CVE-2022-24742 Exposure of Sensitive Information Due to Incompatible Policies in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect...

CVE-2022-24733

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

Code injection

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

CVE-2022-24733 Improper Restriction of Rendered UI Layers or Frames in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

CVE-2022-24733 Improper Restriction of Rendered UI Layers or Frames in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

CVE-2022-24733

Sylius (open-source eCommerce platform) has a clickjacking vulnerability in versions prior to 1.9.10, 1.10.11, and 1.11.2, where an attacker-controlled page could load the site in an iframe and overlay the interface. Root cause: missing X-Frame-Options header allowing framing. Impact: potential U...

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting XSS code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the...

In China and Japan, Malicious Botnets Surge Amidst Holiday Ecommerce Traffic

Akamai data shows that in the days leading up to and including Lunar New Year, the activity of malicious bots increased 15% in China over the previous month. While a similar surge occurs during the high-traffic seen at the end-of-year holidays in EMEA and the U.S. — China and Japan present a...

CVE-2022-24753 Code injection in Stripe CLI on windows

Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are stripe login, stripe config -e, stripe community, and stripe open. MacOS and Linu...

WordPress eCommerce Addon plugin < 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress eCommerce Addon plugin versions 1.3. Solution Update the WordPress eCommerce Addon plugin to the latest available version at least 1.3...

WordPress eCommerce Addon plugin < 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress eCommerce Addon plugin versions 1.3. Solution Update the WordPress eCommerce Addon plugin to the latest available version at least 1.3...

WordPress WordPress eCommerce Plugin – Studiocart plugin < 2.3.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WordPress eCommerce Plugin – Studiocart plugin versions 2.3.1. Solution Update the WordPress WordPress eCommerce Plugin – Studiocart plugin to the latest available version at least 2.3.1...

WordPress WordPress eCommerce Plugin – Studiocart plugin < 2.3.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WordPress eCommerce Plugin – Studiocart plugin versions 2.3.1. Solution Update the WordPress WordPress eCommerce Plugin – Studiocart plugin to the latest available version at least 2.3.1...

WordPress WoowGallery – image gallery / content gallery / ecommerce gallery / social gallery / video gallery / album photo gallery plugin <= 1.1.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WoowGallery – image gallery / content gallery / ecommerce gallery / social gallery / video gallery / album photo gallery plugin versions = 1.1.8. Solution Update the WordPress WoowGallery – image gallery / content gallery /...

WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking plugin <= 3.6.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking plugin versions = 3.6.2. Solution Update the WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion...

WordPress Sync eCommerce NEO plugin <= 1.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Sync eCommerce NEO plugin versions = 1.4. Solution No patched version available...

WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking plugin <= 3.6.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking plugin versions = 3.6.2. Solution Update the WordPress WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking plugin to the...

WordPress Sync eCommerce NEO plugin <= 1.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Sync eCommerce NEO plugin versions = 1.4. Solution No patched version available...

Why ATO Attacks Are Attacks on Your Customers

Motivated by the continual surge in eCommerce, which according to UNCTAD has seen unprecedented growth during the COVID-19 pandemic, retailers are scrambling to adapt to a shift in consumer demand and create unique customer experiences that set them apart from the competition. The rise in online...

MartFury Marketplace Cross Site Scripting

Document Title: =============== MartFury Marketplace - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2282 Release Date: ============= 2022-02-17 Vulnerability Laboratory ID VL-ID: ====================================...