Page 11 of 89 results (0.012 seconds)

CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-2965

https://notcve.org/view.php?id=CVE-2015-2965

Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en osCommerce Japanese 2.2ms1j-R8 y anteriores permite a administradores remotos autenticados leer ficheros arbitrarios a través de vectores no especificados. • http://jvn.jp/en/jp/JVN96312698/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000091 http://www.bitscope.co.jp/tep/news.html http://www.securityfocus.com/bid/75472 http://www.securitytracker.com/id/1032736 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 3

CVE-2014-10033 – osCommerce 2.3.3.4 - 'geo_zones.php?zID' SQL Injection

https://notcve.org/view.php?id=CVE-2014-10033

SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3.3.4 and earlier allows remote administrators to execute arbitrary SQL commands via the zID parameter in a list action. Vulnerabilidad de inyección SQL en la función update_zone en catalog/admin/geo_zones.php en osCommerce Online Merchant 2.3.3.4 y anteriores permite a administradores remotos ejecutar comandos SQL arbitrarios a través del parámetro zID en una acción de listar. • https://www.exploit-db.com/exploits/31515 http://osvdb.org/show/osvdb/103365 http://www.exploit-db.com/exploits/31515 http://www.secgeek.net/oscommerce-v2x-sql-injection-vulnerability https://exchange.xforce.ibmcloud.com/vulnerabilities/91113 https://github.com/gburton/oscommerce2/commit/e4d90eccd7d9072ebe78da4c38fb048bfe31c902 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 1

CVE-2012-5795

https://notcve.org/view.php?id=CVE-2012-5795

The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. El módulo PayPal Express en osCommerce no comprueba si el nombre del servidor coincide con un nombre de dominio en el Common Name (CN) del asunto o el campo subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL a través de un certificado válido de su elección. • http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/79956 • CWE-20: Improper Input Validation •

CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 1

CVE-2012-5792

https://notcve.org/view.php?id=CVE-2012-5792

The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. El módulo Sage Pay Direct en osCommerce no comprueba si el nombre del servidor coincide con un nombre de dominio en el Common Name (CN) del asunto o el campo subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL a través de un certificado válido de su elección. • http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/79979 • CWE-20: Improper Input Validation •

CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 1

CVE-2012-5797

https://notcve.org/view.php?id=CVE-2012-5797

The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. El módulo PayPal Pro PayFlow en osCommerce no comprueba si el nombre del servidor coincide con un nombre de dominio en el Common Name (CN) del asunto o el campo subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL a través de un certificado válido de su elección. • http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/79954 • CWE-20: Improper Input Validation •