WordPress WooCommerce Eway Gateway Plugin <= 3.5.0 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce Eway Gateway Type Plugin Vulnerable versions = 3.5.0 Fixed in 3.5.1 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE N/A Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 9e6ef9dda0ad Credits WordfenceTeam...

WP eCommerce <= 3.11.3 - SQL Injection in sessionid

From vendor: "This vulnerability only affects users who use eWay as their payment gateway, have Gold Cart activated, and are using the as-of-yet-unreleased Theme Engine 2.0. We believe the number of users affected is likely close to zero, due to these conditions – but still, we highly recommend...

EWay 4 Default.APSX Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22528/info eWay is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser ...

eway-xss.txt

hey guys .. check out this new xss i just found ;P Vulnerable : eWay web : http://www.eway.no/eway XSS : http://127.0.0.1/path/default.aspx?pid="alert'bl4ck' Discovered By BLacK ZeRo [email protected] Best regards ,,...

XSS in eWay

hey guys .. check out this new xss i just found ;P Vulnerable : eWay web : http://www.eway.no/eway XSS : http://127.0.0.1/path/default.aspx?pid="scriptalert'bl4ck'/script Discovered By BLacK ZeRo [email protected] Best regards ,,...

EWay 4 - Default.APSX Cross-Site Scripting

EWay 4 - Default.APSX Cross-Site Scripting source: https://www.securityfocus.com/bid/22528/info eWay is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

EWay 4 - Default.APSX Cross-Site Scripting

source: https://www.securityfocus.com/bid/22528/info eWay is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...