CVE-2013-0118

CVE-2013-0118 affects CS-Cart prior to 3.0.6 where PayPal Standard Payments is configured. The vulnerability allows a remote attacker to change the payment recipient by sending a modified merchant email address, effectively setting the recipient to themselves. The NVD lists a base score of 5.0 (M...

CVE-2013-0118: Undefined Security Weakness

CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

PT-2013-2107

Name of the Vulnerable Software and Affected Versions CS-Cart versions prior to 3.0.6 Description The issue allows remote attackers to modify the payment recipient when PayPal Standard Payments is configured. This is achieved by altering the merchant's e-mail address, potentially allowing an...

Spree payment_methods_controller.rb payment_method Parameter Arbitrary Ruby Object Instantiation Command Execution

Spree contains a flaw that is triggered when handling input passed via the 'paymentmethod' parameter to paymentmethodscontroller.rb. This may allow a remote authenticated attacker to instantiate arbitrary Ruby objects and potentially execute arbitrary commands...

Spree controller Parameter Arbitrary Ruby Object Instantiation Command Execution

Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and executd arbitrary commands via the 1 paymentmethod parameter to core/app/controllers/spree/admin/ paymentmethodscontroller.rb; and the 2 promotionaction parameter to...

Heartland Data Breach Suit Back from the Dead

For all intents and purposes, the Heartland Payment Systems data breach saga ended more than two years ago when the embattled payment processor finalized settlements paying out millions of dollars to various banks, credit card issuers and consumers. That is until a handful of banks reportedly...

PayPal Cross Site Scripting

Title: ====== Paypal Bug Bounty 17 - Persistent Web Vulnerability Date: ===== 2013-01-28 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=671 PayPal UID: tlm30fdsh VL-ID: ===== 671 Common Vulnerability Scoring System: ==================================== 3 Introduction:...

First week at MEGA Bounty Program, paid out thousands of dollars for seven Bugs

One week after launching a Bug bounty program by the Kim Dotcom's new file-storage and sharing service MEGA claims to have fixed seven vulnerabilities. Although Mega hasn't shared how much money and to whom it paid out in the first week. But as promised, it is clear that MEGA paid out thousands o...

PayPal Cross Site Scripting

Title: ====== PayPal Bug Bounty 26 - Persistent Web Vulnerabilities Date: ===== 2013-01-26 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=703 PayPal UID: wam19c8kxn VL-ID: ===== 703 Common Vulnerability Scoring System: ==================================== 4.5...

PHP weby directory software 1.2 - Multiple Vulnerabilities

PHP weby directory software 1.2 - Multiple Vulnerabilities =========================================== Vulnerable Software: PHP Weby directory software version 1.2 Vendor: http://phpweby.com Download: htp://phpweby.com/down/phpwebydirectory.zip Vuln: Blind SQL injection && CSRF Dork: intext:Power...

Paypal Bug Bounty #17 - Persistent Web Vulnerability

Document Title: =============== Paypal Bug Bounty 17 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=671 PayPal UID: tlm30fdsh Release Date: ============= 2013-01-27 Vulnerability Laboratory ID VL-ID:...

Paypal Bug Bounty #18 - Blind SQL Injection Vulnerability

Document Title: =============== Paypal Bug Bounty 18 - Blind SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=673...

SA-CONTRIB-2013-002 - Payment - Access Bypass

Payment enables other modules to make payments using a variety of payment processing services. The module incorrectly grants access when checking if a user can view payments, allowing a user to access the payments of other users. CVE identifiers issued CVE-2013-0182 Versions affected Payment...

CVE-2012-4932

Multiple cross-site scripting XSS vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via 1 the having parameter in a manage action to index.php; 2 the Email field in an Add User action; 3 the Customer Name field in an Add...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via 1 the having parameter in a manage action to index.php; 2 the Email field in an Add User action; 3 the Customer Name field in an Add...

CVE-2012-4932

Multiple cross-site scripting XSS vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via 1 the having parameter in a manage action to index.php; 2 the Email field in an Add User action; 3 the Customer Name field in an Add...

Shopex旗下产品Ecmall支付漏洞

简要描述： Shopex旗下产品Ecmall支付漏洞 详细说明： 最近在用ecmall搭建一个站点，却发现这坑爹的功能，哪能否送我个ECMALL的商业授权呀。 漏洞证明：...

Paypal Core Bug Bounty #3 - Persistent Web Vulnerability

Document Title: =============== Paypal Core Bug Bounty 3 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=635 Release Date: ============= 2012-12-12 Vulnerability Laboratory ID VL-ID: ==================================== 635...

SimpleInvoices 2011.1 Cross-Site-Scripting (XSS) Vulnerabilities CVE-2012-4932

Overview SimpleInvoices 2011.1 is vulnerable to Cross-site Scripting XSS. Software Description Simple Invoices is a free, open source, web based invoicing system that you can install on your server/pc or have hosted by one of our services providers. Vulnerability Overview The vulnerabilities POC...

SimpleInvoices 2011.1 Cross Site Scripting

Overview SimpleInvoices 2011.1 is vulnerable to Cross-site Scripting XSS. Software Description Simple Invoices is a free, open source, web based invoicing system that you can install on your server/pc or have hosted by one of our services providers. Vulnerability Overview The vulnerabilities POC...