Welcart e-Commerce < 1.8.3 - Session Management

The Welcart e-Commerce WordPress plugin was affected by a Session Management security vulnerability...

Welcart e-Commerce < 1.8.3 - PHP Object Injection

The Welcart e-Commerce WordPress plugin was affected by a PHP Object Injection security vulnerability...

JVN#61578437: WordPress plugin "Welcart e-Commerce" vulnerable to session management

WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a vulnerability in session management. Impact A remote attacker who knows a user's e-mail address may log in with the user privilege. As a result, arbitrary operations may be conducted. Solution Update the Software Update to t...

JVN#95082904: WordPress plugin "Welcart e-Commerce" vulnerable to cross-site scripting

WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provided by the develope...

JVN#55826471: WordPress plugin "Welcart e-Commerce" vulnerable to cross-site scripting

WordPress plugin "Welcart e-Commerce" provided by Collne Inc. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provided by the develope...

Acer Admits E-commerce Site Breached

Taiwanese electronics company Acer began sending letters to customers last week indicating that some of their sensitive financial information–credit card data included–may have been accessed over the last year or so. Customers’ names, addresses, card numbers, expiration dates, and three digit CVV...

ShopBuilder module\adv\admin\adv. php, etc. 5 SQL injection

ShopBuilder description ShopBuilder is designed for large and medium-sized enterprises to develop the professional-level e-Commerce Mall system, powerful, safe and convenient, can carry tens of millions of views, make the enterprise low-cost to quickly build an online Mall, turn on the e-Commerce...

WordPress Collne Welcart e-Commerce Plugin <= 1.8.2 - XSS

This vulnerability allows an attacker to inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...

WordPress Collne Welcart e-Commerce Plugin <= 1.8.2 - SQL Injection

This vulnerability allows an attacker to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data. Solution Update the plugin...

Asbru Web Content Management System 9.2.7 - Multiple Vulnerabilities

Asbru Web Content Management System 9.2.7 - Multiple Vulnerabilities Asbru Web Content Management System v9.2.7 Multiple Vulnerabilities Vendor: Asbru Ltd. Product web page: http://www.asbrusoft.com Affected version: 9.2.7 Summary: Ready to use, full-featured, database-driven web content...

Einkaufen, Prospekte, Angebote - Customized SSL, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Einkaufen, Prospekte, Angebote published at the 'play' market has multiple vulnerabilities...

osCmax 2.5.4 Code Execution / CSRF / Local File Inclusion

Advisory ID: HTB23285 Product: osCmax Vendor: http://oscmax.com/ Vulnerable Versions: 2.5.4 and probably prior Tested Version: 2.5.4 Advisory Publication: December 21, 2015 without technical details Vendor Notification: December 21, 2015 Public Disclosure: February 17, 2016 Vulnerability Type: PH...

dotDefender Firewall 5.00.12865 / 5.13-13282 - Cross-Site Request Forgery

Exploit for php platform in category web applications + Credits: hyp3rlinx Vendor: ================== www.applicure.com Product: ===================== dotDefender Firewall Versions: 5.00.12865 / 5.13-13282 dotDefender is a Web application firewall WAF for preventing hacking attacks like XSS, SQL...

Magento the presence of XSS vulnerability, the online Mall may be the attacker's control-the vulnerability warning-the black bar safety net

Magento is an open source e-Commerce system, is a major business-oriented application, The processing of e-Commerce needs, including shopping, shipping, product reviews, etc., and ultimately for the construction of a multipurpose and wide application of e-Commerce websites to provide help. Magent...

Critical Flaws in Magento leave Millions of E-Commerce Sites at Risk

If you are using Magento to run your e-commerce website, it's time for you to update the CMS content management system now. Millions of online merchants are at risk of hijacking attacks due to a number of critical cross-site scripting XSS vulnerabilities in the Magento, the most popular e-commerc...

Magento Update Addresses XSS, CSRF Vulnerabilities

Magento patched 20 vulnerabilities last week, including a stored cross-site scripting XSS flaw in the e-commerce platform that could have let an attacker take over a site and create new admin accounts. Researchers at Sucuri dug up the XSS vulnerability while combing through research audits last...

E-commerce platform of Beijing 3D World Technology Co., Ltd. suffers from java deserialization vulnerability

Ltd. is a professional software and application service provider of domestic inspection and testing management platform, master data management platform, e-commerce platform and so on. A java deserialization vulnerability exists in the e-commerce platform of Beijing 3D World Technology Co., Ltd...

SAP Hybris E-commerce Suite VirtualJDBC SQL Injection

Application: SAP Hybris E-commerce Vendor URL: SAP Bugs: SQL Injection Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 14.02.2016 Reference: SAP replied “Due to the fact that this issue is inside Hybris cloud we don’t provide a security note. Please mention inside your...

SAP Hybris E-commerce Suite VirtualJDBC - Default Credentials

Application: SAP Hybris E-commerce Suite Versions Affected: SAP Hybris E-commerce Suite 5.1.0.3 Vendor URL: SAP Bugs: Default credentials Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 10.05.2016 Author: Alexey Tyurin ERPScan VULNERABILITY INFORMATION Class: CWE-259 Use...

RCE via CSRF in osCmax

High-Tech Bridge Security Research Lab discovered 2 PHP Local File Inclusion vulnerabilities in osCmax, a popular web-based e-commerce application and shopping cart. The vulnerabilities can be exploited to execute arbitrary PHP code on the target system. Successful exploitation of these...