WP e-Commerce Shop Styling <= 2.5 - Local File Inclusion

The code in ./wp-ecommerce-shop-styling/includes/download.php does not sanitise user input to prevent sensitive system files from being downloaded. You'll have to rename the download file via mv -- -..-..-..-..-..-..-..-..-etc-passwd passwd as the filename is set to the download filename with pat...

WP e-Commerce Shop Styling <= 2.5 - Local File Inclusion

The code in ./wp-ecommerce-shop-styling/includes/download.php does not sanitise user input to prevent sensitive system files from being downloaded. You'll have to rename the download file via mv -- -..-..-..-..-..-..-..-..-etc-passwd passwd as the filename is set to the download filename with pat...

Ebay Magento Bug Bounty #14 - Persistent Vulnerability

Document Title: =============== Ebay Magento Bug Bounty 14 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1463 EIBBP-31602 Release Date: ============= 2015-06-30 Vulnerability Laboratory ID VL-ID:...

Crlf injection

CRLF injection vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 before 7.0.0.8 Cumulative iFix 2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2015-0196

CRLF injection vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 before 7.0.0.8 Cumulative iFix 2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2015-0196

CRLF injection vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 before 7.0.0.8 Cumulative iFix 2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2015-0196

CVE-2015-0196 affects IBM WebSphere Commerce 6.0–6.0.0.11 and 7.0 before 7.0.0.8. It is a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via a crafted URL. Identified impact is partial integrity exposure (headers) wit...

Hackers Exploit Zero-Day Magento Vulnerability to Steal Your Credit Cards

Hackers are increasingly exploiting an unknown flaw to siphon payment card information from e-commerce websites that use Magento, the most popular e-commerce platform owned by eBay. Security researchers at Sucuri are still investigating the attack vector, but they believe that cyber criminals are...

IBM WebSphere Commerce CRLF Injection Vulnerability

IBM WebSphere Commerce is a suite of e-business solutions from IBM in the United States. The solution supports all sales business models, including B2C, B2B and B2B2C, on a single customer interaction platform. A CRLF injection vulnerability exists in IBM WebSphere Commerce versions 6.0 through...

CVE-2015-4368

The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors...

Buffer overflow

The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors...

CVE-2015-4368

The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors...

CVE-2015-4368

CVE-2015-4368 affects the Drupal Commerce Ogone module (7.x-1.x) prior to 7.x-1.5. The vulnerability allows malicious users to bypass the payment step and complete the checkout without a payment being processed, via unspecified vectors described in the advisory and CVE records. The root cause is ...

Toshiba Commerce Solutions Retail Software Security Vulnerabilities

Toshiba last week patched a potentially serious vulnerability in its CHEC self-checkout software prevalent in retail locations, while it is still wrangling with another security issue in its point-of-sale offering. The vulnerabilities were reported in August 2014 by David Odell of FishNet Securit...

Toshiba 4690 OS contains an information disclosure vulnerability

Overview The Toshiba 4690 operating system, version 6 Release 3 and possibly earlier versions, contains an information disclosure vulnerability. Description CWE-200: Information Exposure - CVE-2014-4876The Toshiba 4690 operating system, version 6 Release 3 and possibly earlier versions, contains...

Novalnet Payment Module Drupal Commerce - Critical - SQL Injection - Unsupported - SA-CONTRIB-2015-117

This module enables you add the Novalnet payment service provider to Drupal Commerce. The module fails to sanitize a database query by not using the database API properly, thereby leading to a SQL Injection vulnerability. Since the affected path is not protected against CSRF, a malicious user can...

CVE-2015-0200

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x before 7.0.0.8 IF2 allows local users to obtain sensitive database information via unspecified vectors...

Information disclosure

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x before 7.0.0.8 IF2 allows local users to obtain sensitive database information via unspecified vectors...

CVE-2015-0200

Vulnerability CVE-2015-0200 affects IBM WebSphere Commerce 6.x (up to 6.0.0.11) and 7.x (before 7.0.0.8 IF2). It enables local users to obtain sensitive database information via unspecified vectors, with partial confidentiality impact (C/P). Details about root cause, exploit steps, or available m...

CVE-2015-0200

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x before 7.0.0.8 IF2 allows local users to obtain sensitive database information via unspecified vectors...