PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Top Ecommerce Bugs and What They Mean

bugcrowd.com | blog | #bug-bounty | #data-exposure | #authentication | #owasp | #ecommerce | #misconfiguration | #retail | #broken-authentication
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Retail and ecommerce programs tripled in 2018, with 29% of submissions critical. Top issues: server misconfiguration with default credentials, broken authentication, and sensitive data exposure.
Published
Collected

Related coverage

blog · netspi.com
API Security Testing: The Overlooked Frontline in Application Penetration Testing
APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.
blog · hackerone.com
3 Bug Bounty Lessons From Retail & eCommerce Customers
HackerOne shares lessons from retail and eCommerce customers—where reflected XSS exceeds the all-industry average—and how diverse hacker skillsets and actionable insights speed up fixes.
blog · hackerone.com
Better than Cyber Monday: Ecommerce and Retail Edition of The Hacker-Powered Security Report
The Hacker-Powered Security Report's ecommerce and retail edition: programs doubled two years running, critical bounties run 80% above cross-industry levels, retailers rank third in bounties paid.
blog · hackenproof.com
New Discovery: Nokia left its cloud environment open, config details exposed
HackenProof disclosed that Nokia left one of its cloud environments open to the internet, exposing configuration details.
blog · blog.sentry.security
LLM API Misconfigurations
How LLM API misconfigurations break trust boundaries: exposed messages[], privileged roles, model choice, or generation parameters enable role injection, parameter tampering, and runaway token usage.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
Back