CVE-2020-6363

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate...

CVE-2020-6272

SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited,...

CVE-2020-6272

The CVE-2020-6272 issue affects SAP Commerce Cloud (versions 1808, 1811, 1905, 2005) and arises from insufficient input encoding in web CMS components. The root cause is improper encoding of user inputs, enabling an authenticated and authorized content manager to inject malicious script into seve...

PT-2020-4581 · Adobe · Magento Commerce

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions 2.3.4 and earlier Magento Commerce version 2.4.0 Description: The issue exists due to insufficient input validation, potentially allowing a remote attacker to access confidential information. In maintenance mode, an...

Dynamics 365 Commerce Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploited this vulnerability could update data without proper authorization. To exploit the vulnerability, an attacker would need to send a specially crafted request to ...

PT-2020-4393 · Microsoft · Dynamics 365 Commerce

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 Commerce affected versions not specified Description: The issue is related to authorization errors in Microsoft Dynamics 365 Commerce, allowing a remote attacker to elevate their privileges. An unauthenticated attacker...

KLA11972 Multiple vulnerabilities in Microsoft Dynamics

Multiple vulnerabilities were found in Microsoft Dynamics. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Dynamics 365 Commerce can be exploited remotely via...

Boom! Mobile Customer Data Lost to Fullz House/Magecart Attack

Boom! Mobile’s U.S. website recently fell victim to an e-commerce attack, putting online shoppers in danger of payment-card theft, researchers said. Boom! is a wireless provider that resells mobile phone plans from Verizon, AT&T and T-Mobile USA, under its own brand and with its own perks the...

Account Takeover Fraud Losses Total Billions Across Online Retailers

Account takeover ATO attacks are on the rise, and in fact have become a go-to attack of choice cybercriminals of all stripes. In fact, in 2019 alone, ATO attacks cost consumers and e-commerce retailers a whopping $16.9 billion in losses. To be clear, ATO fraud isn’t new, it’s been a concern for...

Arrested: 4 most active hackers involved in SIM Swap, malware attacks

By Deeba Ahmed These hackers were involved in malware attacks, sim swapping scams, and e-commerce fraud. This is a post from HackRead.com Read the original post: Arrested: 4 most active hackers involved in SIM Swap, malware attacks...

Stubborn WooCommerce Plugin Bugs Gets Third Patch

E-commerce sites using the WordPress plugin Discount Rules for WooCommerce are being urged to patch two high-severity cross-site scripting flaws that could allow an attacker to hijack a targeted site. Two fixes for the flaws, first available on Aug. 22 and second on Sept. 2, failed to patch the...

CVE-2020-25751

The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=compago&view=comments filterpublished parameter...

CVE-2020-25751

The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=compago&view=comments filterpublished parameter...

Sql injection

The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=compago&view=comments filterpublished parameter...

CVE-2020-25751

The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=compago&view=comments filterpublished parameter...

CVE-2020-25751

CVE-2020-25751 affects the paGO Commerce plugin 2.5.9.0 for Joomla!, enabling SQL Injection via the URL parameter administrator/index.php?option=com_pago&view=comments filter_published. NVD lists CVSS v3.1 base score 8.8 (HIGH) with NETWORK attack, LOW privileges, and no user interaction; impacts...

The vulnerability of the Commerce Service Center component in the Oracle Commerce Service Center module for managing customer interactions in the Oracle Commerce e-commerce platform allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Commerce Service Center component in the Oracle Commerce Service Center platform exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to remotely access and modify, add, or delete data, or unauthorized access to...

The vulnerability of the Workbench search system of Oracle Commerce Guided Search and the Oracle Commerce Experience Manager, a tool for managing the user environment, allows an attacker to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Workbench search engine component of Oracle Commerce Guided Search and the Oracle Commerce Experience Manager user environment management tool exists due to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to...

The vulnerability of the sub-component of the Dynamo Application Framework within the component of the Oracle Commerce Platform of the e-commerce platform Oracle Commerce allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the sub-component of the Dynamo Application Framework within the Oracle Commerce Platform of the e-commerce platform Oracle Commerce exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to remotely access and modify,...

The vulnerability of the sub-component of the Dynamo Application Framework within the component of the Oracle Commerce Platform of the e-commerce platform Oracle Commerce allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the sub-component of the Dynamo Application Framework within the Oracle Commerce Platform of the e-commerce platform Oracle Commerce exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add,...