Magento cross-site scripting vulnerability (CNVD-2019-34460)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento cross-site scripting vulnerability , the vulnerability stems from the lack of WEB applications on the...

Magecart Group 4: A link with Cobalt Group?

Note: This blog post is a collaboration between the Malwarebytes and HYAS Threat Intelligence teams. Magecart is a term that has become a household name, and it refers to the theft of credit card data via online stores. The most common scenario is for criminals to compromise e-commerce sites by...

Ubercart - Moderately critical - Cross site scripting - SA-CONTRIB-2019-070

The Ubercart module provides a shopping cart and e-commerce features for Drupal. The order module doesn't sufficiently sanitize user input when displayed on an invoice leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a rol...

New Research From Imperva Bot Management Tracks Gift Card Abuse

Researchers at Imperva Bot Management formerly Distil Networks have been tracking online bots that target the e-commerce gift card systems of major online retailers. The threat actors they’ve studied show remarkable resourcefulness and adaptability. In a recent podcast, Imperva Bot Management’s...

Magecart Group Targets Routers Behind Public Wi-Fi Networks

A faction of the Magecart threat group is testing code that targets routers used to provide free or paid Wi-Fi services in public spaces and hotels. If successful, attackers would able to compromise these commercial-grade routers and be able to siphon payment data of users joining Wi-Fi networks ...

Ineffective Package Tracking Facilitates Fraud

This article discusses an e-commerce fraud technique in the UK. Because the Royal Mail only tracks packages to the postcode -- and not to the address - it's possible to commit a variety of different frauds. Tracking systems that rely on signature are not similarly vulnerable...

S-CMS e-commerce system aj***.php page fe*** parameter has SQL injection vulnerability

S-CMS e-commerce system is an e-commerce software. S-CMS e-commerce system aj.php page fe parameters exist SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

S-CMS e-commerce system aj***.php page has SQL injection vulnerability

S-CMS e-commerce system is an e-commerce software. S-CMS e-commerce system aj.php page has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

S-CMS e-commerce system aj***.php page L_*** parameter has SQL injection vulnerability

S-CMS e-commerce system is an e-commerce software. S-CMS e-commerce system aj.php page L parameter exists SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

S-CMS php version e-mall system v1.5 SQL injection vulnerability in background a**.p** C_** parameter

S-CMS e-commerce system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station of the product. S-CMS php version of the e-commerce system v1.5 background a.p C parameter there is a SQL injection vulnerability, the attacker can use t...

S-CMS e-commerce system aj***.php page st*** parameter has SQL injection vulnerability

S-CMS e-commerce system is an e-commerce software. S-CMS e-commerce system aj.php page st parameters exist SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

E-commerce: Bad bots are ready for the holidays. Are you?

The busiest time for online retailers is almost upon us—the holiday season. Each business is looking at ways to take advantage of cyber week when a significant portion of annual sales are made. At this time, preparation is well underway for Black Friday and Cyber Monday promotions. But another...

ThreatList: Amidst Data Breaches, Account Creation Fraud Soars in 2019

The first half of 2019 saw a 13 percent increase in fraudulent activity compared to the previous six months, with a spike in June representing the highest-volume bot attack that’s been recorded since 2016, according to an analysis from LexisNexis Risk Solutions. The firm’s report, with data glean...

XSS Vulnerability in Receiving Address Field of E-commerce System of Kunming Aoyuan Technology Co.

Kunming Aoyuan Technology Co., Ltd. is a high-tech enterprise engaged in system development, website construction and other Internet businesses. There is an XSS vulnerability in the receiving address field of the e-commerce system of Kunming Aoyuan Technology Co. Ltd, which can be exploited by...

FIN6 Switches Up PoS Tactics to Target E-Commerce

The financial cybergang known as the FIN6 group, known for going after brick-and-mortar point-of-sale PoS data in the U.S. and Europe, has changed up its tactics to target e-commerce sites. According to researchers at IBM X-Force Incident Response and Intelligence Services IRIS, FIN6 a.k.a. ITG08...

PilusCart 1.4.1 - Local File Disclosure

Exploit Title: PilusCart = 1.4.1 - Local File Disclosure Date: 29 August 2019 Exploit Author: Damian Ebelties https://zerodays.lol/ Vendor Homepage: https://sourceforge.net/projects/pilus/ Version: = 1.4.1 Tested on: Ubuntu 18.04.1 The e-commerce software 'PilusCart' is not validating the...

Magecart Hackers Compromise 80 More eCommerce Sites to Steal Credit Cards

Cybersecurity researchers have discovered over 80 Magecart compromised e-commerce websites that were actively sending credit card information of online shoppers to the attackers-controlled servers. Operating their businesses in the United States, Canada, Europe, Latin America, and Asia, many of...

CVE-2019-15489

laracom aka Laravel FREE E-Commerce Software 1.4.11 has search?q= XSS...

Cross site scripting

laracom aka Laravel FREE E-Commerce Software 1.4.11 has search?q= XSS...

CVE-2019-15489

CVE-2019-15489 affects laracom (Laravel FREE E-Commerce Software) 1.4.11. The vulnerability is a Cross-Site Scripting (XSS) flaw via the search query (search?q=) in the user search form. Documents describe potential client-side code execution, with Veracode noting possible cookie theft and keystr...