CVE-2020-26810

CVE-2020-26810 affects SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905, 2005. An unauthenticated attacker can submit a crafted request to a specific SAP Commerce module URL that is processed with no further interaction, causing the SAP Commerce service to become unavailabl...

CVE-2020-26811

CVE-2020-26811 affects SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905, and 2005. The cited issue is a Server-Side Request Forgery (SSRF) where an unauthenticated attacker can submit a crafted request to a specific SAP Commerce module URL, which is processed without furthe...

CVE-2020-26811

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Reque...

CVE-2020-26809

SAP Commerce Cloud (versions 1808, 1811, 1905, 2005) is affected by CVE-2020-26809 where an attacker can bypass authentication/permission checks via the /medias endpoint, gaining access to Secure Media folders and potentially exposing sensitive data. The root cause is not fully detailed beyond th...

CVE-2020-26809

SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and...

A New Skimmer Uses WebSockets and a Fake Credit Card Form to Steal Sensitive Data

A new skimmer attack was discovered this week, targeting various online e-commerce sites built with different frameworks. As I write this blog post, the attack is still active and exfiltrating data...

Design/Logic Flaw

The usc-e-shop aka Collne Welcart e-Commerce plugin before 1.9.36 for WordPress allows Object Injection because of uscesunserialize. There is not a complete POP chain...

CVE-2020-28339

CVE-2020-28339 affects the WordPress plugin Welcart e-Commerce (usc-e-shop) up to version 1.9.36. The issue is an authenticated PHP Object Injection via usces_unserialize, with the CVE description noting there is not a complete POP chain. Affected: plugin in WordPress; root cause: object injectio...

WordPress Sites Open to Code Injection Attacks via Welcart e-Commerce Bug

A security vulnerability in the Welcart e-Commerce plugin opens up websites to code injection. This can lead to payment skimmers being installed, crashing of the site or information retrieval via SQL injection, researchers said. Welcart e-Commerce is a free WordPress plugin that has more than...

Preparing for Holiday Traffic During COVID-19

We are headed into an unprecedented holiday season as COVID-19 continues to impact the world. For many, this means changing traditions and celebrating without family nearby. For Akamai, it means preparing to support our customers in a holiday commerce season of opportunities and challenges like...

WordPress Welcart e-Commerce plugin <= 1.9.35 - Authenticated PHP Object Injection vulnerability

Authenticated PHP Object Injection vulnerability found by Ramuel Gall in WordPress Welcart e-Commerce plugin versions = 1.9.35. Solution Update the WordPress Welcart e-Commerce plugin to the latest available version at least 1.9.36...

Welcart e-Commerce < 1.9.36 - Authenticated PHP Object Injection

The plugin unserialises via uscesunserialize the content of the uscescookie cookie, which could lead to a PHP Object Injection issue...

Broadleaf Commerce Cross-Site Scripting Vulnerability

Broadleaf Commerce is Broadleaf Commerce team of a Java open source e-commerce website framework. A cross-site scripting vulnerability exists in Broadleaf Commerce version 5.1.14-GA, which stems from a slow HTTP post vulnerability. An attacker can exploit this vulnerability to execute JavaScript...

CVE-2020-21266

Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting XSS due to a slow HTTP post vulnerability...

CVE-2020-21266

Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting XSS due to a slow HTTP post vulnerability...

Cross site scripting

Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting XSS due to a slow HTTP post vulnerability...

CVE-2020-21266

CVE-2020-21266 affects Broadleaf Commerce 5.1.14-GA and is caused by a slow HTTP POST that enables cross-site scripting (XSS) on the client. The impact is client-side script execution. A fix is referenced in Broadleaf release notes for 5.1.15-GA; upgrading to that version is the supported remedia...

CVE-2020-21266

Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting XSS due to a slow HTTP post vulnerability...

The vulnerability of the Microsoft Dynamics 365 Commerce e-commerce software, related to authentication errors, allows a hacker to increase their privileges.

The vulnerability of the Microsoft Dynamics 365 Commerce e-commerce software relates to authentication errors. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

Experts Weigh in on E-Commerce Security Amid Snowballing Threats

The raging pandemic has forced many retailers to re-imagine their businesses, shifting from in-person to contactless interactions through online sales. This new socially distanced reality is colliding with the crush of an upcoming holiday shopping season, creating an unprecedented opportunity for...