SAP Commerce 输入验证错误漏洞

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. This product supports sales management, marketing management, order management and operations management. An input validation error vulnerability exists in SAP Commerce versions 1905, 2005, 2105, 2011, and 2205, which ca...

PT-2022-25727 · Sap · Sap Commerce

Name of the Vulnerable Software and Affected Versions: SAP Commerce versions 1905 through 2205 Description: An attacker can change the content of the SAP Commerce login page through a manipulated URL, allowing them to inject code that redirects submissions from the affected login form to their ow...

PT-2022-6405 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.4-p1 and earlier Adobe Commerce versions 2.4.5 and earlier Description: The issue is related to an Improper Access Control that could result in a Security feature bypass. An attacker could leverage this vulnerabili...

CVE-2022-39275 Improper object type validation in saleor

Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can be used to expose the following...

CVE-2022-39275

CVE-2022-39275 affects Saleor (headless GraphQL commerce platform). The issue is improper ID-type validation in several GraphQL mutations that can let an authenticated user access database objects they should not, potentially exposing info such as row counts from tables with sequential keys and s...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in errors in XML request processing, allowing attackers to execute arbitrary code.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created XML data...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce products lies in the incorrect limitation of the path to the restricted catalog. This allows attackers to execute arbitrary code.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to incorrect path name restrictions for access to restricted catalogs. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code in t...

Exploit for Improper Input Validation in Adobe Commerce

CVE-2022-24086 PoC of CV...

Top 5 Mobile Commerce Trends in 2022

By Owais Sultan Due to its many benefits, mobile commerce has been growing quickly over the last several years. The need… This is a post from HackRead.com Read the original post: Top 5 Mobile Commerce Trends in 2022...

Malicious Package

Overview commerce-clients is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Security Bulletin: Multiple security vulnerabilities in IBM Sales Center for WebSphere Commerce (CVE-2008-7271, CVE-2010-4647, CVE-2012-0186, CVE-2012-0191, CVE-2012-2159, CVE-2012-2161)

Abstract Multiple security vulnerabilities have been identified in IBM Sales Center for WebSphere Commerce V6.0 and V7.0 Content VULNERABILITY DETAILS – Directory Traversal CVE ID: CVE-2012-0186 DESCRIPTION: Specially crafted URLs can be sent to the Eclipse Help component of IBM Sales Center for...

LivelyCart Pro 3 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

Security Risks in Logistics APIs Used by E-Commerce Platforms

Our research examines the security flaws that we found in the logistics API implementation of e-commerce platforms that can potentially expose the consumers’ personal information. We discuss the security risks that such flaws present for software engineers, e-commerce platform providers, and...

CVE-2022-36101

Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update an...

CVE-2022-36102

Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version 5.7.15. Users ca...

Design/Logic Flaw

Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version 5.7.15. Users ca...

Design/Logic Flaw

Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update an...

CVE-2022-36102

Shopware 5.x contains an ACL bypass in backend admin controllers that can be triggered by a specific notation, allowing users to perform actions normally restricted. Affected versions include 5.7.x prior to 5.7.15; remediation is to update to 5.7.15 (via Auto-Updater or download). No public explo...

CVE-2022-36101

The CVE-2022-36101 issue affects Shopware (Shopware 5.x). In affected versions, the backend customer detail view could expose sensitive data, specifically hashed passwords and session IDs, to unauthorized viewers. The root cause is that the request for the customer detail view did not unset these...

PrestaShop Cross-Site Scripting Vulnerability (CNVD-2022-62230)

PrestaShop is an open source e-commerce solution from PrestaShop Inc. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. PrestaShop module 5.0.2 prior versions of cross-site scripting vulnerability, the vulnerability stems from t...