Ability to change order address without triggering address validations in solidus

Impact This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zo...

Ability to change order address without triggering address validations in solidus

Impact This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zo...

Shopify: Ability to generate shipping labels in another store orders

Details A shop owner creating a session on its own store on https://mailbox.shopifycloud.com/ service can craft request to print labels on another store he doesn't have access to. Steps to reproduce 1. Go to an unfulfilled order and click on Create a shipping label 2. Copy the CURL request that i...

XSS Vulnerability in Shipping 100 - Virtual Goods Auto-Shipping System (CNVD-2020-31442)

Shipping 100-Virtual Goods Autoship System is a powerful virtual goods autoship system/article pay to read system. An XSS vulnerability exists in Shipment 100 - Virtual Goods Autoship System. An attacker can exploit the vulnerability to obtain user cookie information...

Oil and Gas Firms Targeted With Agent Tesla Spyware

Attackers are targeting energy companies with the Agent Tesla spyware, as seen in recent spearphishing emails with malicious attachments. Researchers say that until now, Agent Tesla has not been associated with campaigns targeting the oil-and-gas vertical. The emails leverage the tumultuous natur...

Logic Flaw Vulnerability in Shining Networks Virtual Goods Auto-Shipping System (Ship 100) (CNVD-2020-27473)

Shipping 100 is a virtual goods autoship system/article pay to read system. Shining Networks Virtual Goods Auto-Shipping System Ship 100 has a logic flaw vulnerability, which can be exploited through this level of transgression vulnerability, you can delete arbitrary use of information...

XSS Vulnerability in Shipping 100 Virtual Goods Autoship System (CNVD-2020-25886)

Shipping 100 Virtual Goods Autoship System is a virtual goods autoship system/article pay to read system. Shipping 100 Virtual Goods Autoship System has an XSS vulnerability that can be exploited by attackers to execute malicious scripts and obtain an administrator cookie...

Microdistribution has a flawed logic vulnerability

Micro Distribution is a WeChat distribution platform tailored for businesses. Micro distribution has a logic flaw vulnerability, an attacker can use the vulnerability to overstep the right to modify the entire network of users' shipping address information...

SQL Injection Vulnerability in Shipping 100 System co***.php Page

Shipping 100 System is a virtual goods autoship system/article pay to read system. A SQL injection vulnerability exists in the co.php page of the Shipment 100 system, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Shipping 100 Enterprise Official Website Template me***.php

Shipping 100 System is a virtual goods autoship system/article pay to read system. Shipping100 enterprise official website template me.php has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in the ad***.php page of the Shipping 100 Virtual Goods Autoship system

Shipping 100 Virtual Goods Autoship System is a virtual goods autoship system/article pay to read system. SQL injection vulnerability exists in the ad.php page of the Shipment 100 virtual goods autoship system, which can be exploited by attackers to obtain sensitive information from the database...

Arbitrary File Deletion Vulnerability in Shipping 100 Virtual Goods Autoship System

Shipping 100 Virtual Goods Autoship System is a virtual goods autoship system/article pay to read system. Ship 100 Virtual Goods Autoship System has an arbitrary file deletion vulnerability that can be exploited by an attacker to delete arbitrary files...

XSS Vulnerability in Shipping 100 Virtual Goods Autoship System

Shipping 100 Virtual Goods Autoship System is a virtual goods autoship system/article pay to read system. Shipping 100 Virtual Goods Autoship System has an XSS vulnerability that can be exploited by attackers to obtain administrator cookie information...

SQL Injection Vulnerability in Shipping 100 Virtual Goods Autoship System

Shipping 100 Virtual Goods Autoship System is a virtual goods autoship system/article pay to read system. Shipping 100 Virtual Goods Autoship System suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Shipping 100 System (CNVD-2020-10186)

Shipping 100 System is a virtual goods autoship system/article pay to read system. A SQL injection vulnerability exists in Shipment 100 System, which can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in Shipping 100 System (CNVD-2020-10187)

Shipping 100 System is a virtual goods autoship system/article pay to read system. A SQL injection vulnerability exists in Shipment 100 System, which can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in Shipping 100 System (CNVD-2020-10185)

Shipping 100 System is a virtual goods autoship system/article pay to read system. A SQL injection vulnerability exists in Shipment 100 System, which can be exploited by attackers to obtain sensitive information...

Magento Marketplace Suffers Data Breach Exposing Users' Account Info

If you have ever registered an account with the official Magento marketplace to bought or sold any extension, plugin, or e-commerce website theme, you must change your password immediately. Adobe—the company owning Magento e-commerce platform—today disclosed a new data breach incident that expose...

Magento Marketplace Suffers Data Breach Exposing Users' Account Info

If you have ever registered an account with the official Magento marketplace to bought or sold any extension, plugin, or e-commerce website theme, you must change your password immediately. Adobe—the company owning Magento e-commerce platform—today disclosed a new data breach incident that expose...

OnePlus Suffers New Data Breach Impacting Its Online Store Customers

Chinese smartphone maker OnePlus has suffered a new data breach exposing personal and order information of an undisclosed number of its customers, likely, as a result of a vulnerability in its online store website. The breach came to light after OnePlus started informing affected customers via...