Magento Marketplace Suffers Data Breach Exposing Users' Account Info

If you have ever registered an account with the official Magento marketplace to bought or sold any extension, plugin, or e-commerce website theme, you must change your password immediately. Adobe—the company owning Magento e-commerce platform—today disclosed a new data breach incident that expose...

Magento Marketplace Suffers Data Breach Exposing Users' Account Info

If you have ever registered an account with the official Magento marketplace to bought or sold any extension, plugin, or e-commerce website theme, you must change your password immediately. Adobe—the company owning Magento e-commerce platform—today disclosed a new data breach incident that expose...

CVE-2018-9283

An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting XSS vulnerabilities in the firstname, lastname, billingaddress-address, billingaddress-zipcode, billingaddress-city, billingaddress-department, shippingaddress-address, shippingaddress-zipcode,...

Cross site scripting

An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billingaddress-address, billingaddress-zipcode, billingaddress-city, billingaddress-department, shippingaddress-address,...

CVE-2018-14397

An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billingaddress-address, billingaddress-zipcode, billingaddress-city, billingaddress-department, shippingaddress-address,...

Cross site scripting

An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting vulnerabilities involving the firstname, lastname, billingaddress-address, billingaddress-zipcode, billingaddress-city, billingaddress-department, shippingaddress-address,...

Information leakage vulnerability in Yunmai Good Light APP

Yunmai Good Light APP is a special app for smart weight scale launched by Yunmai. There is an information leakage vulnerability in Yunmai Good Light APP. Since the entire APP only uses token as a security restriction, the token generation algorithm can be cracked to obtain sensitive information,...

Override Traversal Vulnerability in the Management of Shipping Addresses of the Kai Distribution Platform Management System

Kai distribution system is a network distribution management system specializing in B2B e-commerce business under Hangzhou Qibo 360shop Technology Co. There is an unauthorized traversal vulnerability in the management of shipping address of the Kai distribution platform management system. Through...

Starbucks: Parameter Manipulation allowed for editing the shipping address for other user’s teavana.com subscriptions.

@meals discovered a vulnerability which allowed the shipping address for teavana.com order subscriptions to be edited without proper authorization. Thanks @meals!...

JEECMS一处通用越权

简要描述： 1 详细说明： http://wooyun.org/bugs/wooyun-2015-096948 路人甲已经把xss挖透了，那么我们不挖xss了，我们转战挖越权 收货地址存在越权修改 漏洞证明： http://wooyun.org/bugs/wooyun-2015-096948 路人甲已经把xss挖透了，那么我们不挖xss了，我们转战挖越权 收货地址存在越权修改...

WordPress Plugin TheCartPress Has Multiple Cross-Site Scripting Vulnerabilities

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Multiple cross-site scripting vulnerabilities exist in the WordPress plugin TheCartPress. 1 Because many user-supplied HTTP...

Alibaba aliexpress exposure security vulnerability could compromise millions of users personal information-vulnerability warning-the black bar safety net

1 of 2 November 9 November 2 1:0 0 updates: According to the official feedback Alibaba security team have been in the first time to fix the vulnerability. ! According to foreign media reports, Alibaba's aliexpress website on the exposed security vulnerabilities that could impact the world of...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in invoice.asp in CactuShop before 6.155 allow remote attackers to inject arbitrary web script or HTML via the 1 billing address or 2 shipping address...

Design/Logic Flaw

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the 1 Account Billing Address and 2 Shipping Address fields in a profile by creating a Sales Order SO associated with that profile...