RSS   Podatności dla 'Online merchant'   RSS

2018-11-05
 
CVE-2018-18966

CWE-20
 
 
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file.

 
 
CVE-2018-18965

CWE-20
 
 
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename).

 
 
CVE-2018-18964

CWE-20
 
 
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several extensions in which contained HTML can be executed, such as the svg extension.

 
2015-01-13
 
CVE-2014-10033

 
 
SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID parameter in a list action.

 
2012-09-19
 
CVE-2012-2991

 
 
The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.

 
2012-05-27
 
CVE-2012-2935

CWE-79
 
 
Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Checkout/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, a different vulnerability than CVE-2012-1059.

 
 
CVE-2012-1792

CWE-79
 
 
Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, which is not properly handled in an error message. NOTE: this might not be a vulnerability, since the ability to access oscommerce/index.php during installation may already imply administrator privileges.

 
2012-02-13
 
CVE-2012-1059

CWE-79
 
 
Cross-site scripting (XSS) vulnerability in the shirt module in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the "Front" field.

 
2012-01-26
 
CVE-2012-0312

CWE-79
 
 
Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

 

 >>> Vendor: Oscommerce 9 Produkty
Oscommerce
Osc2nuke
Php point of sale
Customer testimonials
Poll booth
Finnish bank payment
Luottokunta
Online merchant
Ce phoenix

Copyright 2024, cxsecurity.com

 

Back to Top