Commerce Elavon - Moderately critical - Access bypass - SA-CONTRIB-2022-053

This module enables you to accept payments from the Elavon payment provider. The module doesn't sufficiently verify that it's communicating with the correct server when using the Elavon On-site payment gateway, which could lead to leaking valid payment details as well as accepting invalid payment...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of protective measures for website structures, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in their lack of access control mechanisms. This allows attackers to trigger service interruptions.

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of authentication procedures, which allow attackers to increase their privileges.

The vulnerability of the software platforms for developing and managing online stores Magento Open Source and Adobe Commerce is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of protective measures for website structures, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in insufficient validation of input data, which allows attackers to exploit this weakness to increase their privileges.

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce stores is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges by sending specially crafted requests...

osCommerce Cross-Site Scripting Vulnerability (CNVD-2022-59212)

osCommerce is an open source online shopping e-commerce solution based on the GNUGPL license. osCommerce2 v2.3.4.1 previously had a security vulnerability that stemmed from a security issue with the function tepdberror. No detailed vulnerability details are available...

GHSA-GM4M-9RM8-7RXJ Magento Open Source has Improper Access Control vulnerability

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account...

Magento Open Source has Improper Access Control vulnerability

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account...

SQL Injection Vulnerability in Nippon Steel's Procurement E-Commerce Platform

hereinafter referred to as Rizhao Iron & Steel Holding Group, whose main products include hot rolled coils, hot rolled sheets, cold formed sheets, pickled sheets, galvanized sheets, profiled steel, etc., is currently the world's very large-scale ESP product production, processing base, etc.. A SQ...

CVE-2022-35692

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account...

Improper access control

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account...

CVE-2022-35692 Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account...

CVE-2022-35692 Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account...

CVE-2022-35692

Adobe Commerce/Open Source Magento 2.x versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could bypass security features and allow leakage of minor information from another user’s account. Exploitation does not ...

CVE-2022-35692 Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account...

Adobe Commerce 安全漏洞

Adobe Commerce is a leading global digital commerce solution for merchants and brands from Adobe, Incorporated. A security vulnerability exists in Adobe Commerce, which stems from improper access control that could lead to an attacker bypassing security protections to disclose secondary informati...

CVE-2022-35213

Ecommerce-CodeIgniter-Bootstrap before commit 56465f was discovered to contain a cross-site scripting XSS vulnerability via the function baseurl at /blog/blogpublish.php...

Leading the Way in Tampa

If you've been to the Tampa Bay area in recent years, you've probably noticed the significant tech industry expansion taking place in the Channel District. It's an exciting time to be a part of the scene, and Rapid7 is smack in the middle. Being active in the Tampa Bay Chamber of Commerce is...

GHSA-RG7P-WMGJ-F374 Magento stored Cross-Site Scripting (XSS) vulnerability

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s...