baijiacms path traversal vulnerability

baijiacms is a content management system CMS for e-commerce. baijiacms is vulnerable to a path traversal vulnerability, which stems from a directory traversal vulnerability found in database.php, which allows an attacker to delete a folder on any server with the id parameter...

SmartStoreNET - Malicious Message leading to E-Commerce Takeover

SmartStoreNET is the leading open-source e-commerce platform for .NET, which makes it suitable for companies running Windows Server. Next to the operation of an online business, it offers advanced features, such as CRM tools, a blog and a forum. As a result, a SmartStoreNET instance handles highl...

Shopware Cross-Site Scripting Vulnerability (CNVD-2021-103572)

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware in versions prior to 5.7.6 suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit the...

Nhn Commerce Godomall5 数据伪造问题漏洞

Nhn Commerce Godomall5 is a Nhn shopping solution from Nhn Commerce, a South Korean company. A data forgery vulnerability exists in Nhn Commerce godomall5, which stems from the fact that moveuploadedfile in the product does not validate the extension of files uploaded by users. The vulnerability...

CVE-2021-41188

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the .htaccess file will protect against...

CVE-2021-41188

CVE-2021-41188 affects Shopware Open Source before version 5.7.6, which contains a cross-site scripting vulnerability. The issue is mitigated by upgrading to 5.7.6; workarounds include enabling the Security Plugin or applying specific configurations in .htaccess (for Apache) or nginx server block...

New York Times Journalist Hacked with NSO Spyware

Citizen Lab is reporting that a New York Times journalist was hacked with the NSO Groups spyware Pegasus, probably by the Saudis. The world needs to do something about these cyberweapons arms manufacturers. This kind of thing isnt enough; NSO Group is an Israeli company...

U.S. Ban on Sales of Cyberattack Tools Is Anemic, Experts Warn

The launch of a standing offer to pay for Windows virtual private network VPN software zero-day exploits came to light this week, even as the U.S. mulls new regulations on the export of tools that could be used in cyberattacks against the U.S. or its interests. The developments signal that the U....

U.S. Government Bans Sale of Hacking Tools to Authoritarian Regimes

The U.S. Commerce Department on Wednesday announced new rules barring the sales of hacking software and equipment to authoritarian regimes and potentially facilitate human rights abuse for national security NS and anti-terrorism AT reasons. The mandate, which is set to go into effect in 90 days,...

Judge.me : Stored XSS in Email Templates via link

Summary: Stored cross-site scripting also known as second-order or persistent XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. FYI: I Install judge.me in Shopify E-Commerce Steps To Reproduce: 1. Go to...

ecommerce-lounge.de Improper Access Control vulnerability OBB-2171706

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-39864

Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier and 2.3.7p1 and earlier are affected by a cross-site request forgery CSRF vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to...

CVE-2021-39864

Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier and 2.3.7p1 and earlier are affected by a cross-site request forgery CSRF vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to...

Cross site request forgery (csrf)

Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier and 2.3.7p1 and earlier are affected by a cross-site request forgery CSRF vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to...

CVE-2021-39864 Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition

Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier and 2.3.7p1 and earlier are affected by a cross-site request forgery CSRF vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to...

CVE-2021-39864

CVE-2021-39864 is a CSRF vulnerability in Adobe Commerce / Magento Open Source via a Wishlist Share Link. Affected: Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier, 2.3.7p1 and earlier. Impact: unauthenticated attacker could cause unauthorized additions to a customer’s cart withou...

CVE-2021-39864 Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition

Adobe Commerce versions 2.4.2-p2 and earlier, 2.4.3 and earlier and 2.3.7p1 and earlier are affected by a cross-site request forgery CSRF vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to...

Security Bulletin: Vulnerability in WebSphere Commerce REST services (CVE-2012-3298) *|* -9958B33F7781FF2C85257A77006ED4

Question Security Bulletin: Vulnerability in WebSphere Commerce REST services CVE-2012-3298 | -9958B33F7781FF2C85257A77006ED44E- | Answer Technote troubleshooting ProblemAbstract WebSphere Commerce REST services framework contains security vulnerability. Resolving the problem VULNERABILITY DETAIL...

Security Bulletin: Vulnerability in WebSphere Commerce related to persistent sessions and personalization IDs. (CVE-2012-3300)

Question Security Bulletin: Vulnerability in WebSphere Commerce related to persistent sessions and personalization IDs. CVE-2012-3300 | -9F7F4EC1049C904F85257A77006D19A9- | Answer Flash Alert Abstract WebSphere Commerce contains a security vulnerability related to its use of persistent sessions a...

Security Bulletin: Vulnerability in WebSphere Commerce could allow disclosure of user personal data (CVE-2012-4830) *|* -

Question Security Bulletin: Vulnerability in WebSphere Commerce could allow disclosure of user personal data CVE-2012-4830 | -C6B55ADAB6CADCB985257A86004C7B62- | Answer Flash Alert Abstract Potential Information Disclosure security vulnerability in IBM WebSphere Commerce could expose user persona...