How to collect data for ADC Gateway, Storefront, and VDA issues

To provide a comprehensive guide on how to properly collect data for issues with ADC when these issues are related to Gateway, Storefront, or VDA connectivity issues...

FAQ: Where is the setting to enable multiple monitors?

Q:Where is the setting to enable multiple monitors? A : To enable multiple monitors edit the web.config file in the StoreWeb -directory on the StoreFront server. The default location isc:\inetpub\wwwroot\citrix\Storeweb. In the web.config file, change showDesktopViewer=true to...

Infor Storefront B2B 1.0 SQL Injection

Exploit Title: Infor Storefront B2B 1.0 - 'usrname' SQL Injection Google Dork: inurl:storefrontb2bweb Date: 2020-06-27 Exploit Author: ratboy Vendor Homepage: https://www.insitesoft.com/infor-storefront/ Version: Infor Storefront Tested on: Windows All Versions POC Multiple Vulns python sqlmap.py...

Infor Storefront B2B 1.0 - 'usr_name' SQL Injection

Exploit Title: Infor Storefront B2B 1.0 - 'usrname' SQL Injection Google Dork: inurl:storefrontb2bweb Date: 2020-06-27 Exploit Author: ratboy Vendor Homepage: https://www.insitesoft.com/infor-storefront/ Version: Infor Storefront Tested on: Windows All Versions POC Multiple Vulns python sqlmap.py...

Infor Storefront B2B 1.0 - (usr_name) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Infor Storefront B2B 1.0 - 'usrname' SQL Injection Google Dork: inurl:storefrontb2bweb Exploit Author: ratboy Vendor Homepage: https://www.insitesoft.com/infor-storefront/ Version: Infor Storefront Tested on: Windows All Version...

Unspecified Vulnerability in MIRUMEE SOFTWARE Saleor Storefront

MIRUMEE SOFTWARE Saleor Storefront is a web-based, single-page e-commerce application from the Polish company MIRUMEE SOFTWARE. A security vulnerability exists in MIRUMEE SOFTWARE Saleor Storefront versions prior to 2.10.3, which can be exploited by attackers to extract email names and passwords...

CVE-2020-15085

In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0...

CVE-2020-15085

In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0...

CVE-2020-15085

In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0...

Design/Logic Flaw

In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0...

CVE-2020-15085 Client caching login operation with plaintext password in Saleor Storefront

In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0...

CVE-2020-15085

This CVE affects Saleor Storefront prior to version 2.10.3. Authentication-related data could be cached in the browser’s local storage, enabling an attacker with local access to extract email addresses and passwords. Prior to 2.10.0, the cached data could persist after logout; the issue is fixed ...

manual.aspdotnetstorefront.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1166568 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Storefront 3.12 - SAML authentication is not working.when using IDP like Forge Rock

Storefront 3.12 - SAML authentication is not working with IDP like Forge Rock. Error Message on Store Front Page Error Message: "There was a Failure with mapped account." Following Error message is thrown in the Event Viewer The security token failed validation...

StoreFront - Citrix Subscriptions Store service not starting up on one storefront server in server group

When launching a published application an error message israndomly seen . "Your apps are not available at this time. Please try again in a few minutes or contact your help desk with this information: Cannot contact Storefront" The issue is caused by subscription service store service not starting...

Shopify: Self XSS in Timeline

Copy the url javascript: XSS payload to any Timeline, then click url will trigger XSS. F796167 F796161 I previously reported a storefront url XSS at 841361, then admin copy the url to Timeline is possibly. Impact Self XSS...

CVE-2020-11883

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names...

CVE-2020-11883

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names...

Code injection

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names...

CVE-2020-11883

The CVE-2020-11883 entry concerns Divante Vue Storefront API (Divante vue-storefront-api up to v1.11.1) and storefront-api (up to v1.0-rc.1) used in VueStorefront PWA. The issue is an information-disclosure/stack-trace exposure: unexpected HTTP requests trigger an exception that reveals internal ...