PT-2018-13019

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce Enterprise versions V7 through V9 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a truste...

CVE-2018-1541: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Commerce Enterprise V7, V8, and V9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2018-1644: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8 could allow an authenticated user to obtain sensitive information about another user...

CVE-2017-1484: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attacker to obtain information such as user personal data. IBM X-Force ID: 128622...

CVE-2017-1398: URL Redirection to Untrusted Site

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to...

CVE-2017-1170: Undefined Security Weakness

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230...

PT-2016-3781

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce Enterprise versions 7.0.0.8 through 7.0.0.9 Description The issue concerns the Update Installer in IBM WebSphere Commerce Enterprise, which fails to properly replicate the search index. This allows attackers to obtain...

CVE-2015-7444: Exposure of Sensitive Information to an Unauthorized Actor

The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain sensitive information via unspecified vectors...

CVE-2015-5015: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Commerce Enterprise 7.0.0.9 and 8.x before Feature Pack 8 allows remote attackers to obtain sensitive information via a crafted REST URL...

PT-2013-2402

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce Enterprise versions 5.6.x through 5.6.1.5 IBM WebSphere Commerce Enterprise versions 6.0.x through 6.0.0.11 IBM WebSphere Commerce Enterprise versions 7.0.x through 7.0.0.7 Description The issue allows remote attackers t...

CVE-2013-0523: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Commerce Enterprise 5.6.x through 5.6.1.5, 6.0.x through 6.0.0.11, and 7.0.x through 7.0.0.7 does not use a suitable encryption algorithm for storefront web requests, which allows remote attackers to obtain sensitive information via a padding oracle attack that targets certain UTF-8...

CVE-2010-2639: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Commerce Enterprise 7.0 before 7.0.0.2 allows remote attackers to read messages intended for other recipients via vectors involving access by the outbound messaging system to the RunTimeProfileCacheCmdImpl class, related to the caching of mutable objects and "concurrency issues."...

PT-2010-4165

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce Enterprise version 7.0 before 7.0.0.2 Description The issue allows remote attackers to read messages intended for other recipients via vectors involving access by the outbound messaging system to the...