Acer Admits E-commerce Site Breached

Taiwanese electronics company Acer began sending letters to customers last week indicating that some of their sensitive financial information–credit card data included–may have been accessed over the last year or so. Customers’ names, addresses, card numbers, expiration dates, and three digit CVV...

ShopBuilder module\adv\admin\adv. php, etc. 5 SQL injection

ShopBuilder description ShopBuilder is designed for large and medium-sized enterprises to develop the professional-level e-Commerce Mall system, powerful, safe and convenient, can carry tens of millions of views, make the enterprise low-cost to quickly build an online Mall, turn on the e-Commerce...

WordPress Collne Welcart e-Commerce Plugin <= 1.8.2 - XSS

This vulnerability allows an attacker to inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...

WordPress Collne Welcart e-Commerce Plugin <= 1.8.2 - SQL Injection

This vulnerability allows an attacker to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data. Solution Update the plugin...

Asbru Web Content Management System 9.2.7 - Multiple Vulnerabilities

Asbru Web Content Management System 9.2.7 - Multiple Vulnerabilities Asbru Web Content Management System v9.2.7 Multiple Vulnerabilities Vendor: Asbru Ltd. Product web page: http://www.asbrusoft.com Affected version: 9.2.7 Summary: Ready to use, full-featured, database-driven web content...

Einkaufen, Prospekte, Angebote - Customized SSL, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Einkaufen, Prospekte, Angebote published at the 'play' market has multiple vulnerabilities...

osCmax 2.5.4 Code Execution / CSRF / Local File Inclusion

Advisory ID: HTB23285 Product: osCmax Vendor: http://oscmax.com/ Vulnerable Versions: 2.5.4 and probably prior Tested Version: 2.5.4 Advisory Publication: December 21, 2015 without technical details Vendor Notification: December 21, 2015 Public Disclosure: February 17, 2016 Vulnerability Type: PH...

dotDefender Firewall 5.00.12865 / 5.13-13282 - Cross-Site Request Forgery

Exploit for php platform in category web applications + Credits: hyp3rlinx Vendor: ================== www.applicure.com Product: ===================== dotDefender Firewall Versions: 5.00.12865 / 5.13-13282 dotDefender is a Web application firewall WAF for preventing hacking attacks like XSS, SQL...

Magento the presence of XSS vulnerability, the online Mall may be the attacker's control-the vulnerability warning-the black bar safety net

Magento is an open source e-Commerce system, is a major business-oriented application, The processing of e-Commerce needs, including shopping, shipping, product reviews, etc., and ultimately for the construction of a multipurpose and wide application of e-Commerce websites to provide help. Magent...

Critical Flaws in Magento leave Millions of E-Commerce Sites at Risk

If you are using Magento to run your e-commerce website, it's time for you to update the CMS content management system now. Millions of online merchants are at risk of hijacking attacks due to a number of critical cross-site scripting XSS vulnerabilities in the Magento, the most popular e-commerc...

Magento Update Addresses XSS, CSRF Vulnerabilities

Magento patched 20 vulnerabilities last week, including a stored cross-site scripting XSS flaw in the e-commerce platform that could have let an attacker take over a site and create new admin accounts. Researchers at Sucuri dug up the XSS vulnerability while combing through research audits last...

E-commerce platform of Beijing 3D World Technology Co., Ltd. suffers from java deserialization vulnerability

Ltd. is a professional software and application service provider of domestic inspection and testing management platform, master data management platform, e-commerce platform and so on. A java deserialization vulnerability exists in the e-commerce platform of Beijing 3D World Technology Co., Ltd...

SAP Hybris E-commerce Suite VirtualJDBC - Default Credentials

Application: SAP Hybris E-commerce Suite Versions Affected: SAP Hybris E-commerce Suite 5.1.0.3 Vendor URL: SAP Bugs: Default credentials Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 10.05.2016 Author: Alexey Tyurin ERPScan VULNERABILITY INFORMATION Class: CWE-259 Use...

SAP Hybris E-commerce Suite VirtualJDBC SQL Injection

Application: SAP Hybris E-commerce Vendor URL: SAP Bugs: SQL Injection Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 14.02.2016 Reference: SAP replied “Due to the fact that this issue is inside Hybris cloud we don’t provide a security note. Please mention inside your...

RCE via CSRF in osCmax

High-Tech Bridge Security Research Lab discovered 2 PHP Local File Inclusion vulnerabilities in osCmax, a popular web-based e-commerce application and shopping cart. The vulnerabilities can be exploited to execute arbitrary PHP code on the target system. Successful exploitation of these...

Welcart e-Commerce < 1.5.3 - SQL Injection

The Welcart e-Commerce WordPress plugin was affected by a SQL Injection security vulnerability...

NetShen E-commerce System Exists IIS Write Permission, Source Code Leakage Vulnerabilities

NetShen Information Technology Beijing Co., Ltd. is a high-tech information security solution, product and service provider integrating technology research and development, manufacturing and comprehensive service. NetShen's e-commerce system suffers from IIS write permission and source code leaka...

Multiple Cross-Site Request Forgery Vulnerabilities in Magento

Magento is a professional open source PHP e-commerce system from Magento, USA, which provides permission management, search engine and payment gateway. Magento has multiple cross-site request forgery vulnerabilities. Allow remote attackers to perform certain unauthorized operations...

Magento E-Commerce Platform Magmi Plugin Information Disclosure

An information disclosure vulnerability has been discovered in Magento e-commerce platform Magmi Plugin. Successful exploitation results in access to Magento site credentials and database encryption key...

E-Commerce platform Magento plug-in is exposed 0day vulnerabilities-vulnerability warning-the black bar safety net

! Recently, the e-Commerce platform Magento, a very popular plug-in－Magmi is exposed out of the 0 day vulnerabilities, and there have been hackers use this vulnerability to attack. Magento is a professional open-source e-Commerce system. Magento design is very flexible, and also has a modular...