Exploit for Unrestricted Upload of File with Dangerous Type in Prestashop

PrestaShop Back Office Remote Code Execution CVE-2018-19126...

CVE-2018-2887

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications subcomponent: Back Office. Supported versions that are affected are 13.0.0 and 12.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successf...

CVE-2018-2887: Undefined Security Weakness

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications subcomponent: Back Office. Supported versions that are affected are 13.0.0 and 12.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successf...

PT-2018-2312

Name of the Vulnerable Software and Affected Versions Oracle Retail Applications MICROS Retail-J versions 12.1.2 and 13.0.0 Description The issue is related to inadequate access control in the Back Office component of MICROS Retail-J, allowing an unauthenticated attacker with network access via...

Design/Logic Flaw

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications subcomponent: Back Office. Supported versions that are affected are 10.2.x, 11.0.x, 12.0.x, 12.1.x, 12.1.1.x,12.1.2.x and 13.1.x. Difficult to exploit vulnerability allows physical access to compromise MICROS Retail-J...

PrestaShop < 1.6.1.19 - BlowFish ECD Privilege Escalation Exploit

Exploit for php platform in category web applications !/usr/bin/env python3 PrestaShop = 1.6.1.19 Privilege Escalation Charles Fol 2018-07-10 See https://ambionics.io/blog/prestashop-privilege-escalation The condition for this exploit to work is for an employee to have the same password as a...

CVE-2018-2888: Undefined Security Weakness

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications subcomponent: Back Office. Supported versions that are affected are 10.2.x, 11.0.x, 12.0.x, 12.1.x, 12.1.1.x,12.1.2.x and 13.1.x. Difficult to exploit vulnerability allows physical access to compromise MICROS Retail-J...

PrestaShop 1.6.1.19 - BlowFish ECD Privilege Escalation

PrestaShop 1.6.1.19 - BlowFish ECD Privilege Escalation !/usr/bin/env python3 PrestaShop = 1.6.1.19 Privilege Escalation Charles Fol 2018-07-10 See https://ambionics.io/blog/prestashop-privilege-escalation The condition for this exploit to work is for an employee to have the same password as a...

PrestaShop < 1.6.1.19 - 'BlowFish ECD' Privilege Escalation

!/usr/bin/env python3 PrestaShop = 1.6.1.19 Privilege Escalation Charles Fol 2018-07-10 See https://ambionics.io/blog/prestashop-privilege-escalation The condition for this exploit to work is for an employee to have the same password as a customer. The exploit will yield a valid employee cookie f...

Oracle Retail Applications Retail Back Office Component Unauthorized Operation Vulnerability

Oracle Retail Applications is a suite of retail applications store solutions from Oracle Corporation, of which Retail Back Office is a retail back office component that provides retailers with real-time access to storage management and reporting capabilities. A security vulnerability exists in th...

CVE-2018-2861

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2018-2861

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2018-2861

CVE-2018-2861 affects Oracle Retail Back Office (Security subcomponent) in Oracle Retail Applications for versions 13.4.9, 14.0.4, and 14.1.3. The vulnerability allows an unauthenticated attacker with network access via HTTP to read a subset of data and cause a partial denial of service. The issu...

CVE-2018-2861

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2018-2861: Undefined Security Weakness

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

PT-2018-15874

Name of the Vulnerable Software and Affected Versions Oracle Retail Back Office versions 13.4.9, 14.0.4, and 14.1.3 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Retail Back Office, resulting in unauthorized read access to a subset of...

ShoprLynx 9.2.3 Insecure File Permissions

ShaprLynx v9.2.3 Insecure File Permissions Vendor: Lynx Software Pty Ltd. Product web page: https://www.sharplynx.com Affected version: 9.02.0003 Summary: Back Office Software for Sharp POS Terminals. Catering for the needs of retail and hospitality businesses, SharpLynx has been developed as a...

Burrowing ideas | account to attack of a several common techniques-vulnerability warning-the black bar safety net

web security incidents, the account, is usually presented to the attacker's first point of contact with account-related functions if there is a defect, an attacker can obtain the key information and important features, such as, the login fails, the error message can determine whether the because...

CVE-2018-6022

Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter...

CVE-2018-6022

Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter...