CVE-2020-14275

The CVE-2020-14275 entry concerns HCL Commerce, affecting versions 9.0.0.5–9.0.0.13, 9.0.1.0–9.0.1.14, and 9.1–9.1.4. It states potential denial of service, disclosure of user personal data, and the ability to perform unauthorized administrative operations. No root-cause, affected component/file,...

HCL Commerce 信息泄露漏洞

HCL Commerce is a software platform framework for e-commerce from HCL India. The software includes marketing, sales, customer and order processing functions in a customizable and integrated package. It is a unified platform that provides the ability to conduct business directly with consumers, wi...

HCL Commerce 安全漏洞

HCL Commerce is a software platform framework for e-commerce from HCL India. The software includes marketing, sales, customer and order processing functionality in a customizable and integrated package. It is a unified platform that provides the ability to conduct business directly with consumers...

SAP Commerce Cloud 环境问题漏洞

SAP Commerce Cloud is an e-commerce cloud platform from SAP Germany. The platform provides enterprise-level e-commerce business support. SAP Commerce Cloud versions 1808, 1811, 1905, 2005, and 2011 suffer from an Input Validation Error vulnerability, which is caused by an authenticated attacker...

Chongqing Fengshengjia E-commerce Co., Ltd. mall CMS exists overstepping the right loophole

The business scope of Chongqing Feng Shengjia E-commerce Co., Ltd. includes: Internet sales, advertising design and agency, software development, enterprise management, etc.. Chongqing Feng Shengjia E-commerce Co., Ltd. mall CMS has an overstepping vulnerability, which can be exploited by attacke...

Taking a Neighborhood Watch Approach to Retail Cybersecurity

Every year retailers face a heightened level of risk during the online holiday shopping season. COVID-19 drastically shifted consumer buying behaviors, forcing retailers to accelerate digital transformation efforts to support an exponentially higher number of online transactions. Projected U.S...

File Upload Vulnerability in Laiku Push E-commerce System (CNVD-2021-01290)

Laike Push www.laiketui.com is a mall system and mall website construction provider for enterprise-level businesses to provide retail mall, B2B2C multi-user mall system, community group-buying mall system, micro letter distribution system, small program mall, micro distribution system and other...

SQL Injection Vulnerability in Laiku Push E-commerce System (CNVD-2021-01318)

Laikepui E-commerce system is an e-commerce system using PHP5.6+ MYSQL5.5+ self-developed framework. Laikipu E-commerce system has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Hacker Dumps Crypto Wallet Customer Data; Active Attacks Follow

On Monday a hacker dumped sensitive data stolen earlier this year from the Ledger cryptocurrency wallet’s website. The data was put up for grabs on sites frequented by criminals. And in a twist that surprised no one, the data is now actively being exploited in phishing campaigns. Researchers at...

5 essential steps needed to set up a secure e-commerce website

By Owais Sultan Here are a few tips for getting your business set up as an e-commerce provider and transferring previous face-to-face clients into digital sales. This is a post from HackRead.com Read the original post: 5 essential steps needed to set up a secure e-commerce website...

The vulnerability of the software platform for developing and managing online stores Magento Commerce is related to the exposure of information through inconsistencies, allowing attackers to gain access to protected information.

The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to the exposure of information through inconsistencies. Exploiting this vulnerability can allow a malicious actor to gain access to protected information...

The vulnerability of the Magento Commerce software development and management platform lies in the incorrect limitation of the path to the restricted catalog. This allows attackers to execute arbitrary code.

The vulnerability of the Magento Commerce development and management software platform is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

File upload vulnerability in ShopXO open source e-commerce system (CNVD-2020-73468)

ShopXO is an open source enterprise-level open source e-commerce system. ShopXO open source e-commerce system has a file upload vulnerability that can be exploited by an attacker to upload malicious files and obtain server control privileges...

Easy WP SMTP Security Bug Can Reveal Admin Credentials

Easy WP SMTP, a WordPress plugin for email management that has more than 500,000 installations, has a vulnerability that could open the site up to takeover, researchers said. Easy WP SMTP allows users to configure and send all outgoing emails via a SMTP server, so that they don’t end up in the...

SolarWinds Hack Could Affect 18K Customers

The still-unfolding breach at network management software firm SolarWinds may have resulted in malicious code being pushed to nearly 18,000 customers, the company said in a legal filing on Monday. Meanwhile, Microsoft should soon have some idea which and how many SolarWinds customers were affecte...

The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Magento Commerce development and management software platform relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

The vulnerability of the software platform for developing and managing online stores Magento Commerce, related to deficiencies in authentication mechanisms, allows a perpetrator to execute arbitrary code.

The vulnerability of the Magento Commerce development and management software platform is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

SolarWinds advanced cyberattack: What happened and what to do now

We learned more about the sophisticated attack first disclosed on December 8 when security firm FireEye reported it had been the victim of a state-sponsored adversary that stole Red Team assessment tools. On December 13 there was a new development when IT company SolarWinds announced it had been...

DHS Among Those Hit in Sophisticated Cyberattack by Foreign Adversaries – Report

The U.S. Department of Homeland Security DHS, plus the Treasury and Commerce departments, have been hacked in an attack related to the FireEye compromise last week, according to reports. In addition, defense contractors and enterprises were caught up in the attack, FireEye said, which was carried...

U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds, a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the companys...