CVE-2019-0308

An authenticated attacker in SAP E-Commerce Business-to-Consumer application, versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even...

CVE-2019-0308

SAP E-Commerce (Business-to-Consumer) vulnerable in versions 7.3, 7.31, 7.32, 7.33, and 7.54 due to an HTML injection that executes during user login. This allows an authenticated attacker to alter product prices to zero and perform checkout, revealing a Code Injection risk. Root cause is imprope...

PT-2019-11226

Name of the Vulnerable Software and Affected Versions: SAP E-Commerce Business-to-Consumer application versions 7.3, 7.31, 7.32, 7.33, 7.54 Description: The issue allows an authenticated attacker to inject HTML code into the application, which will be executed when the victim logs in, potentially...

CVE-2019-0308: Improper Neutralization of Input During Web Page Generation

An authenticated attacker in SAP E-Commerce Business-to-Consumer application, versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even...

SQL Injection Vulnerability in B2C_UQ Cloud Business System (CNVD-2019-18481)

UQ Cloud Business System B2C version is a compact e-commerce system, the platform is developed by PHP7.0+Mysql. B2CUQ Cloud Business System suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Skimmer acts as payment service provider via rogue iframe

Criminals continue to target online stores to steal payment details from unaware customers at a rapid pace. There are many different ways to go about it, from hacking the shopping site itself, to compromising its supply-chain. A number of online merchants externalize the payment process to a...

Cross site scripting

SAP E-Commerce Business-to-Consumer application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54...

CVE-2019-0298

SAP E-Commerce Business-to-Consumer application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54...

CVE-2019-0298

SAP E-Commerce Business-to-Consumer application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54...

CVE-2019-0298

SAP E-Commerce Business-to-Consumer application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54...

CVE-2019-0298

The CVE-2019-0298 entry affects SAP E-Commerce (B2C) with a vulnerability caused by insufficient encoding of user-controlled inputs, resulting in cross-site scripting (XSS). Affected components are SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, and SAP-SHRAPP, across versions 7.30, 7...

CVE-2019-0298: Improper Neutralization of Input During Web Page Generation

SAP E-Commerce Business-to-Consumer application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54...

PT-2019-11223

Name of the Vulnerable Software and Affected Versions: SAP E-Commerce Business-to-Consumer application versions prior to 7.30, 7.31, 7.32, 7.33, 7.54 are not explicitly mentioned, however, the fixed versions are mentioned, so we can infer the affected versions as: SAP E-Commerce...

Ongoing Attack Stealing Credit Cards From Over A Hundred Shopping Sites

Researchers from Chinese cybersecurity firm Qihoo 360's NetLab have revealed details of an ongoing credit card hacking campaign that is currently stealing payment card information of customers visiting more than 105 e-commerce websites. While monitoring a malicious domain,...

Command Execution Vulnerability in NiuShop B2C Single Merchant Mall System

NiuShop B2C single merchant mall system is a PHP open source e-commerce system designed and developed completely independently by Shanxi NiuKu Information Technology Co. NiuShop B2C Single Merchant Mall System suffers from a command execution vulnerability. An attacker can achieve remote code...

GitHub hosted Magecart skimmer used against hundreds of e-commerce sites

Every day, new e-commerce websites fall into the hands of one of the many Magecart skimmers. Unbeknownst to shoppers, criminals are harvesting their personal information, including payment details in the online equivalent of ATM card skimming. Most often the skimming code—written in JavaScript an...

Shopify Flaw Exposed Thousands of Merchants' Revenue, Traffic Numbers

A researcher has uncovered a high-severity vulnerability in an e-commerce software platform used by 800,000 different online merchants, which could have been abused to expose the traffic and revenue data for the stores. The platform is Shopify, which was found exposing store data dating back to...

In-Depth Analysis of JS Sniffers Uncovers New Families of Credit Card-Skimming Code

In a world that's growing increasingly digital, Magecart attacks have emerged as a key cybersecurity threat to e-commerce sites. Magecart, which is in the news a lot lately, is an umbrella term given to 12 different cyber criminal groups that are specialized in secretly implanting a special piece...

Critical Magento SQL Injection Vulnerability Discovered – Patch Your Sites

If your online e-commerce business is running over the Magento platform, you must pay attention to this information. Magento yesterday released new versions of its content management software to address a total of 37 newly-discovered security vulnerabilities. Owned by Adobe since mid-2018, Magent...

MyPillow and Amerisleep Targeted in Magecart Group Attacks

The Magecart threat group continues its offensive with two newly disclosed breaches targeting bedding retailers MyPillow and Amerisleep. The group attacked the two companies with online payment credit card skimming attacks, researchers with RiskIQ said on Wednesday. While MyPillow removed a skimm...