PayPal Open Redirection

Title: ====== Paypal BugBounty 11 - Redirection Web Vulnerability Date: ===== 2012-11-22 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=648 VL-ID: ===== 648 Common Vulnerability Scoring System: ==================================== 2 Introduction: ============= PayPal i...

Citadel Trojan Updates with Dynamic Config Mechanism that Streamlines Fraud Activity

The elusive authors of the Citadel Trojan have released a new version of their banking botnet malware and service. The latest version, the sixth since it debuted in January and dubbed Rain, includes a dynamic configuration mechanism that allows botmasters to inject malicious content to compromise...

Unirgy uStoreLocator Magento Extension SQL Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: SQL Injection product: Unirgy uStoreLocator - Magento extension vulnerable version: =2.0.1 impact: High homepage: http://www.unirgy.com/ found: 2012-06-18 by: K...

WordPress Shopp v1.0.17 - eCommerce Plugin <= XSS/LFI Vulnerabilities

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

PayPal Cross Site Scripting

Title: ====== Paypal BugBounty 9 - Persistent Web Vulnerabilities Date: ===== 2012-10-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=646 VL-ID: ===== 646 Common Vulnerability Scoring System: ==================================== 7.2 Introduction: ============= PayPal...

Paypal BugBounty #9 - Persistent Web Vulnerabilities

Document Title: =============== Paypal BugBounty 9 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=646 Release Date: ============= 2012-10-01 Vulnerability Laboratory ID VL-ID: ==================================== 646...

Dream Ecommerce SQL Injection

Exploit Title: dreamecommerce sql injection Vulnerability Google Dork: inurl:board/sview.php?boardname= Date: 09/28/2012 Author: Crim3R download Link Or Vendor Home: http://dreamecommerce.net/ Tested on: all ================================== boardname parametr is injectable D3M0 :...

CVE-2011-5198

SQL injection vulnerability in search.php in Neturf eCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the SearchFor parameter. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in search.php in Neturf eCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the SearchFor parameter. NOTE: some of these details are obtained from third party information...

CVE-2011-5198

CVE-2011-5198 is a confirmed SQL injection in the Neturf eCommerce Shopping Cart, targeting the search.php endpoint. The vulnerability allows remote attackers to append arbitrary SQL via the SearchFor parameter (no authentication required, network access). CVSS v2 metrics indicate a base score of...

CVE-2011-5198

SQL injection vulnerability in search.php in Neturf eCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the SearchFor parameter. NOTE: some of these details are obtained from third party information...

SSL Digital Certificate Security Issues Put CAs on Notice

It’s been a rough couple of years for the security of fundamental Internet infrastructure technologies such the domain name system DNS, SSL and digital certificates. Hackers are taking aim at these core technologies at the heart of ecommerce and online communication, and are more often than not,...

Total Shop UK eCommerce Generic Cross-Site Scripting

/------------------------------------------------------ | Total Shop UK eCommerce Generic Cross-Site Scripting | ------------------------------------------------------/ Summary ======= The open source version of Total Shop UK eCommerce based on CodeIgniter version 2.1.2 is subject to a cross-site...

Power-eCommerce - Multiple Cross-Site Scripting Vulnerabilities

Power-eCommerce - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/55216/info Power-eCommerce is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execut...

Power-eCommerce CMS Cross Site Scripting

Exploit Title: Power-eCommerce CMS Cross Site Scripting Vulnerability Google Dork:intext:"Site Powered by: Power-eCommerce.com" Date: 08/24/2012 Author: Crim3R Vendor Home : http://www.power-ecommerce.com/ Tested on: all ======================================== id parametr in Questions.asp and 7 ...

Power-eCommerce - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/55216/info Power-eCommerce is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user i...

CVE-2011-5104

Cross-site scripting XSS vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the customtext parameter. NOTE: some of these details are obtained from third party...

CVE-2012-4236

Cross-site scripting XSS vulnerability in the refreshpage function in application/modules/main/views/top.php in Total Shop UK eCommerce Open Source before 2.1.2p1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

Cross site scripting

Cross-site scripting XSS vulnerability in the refreshpage function in application/modules/main/views/top.php in Total Shop UK eCommerce Open Source before 2.1.2p1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2012-4236

The vulnerability CVE-2012-4236 affects Total Shop UK eCommerce Open Source (CodeIgniter-based) before version 2.1.2_p1. Root cause: the refresh_page function in /application/modules/_main/views/_top.php writes the entire URL (including PATH_INFO) to Javascript without sufficient sanitisation, en...