275 matches found
CVE-2010-2635
SQL injection vulnerability in IBM WebSphere Commerce 6.0 before 6.0.0.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters to "Commerce Organization Admin Console JavaServer pages."...
CVE-2010-2636
Multiple cross-site scripting XSS vulnerabilities in sample store pages in IBM WebSphere Commerce 7.0 before 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...
Sql injection
SQL injection vulnerability in IBM WebSphere Commerce 6.0 before 6.0.0.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters to "Commerce Organization Admin Console JavaServer pages."...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in sample store pages in IBM WebSphere Commerce 7.0 before 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...
CVE-2010-2636
CVE-2010-2636 : Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Commerce 7.0 sample store pages prior to 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2010-2635
SQL injection vulnerability in IBM WebSphere Commerce 6.0 before 6.0.0.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters to "Commerce Organization Admin Console JavaServer pages."...
CVE-2010-2635
The CVE-2010-2635 vulnerability affects IBM WebSphere Commerce 6.0 prior to 6.0.0.10. It is a SQL injection flaw where remote authenticated users can cause arbitrary SQL execution via unspecified parameters to the Commerce Organization Admin Console JavaServer pages. Root cause: improper handling...
CVE-2010-2636
Multiple cross-site scripting XSS vulnerabilities in sample store pages in IBM WebSphere Commerce 7.0 before 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...
CVE-2009-2752
IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...
CVE-2009-2751
IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...
Design/Logic Flaw
IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...
Information disclosure
IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...
CVE-2009-2751
CVE-2009-2751 involves IBM WebSphere Commerce 7.0, where the same cryptographic key is used for both session attributes and merchant data encryption. The underlying cause is the reuse of a single key for distinct encryption domains, which the documents describe as having an unspecified impact and...
CVE-2009-2752
CVE-2009-2752 affects IBM WebSphere Commerce 7.0. The vulnerability is a failure to properly encrypt data in the database, which can allow local users to obtain sensitive information by defeating cryptographic protections. The available documents do not specify affected components, root cause det...
CVE-2009-2751
IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...
CVE-2009-2752
IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...
Improper access control
The 1 Net.Commerce and 2 Net.Data components in IBM WebSphere Commerce Suite store sensitive information under the web root with insufficient access control, which allows remote attackers to discover passwords, and database and filesystem details, via direct requests for configuration files...
CVE-2009-2956
The 1 Net.Commerce and 2 Net.Data components in IBM WebSphere Commerce Suite store sensitive information under the web root with insufficient access control, which allows remote attackers to discover passwords, and database and filesystem details, via direct requests for configuration files...
Code injection
Unspecified vulnerability in IBM WebSphere Commerce 6.0 Enterprise before 6.0.0.8, when trace is enabled, allows local users to obtain sensitive information via unknown vectors...