CVE-2010-2635

SQL injection vulnerability in IBM WebSphere Commerce 6.0 before 6.0.0.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters to "Commerce Organization Admin Console JavaServer pages."...

CVE-2010-2636

CVE-2010-2636 : Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Commerce 7.0 sample store pages prior to 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2010-2635

The CVE-2010-2635 vulnerability affects IBM WebSphere Commerce 6.0 prior to 6.0.0.10. It is a SQL injection flaw where remote authenticated users can cause arbitrary SQL execution via unspecified parameters to the Commerce Organization Admin Console JavaServer pages. Root cause: improper handling...

CVE-2010-2636

Multiple cross-site scripting XSS vulnerabilities in sample store pages in IBM WebSphere Commerce 7.0 before 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...

PT-2010-4161

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce version 6.0 before 6.0.0.10 Description The issue allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters to "Commerce Organization Admin Console JavaServer pages." Recommendations...

PT-2010-4162

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce version 7.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in sample store pages. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2010-2635: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in IBM WebSphere Commerce 6.0 before 6.0.0.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters to "Commerce Organization Admin Console JavaServer pages."...

CVE-2010-2636: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in sample store pages in IBM WebSphere Commerce 7.0 before 7.0.0.1 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2009-2751

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

CVE-2009-2752

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...

Design/Logic Flaw

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

Information disclosure

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...

CVE-2009-2751

CVE-2009-2751 involves IBM WebSphere Commerce 7.0, where the same cryptographic key is used for both session attributes and merchant data encryption. The underlying cause is the reuse of a single key for distinct encryption domains, which the documents describe as having an unspecified impact and...

CVE-2009-2751

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

CVE-2009-2752

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...

CVE-2009-2752

CVE-2009-2752 affects IBM WebSphere Commerce 7.0. The vulnerability is a failure to properly encrypt data in the database, which can allow local users to obtain sensitive information by defeating cryptographic protections. The available documents do not specify affected components, root cause det...

CVE-2009-2752: Undefined Security Weakness

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...

CVE-2009-2751: Undefined Security Weakness

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

Improper access control

The 1 Net.Commerce and 2 Net.Data components in IBM WebSphere Commerce Suite store sensitive information under the web root with insufficient access control, which allows remote attackers to discover passwords, and database and filesystem details, via direct requests for configuration files...

CVE-2009-2956

The 1 Net.Commerce and 2 Net.Data components in IBM WebSphere Commerce Suite store sensitive information under the web root with insufficient access control, which allows remote attackers to discover passwords, and database and filesystem details, via direct requests for configuration files...