CVE-2018-1541: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Commerce Enterprise V7, V8, and V9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

PT-2018-13019

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce Enterprise versions V7 through V9 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a truste...

CVE-2018-1644: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8 could allow an authenticated user to obtain sensitive information about another user...

CVE-2017-1484: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attacker to obtain information such as user personal data. IBM X-Force ID: 128622...

Redirection Vulnerability Open in Multiple IBM Products

IBM WebSphere Commerce Enterprise and others are products of IBM Corporation in the U.S. IBM WebSphere Commerce Enterprise is a suite of e-commerce solutions for high-volume B2C and B2B business models and multiple e-commerce sites; Express is a suite of business intelligence and planning...

CVE-2017-1398: URL Redirection to Untrusted Site

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to...

CVE-2017-1170: Undefined Security Weakness

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230...

CVE-2015-7444: Exposure of Sensitive Information to an Unauthorized Actor

The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain sensitive information via unspecified vectors...

PT-2016-3781

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce Enterprise versions 7.0.0.8 through 7.0.0.9 Description The issue concerns the Update Installer in IBM WebSphere Commerce Enterprise, which fails to properly replicate the search index. This allows attackers to obtain...

IBM WebSphere Commerce Enterprise Information Disclosure Vulnerability

IBM WebSphere Commerce Enterprise is a suite of e-commerce solutions from IBM in the United States. The solution is primarily used for high-volume B2C and B2B business models and advanced platforms for multiple e-commerce sites. A security vulnerability exists in IBM WebSphere Commerce Enterprise...

CVE-2015-5015: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Commerce Enterprise 7.0.0.9 and 8.x before Feature Pack 8 allows remote attackers to obtain sensitive information via a crafted REST URL...

PT-2013-2402

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce Enterprise versions 5.6.x through 5.6.1.5 IBM WebSphere Commerce Enterprise versions 6.0.x through 6.0.0.11 IBM WebSphere Commerce Enterprise versions 7.0.x through 7.0.0.7 Description The issue allows remote attackers t...

CVE-2013-0523: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Commerce Enterprise 5.6.x through 5.6.1.5, 6.0.x through 6.0.0.11, and 7.0.x through 7.0.0.7 does not use a suitable encryption algorithm for storefront web requests, which allows remote attackers to obtain sensitive information via a padding oracle attack that targets certain UTF-8...

PT-2010-4165

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce Enterprise version 7.0 before 7.0.0.2 Description The issue allows remote attackers to read messages intended for other recipients via vectors involving access by the outbound messaging system to the...

CVE-2010-2639: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Commerce Enterprise 7.0 before 7.0.0.2 allows remote attackers to read messages intended for other recipients via vectors involving access by the outbound messaging system to the RunTimeProfileCacheCmdImpl class, related to the caching of mutable objects and "concurrency issues."...