RCE in Zen Cart via Arbitrary File Inclusion

High-Tech Bridge Security Research Lab discovered critical vulnerability in a popular e-commerce software Zen Cart, which can be exploited by remote non-authenticated attackers to compromise vulnerable system. A remote unauthenticated attacker might be able to execute arbitrary PHP code on the...

Zen Cart 1.5.4 Code Execution / Information Disclosure

Zen Cart 1.5.4: Code Execution and Information Leak Security Advisory – Curesec Research Team 1. Introduction Affected Product: Zen Cart 1.5.4 Fixed in: partial fix via patch Partial Patch Link: https://www.zen-cart.com/showthread.php?218239-curesec-security-report-Patch-Included Vendor Contact:...

Zen Library [zen], 1.0.2 and below, XSS (Cross Site Scripting)

Zen Library zen, 1.0.2, XSS Cross Site Scripting...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that 1 delete a product via a deleteproductconfirm action to product.php or 2 disable a product via a setflag action to categories.php...

CVE-2011-4403

Multiple cross-site request forgery CSRF vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that 1 delete a product via a deleteproductconfirm action to product.php or 2 disable a product via a setflag action to categories.php...

CVE-2011-4403

Multiple cross-site request forgery CSRF vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that 1 delete a product via a deleteproductconfirm action to product.php or 2 disable a product via a setflag action to categories.php...

CVE-2011-4403

CVE-2011-4403 affects Zen Cart 1.3.9h. A CSRF vulnerability allows an attacker to make an authenticated administrator perform actions such as deleting a product (via product.php with action=delete_product_confirm) or disabling a product (via categories.php with setflag). The root cause is cross‑s...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in zencart-ja aka Zen Cart Japanese edition 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/initincludes/initsanitize.php and...

CVE-2015-0882

CVE-2015-0882 affects Zen Cart Japanese edition (zencart-ja) in versions 1.3 jp up to 1.3.0.2 jp8 and 1.5 ja up to 1.5.1 ja. The flaw is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script or HTML via a crafted parameter related to admin/includes/ini...

Zen Cart Cross-Site Scripting Vulnerability

Zen Cart is a PHP-based WEB application. Zen Cart suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions, or perform malicious...

Zen Cart Japanese version vulnerable to cross-site scripting

Overview Zen Cart is an open source system for creating shopping websites. Zen Cart Japanese version contains a cross-site scripting vulnerability. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact ...

JVN#44544694: Zen Cart Japanese version vulnerable to cross-site scripting

Zen Cart is an open source system for creating shopping websites. Zen Cart Japanese version contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the web browser of a user who is logged on as an administrator. Solution For Zen Cart v1.5 ja variants: Update t...

CVE-2014-9385

Cross-site request forgery CSRF vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger arbitrary code execution via a ZenPack upload, aka ZEN-15388...

CVE-2014-9252

Zenoss Core through 5 Beta 3 stores cleartext passwords in the session database, which might allow local users to obtain sensitive information by reading database entries, aka ZEN-15416...

CVE-2014-9248

Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a brute-force attack, aka ZEN-15406...

CVE-2014-9247

Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive 1 user account, 2 e-mail address, and 3 role information by visiting the ZenUsers aka User Manager page, aka ZEN-15389...

CVE-2014-6261

Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary code by 1 spoofing the callhome server or 2 deploying a crafted web site that is visited during a login session, aka ZEN-12657...

CVE-2014-6258

An unspecified endpoint in Zenoss Core through 5 Beta 3 allows remote attackers to cause a denial of service CPU consumption by triggering an arbitrary regular-expression match attempt, aka ZEN-15411...

CVE-2014-6257

Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions by using a web-endpoint URL to invoke an object helper method, aka ZEN-15407...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to hijack the authentication of arbitrary users, aka ZEN-12653...