Spree controller Parameter Arbitrary Ruby Object Instantiation Command Execution

Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and executd arbitrary commands via the 1 paymentmethod parameter to core/app/controllers/spree/admin/ paymentmethodscontroller.rb; and the 2 promotionaction parameter to...

SA-CONTRIB-2013-020 - Ubercart - Cross site scripting (XSS)

The Ubercart module for Drupal provides a shopping cart and e-commerce features for Drupal. The "full name" field in Views did not properly sanitize output. The vulnerability is mitigated by the fact that an attacker must get far enough in the checkout process to store their name with an order. C...

ECShop payment plug-ins exposed 0day vulnerabilities 3 6 0 to assist in the repair-bug warning-the black bar safety net

Recently, the 3 6 0 Web sitessecurity testingplatform exclusive discover the online store system ECShop Alipay plug-in the presence of high-risk 0day vulnerability. Hackers can use aSQL injectionto bypass the system to limit access to the web data, and then implement the“drag library”steal site...

PayPal Cross Site Scripting

Title: ====== Paypal Bug Bounty 17 - Persistent Web Vulnerability Date: ===== 2013-01-28 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=671 PayPal UID: tlm30fdsh VL-ID: ===== 671 Common Vulnerability Scoring System: ==================================== 3 Introduction:...

AbanteCart 1.1.3 Cross Site Scripting

AbanteCart 1.1.3 index.php Multiple Reflected XSS Vulnerabilities Vendor: Belavier Commerce Product web page: http://www.abantecart.com Affected version: 1.1.3 Summary: AbanteCart is a free PHP based eCommerce solution for merchants to provide ability creating online business and sell products...

PayPal Cross Site Scripting

Title: ====== PayPal Bug Bounty 26 - Persistent Web Vulnerabilities Date: ===== 2013-01-26 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=703 PayPal UID: wam19c8kxn VL-ID: ===== 703 Common Vulnerability Scoring System: ==================================== 4.5...

God Horses are Floating Clouds: The Story of a Chinese Banker Trojan

Dong Yan In China these days, e-commerce has become an important part of daily life, especially among young people. According to a report from CNNIC China Internet Network Information Center, the number of Chinese e-commerce users reached 242 million at the end of the December 2012. This is nearl...

PayPal Cross Site Scripting

Title: ====== Paypal Bug Bounty 10 - Persistent Web Vulnerability Date: ===== 2013-01-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=647 PayPal UID: ixb165sfi VL-ID: ===== 647 Common Vulnerability Scoring System: ==================================== 3.5 Introduction...

Paypal Bug Bounty #17 - Persistent Web Vulnerability

Document Title: =============== Paypal Bug Bounty 17 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=671 PayPal UID: tlm30fdsh Release Date: ============= 2013-01-27 Vulnerability Laboratory ID VL-ID:...

PayPal Bug Bounty #26 - Persistent Web Vulnerabilities

Document Title: =============== PayPal Bug Bounty 26 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=703 PayPal UID: wam19c8kxn Release Date: ============= 2013-01-25 Vulnerability Laboratory ID VL-ID:...

Paypal Bug Bounty #8 - CSRF DEV Web Vulnerability

Document Title: =============== Paypal Bug Bounty 8 - CSRF DEV Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=644 Paypal UID: ydw159yyb Release Date: ============= 2013-01-23 Vulnerability Laboratory ID VL-ID:...

Paypal Bug Bounty #10 - Persistent Web Vulnerability

Document Title: =============== Paypal Bug Bounty 10 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=647 PayPal UID: ixb165sfi Release Date: ============= 2013-01-23 Vulnerability Laboratory ID VL-ID:...

Paypal Bug Bounty #8 - CSRF DEV Web Vulnerability

Document Title: =============== Paypal Bug Bounty 8 - CSRF DEV Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=644 Paypal UID: ydw159yyb Release Date: ============= 2013-01-23 Vulnerability Laboratory ID VL-ID:...

Paypal Bug Bounty #18 - Blind SQL Injection Vulnerability

Document Title: =============== Paypal Bug Bounty 18 - Blind SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=673...

Operation Red October : Cyber Espionage campaign against many Governments

A new sensational discovered has been announced by Kaspersky Lab's Global Research & Analysis Team result of an investigation after several attacks hit computer networks of various international diplomatic service agencies. A new large scale cyber-espionage operation has been discovered, named Re...

ColdFusion E-Commerce (SHOP) <= Local File Include Vulnerability

Adobe ColdFusion suffer from multiple vulnerabilities / bugs in ColdFusion-SHOP , the attacker can use some bug in the software to inject some remote command/code LFI / HTML Injection . This is private exploit. You can buy it at https://0day.today...

Under the hood of recent DDoS Attack on U.S. Banks

Incapsula security study reveals how a simple neglect in managing the administrative password of a small UK site was quickly exploited by Botnet shepherds operating obscurely out of Turkey to hurl large amounts of traffic at American banks. If you've been following the news, you are probably awar...

WordPress E-Commerce Shop Styling Plugin <= 1.7 - Remote File Inclusion

Because of this vulnerability in includes/generate-pdf.php, the attackers can execute arbitrary PHP code via a URL in the "dompdf" parameter. Solution Update the plugin...

PrestaShop E-Commerce v1.5.x->1.5.2 Multiple Vulnerabilities

This is new Multiple Vulnerabilities POC/Bugs in PrestaShop E-Commerce 1.5.x-1.5.2 The Attacker can use this bug to access and get some important information like backups/dbs, and maybe he can find some secret information like visa/paypal accounts in the backups etc... This is private exploit. Yo...

PayPal Cross Site Scripting

Title: ====== Paypal Core Bug Bounty 3 - Persistent Web Vulnerability Date: ===== 2012-12-12 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=635 VL-ID: ===== 635 Common Vulnerability Scoring System: ==================================== 4 Introduction: ============= PayP...