dotDefender Firewall 5.00.12865 / 5.13-13282 - Cross-Site Request Forgery

Exploit for php platform in category web applications + Credits: hyp3rlinx Vendor: ================== www.applicure.com Product: ===================== dotDefender Firewall Versions: 5.00.12865 / 5.13-13282 dotDefender is a Web application firewall WAF for preventing hacking attacks like XSS, SQL...

Magento the presence of XSS vulnerability, the online Mall may be the attacker's control-the vulnerability warning-the black bar safety net

Magento is an open source e-Commerce system, is a major business-oriented application, The processing of e-Commerce needs, including shopping, shipping, product reviews, etc., and ultimately for the construction of a multipurpose and wide application of e-Commerce websites to provide help. Magent...

Critical Flaws in Magento leave Millions of E-Commerce Sites at Risk

If you are using Magento to run your e-commerce website, it's time for you to update the CMS content management system now. Millions of online merchants are at risk of hijacking attacks due to a number of critical cross-site scripting XSS vulnerabilities in the Magento, the most popular e-commerc...

Magento Update Addresses XSS, CSRF Vulnerabilities

Magento patched 20 vulnerabilities last week, including a stored cross-site scripting XSS flaw in the e-commerce platform that could have let an attacker take over a site and create new admin accounts. Researchers at Sucuri dug up the XSS vulnerability while combing through research audits last...

E-commerce platform of Beijing 3D World Technology Co., Ltd. suffers from java deserialization vulnerability

Ltd. is a professional software and application service provider of domestic inspection and testing management platform, master data management platform, e-commerce platform and so on. A java deserialization vulnerability exists in the e-commerce platform of Beijing 3D World Technology Co., Ltd...

SAP Hybris E-commerce Suite VirtualJDBC SQL Injection

Application: SAP Hybris E-commerce Vendor URL: SAP Bugs: SQL Injection Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 14.02.2016 Reference: SAP replied “Due to the fact that this issue is inside Hybris cloud we don’t provide a security note. Please mention inside your...

SAP Hybris E-commerce Suite VirtualJDBC - Default Credentials

Application: SAP Hybris E-commerce Suite Versions Affected: SAP Hybris E-commerce Suite 5.1.0.3 Vendor URL: SAP Bugs: Default credentials Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 10.05.2016 Author: Alexey Tyurin ERPScan VULNERABILITY INFORMATION Class: CWE-259 Use...

RCE via CSRF in osCmax

High-Tech Bridge Security Research Lab discovered 2 PHP Local File Inclusion vulnerabilities in osCmax, a popular web-based e-commerce application and shopping cart. The vulnerabilities can be exploited to execute arbitrary PHP code on the target system. Successful exploitation of these...

Welcart e-Commerce < 1.5.3 - SQL Injection

The Welcart e-Commerce WordPress plugin was affected by a SQL Injection security vulnerability...

NetShen E-commerce System Exists IIS Write Permission, Source Code Leakage Vulnerabilities

NetShen Information Technology Beijing Co., Ltd. is a high-tech information security solution, product and service provider integrating technology research and development, manufacturing and comprehensive service. NetShen's e-commerce system suffers from IIS write permission and source code leaka...

Multiple Cross-Site Request Forgery Vulnerabilities in Magento

Magento is a professional open source PHP e-commerce system from Magento, USA, which provides permission management, search engine and payment gateway. Magento has multiple cross-site request forgery vulnerabilities. Allow remote attackers to perform certain unauthorized operations...

Magento E-Commerce Platform Magmi Plugin Information Disclosure

An information disclosure vulnerability has been discovered in Magento e-commerce platform Magmi Plugin. Successful exploitation results in access to Magento site credentials and database encryption key...

E-Commerce platform Magento plug-in is exposed 0day vulnerabilities-vulnerability warning-the black bar safety net

! Recently, the e-Commerce platform Magento, a very popular plug-in－Magmi is exposed out of the 0 day vulnerabilities, and there have been hackers use this vulnerability to attack. Magento is a professional open-source e-Commerce system. Magento design is very flexible, and also has a modular...

PayPal Inc Bug Bounty #117 - Session Fixation Vulnerability

Document Title: =============== PayPal Inc Bug Bounty 117 - Session Fixation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1509 EIBBP-31983 P2 Video: http://www.vulnerability-lab.com/getcontent.php?id=1615 Vulnerability Magazine:...

WordPress Collne Welcart e-Commerce Plugin <= 1.5.2 - Multiple SQL Injection

Multiple SQL Injection vulnerabilities are in admin.php in this plugin. These vulnerabilities allow an authenticated user to execute arbitrary SQL commands via the 1. searchcolumn or 2. switch parameter. Solution Update the plugin...

breal.net XSS vulnerability

Vulnerable URL: http://www.breal.net/ecommerce/recherche.cfm Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 17:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 100757 Google Pagerank| 0 VIP website status:|...

WordPress E-Commerce Shop Styling Plugin <= 2.5 - Local File Inclusion

This plugin is prone to a local file inclusion vulnerability, becuse the code in ./wp-ecommerce-shop-styling/includes/download.php is not sanitized. Solution Update the plugin...

Researchers Outline Bugs in Yahoo, PayPal, Magento

Researchers recently discovered a smattering of vulnerabilities in web applications and mobile applications belonging to companies like Yahoo, PayPal, Magento, and Shopify that could have led to account theft, session hijacking, and phishing, among other consequences. Hadji Samir, Ebrahim Hegazy,...

PayPal Inc - SecApproval & 2FA Auth Bypass Vulnerability

Document Title: =============== PayPal Inc - SecApproval & 2FA Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1486 Video: http://www.vulnerability-lab.com/getcontent.php?id=1485 Watch Video:...

PayPal Stored Cross Site Scripting

Document Title: =============== PayPal Bug Bounty 119 - Stored Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1588 Video: http://www.vulnerability-lab.com/getcontent.php?id=1587 Vulnerability Magazine:...