plugin 2.5 - Arbitrary File Download

E-Commerce Shop Styling plugin is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Upgrade the plugin...

WordPress Plugin WP E-Commerce Shop Styling 2.5 - Arbitrary File Download

Title: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-05 Download Site: https://wordpress.org/plugins/wp-ecommerce-shop-styling Vendor: https://profiles.wordpress.org/haet/ Vendor Notified: 2015-07-05, fixed...