CVE-2010-2636

Multiple cross-site scripting XSS vulnerabilities in sample store pages in IBM WebSphere Commerce 7.0 before 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...

Sql injection

SQL injection vulnerability in IBM WebSphere Commerce 6.0 before 6.0.0.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters to "Commerce Organization Admin Console JavaServer pages."...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in sample store pages in IBM WebSphere Commerce 7.0 before 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2010-2636

CVE-2010-2636 : Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Commerce 7.0 sample store pages prior to 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2010-2635

The CVE-2010-2635 vulnerability affects IBM WebSphere Commerce 6.0 prior to 6.0.0.10. It is a SQL injection flaw where remote authenticated users can cause arbitrary SQL execution via unspecified parameters to the Commerce Organization Admin Console JavaServer pages. Root cause: improper handling...

CVE-2009-2752

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...

CVE-2009-2751

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

Design/Logic Flaw

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

Information disclosure

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...

CVE-2009-2751

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

CVE-2009-2752

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...

Improper access control

The 1 Net.Commerce and 2 Net.Data components in IBM WebSphere Commerce Suite store sensitive information under the web root with insufficient access control, which allows remote attackers to discover passwords, and database and filesystem details, via direct requests for configuration files...

CVE-2009-2956

The 1 Net.Commerce and 2 Net.Data components in IBM WebSphere Commerce Suite store sensitive information under the web root with insufficient access control, which allows remote attackers to discover passwords, and database and filesystem details, via direct requests for configuration files...

CVE-2009-2094

Unspecified vulnerability in IBM WebSphere Commerce 6.0 Enterprise before 6.0.0.8, when trace is enabled, allows local users to obtain sensitive information via unknown vectors...

Code injection

Multiple unspecified vulnerabilities in IBM WebSphere Commerce 6.0 before 6.0.0.7 have unknown impact and attack vectors...

CVE-2008-6973

Multiple unspecified vulnerabilities in IBM WebSphere Commerce 6.0 before 6.0.0.7 have unknown impact and attack vectors...

CVE-2008-6973

Multiple unspecified vulnerabilities in IBM WebSphere Commerce 6.0 before 6.0.0.7 have unknown impact and attack vectors...

CVE-2009-2094

Unspecified vulnerability in IBM WebSphere Commerce 6.0 Enterprise before 6.0.0.8, when trace is enabled, allows local users to obtain sensitive information via unknown vectors...

IBM WebSphere Commerce ResetPassword Servlet Caching Information Disclosure

The remote host is running a version of IBM WebSphere Commerce that may allow an attacker to conduct a brute-force attack against users who have recently had their passwords invalidated in WebSphere Commerce and uncover private information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

IBM Websphere Commerce Database Update Information Disclosure

The remote host is running a version of IBM Websphere Commerce that may allow potentially confidential information to be accessed through the default user account. An attacker, exploiting this flaw, would only need to be able to make standard queries to the application server. %NASLMINLEVEL 70300...