38 matches found
MAL-2026-8819 Malicious code in sm8295yubf (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
CVE-2020-8819
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefore bypass...
CVE-2019-8819
creationtimestamp| type| source ---|---|--- 2024-01-31 08:01:44+00:00| seen| https://t.me/ctinow/176528 2024-01-31 09:41:53+00:00| seen| https://t.me/ctinow/176589 2024-01-31 18:16:54+00:00| seen| https://t.me/ctinow/176954 2024-02-01 08:36:55+00:00| seen| https://t.me/ctinow/177382...
Automated Logic Corporation WebCTRL Improper Restriction of XML External Entity Reference (CVE-2018-8819)
An XXE issue was discovered in Automated Logic Corporation ALC WebCTRL Versions 6.0, 6.1 and 6.5. An unauthenticated attacker could enter malicious input to WebCTRL and a weakly configured XML parser will allow the application to disclose full file contents from the underlying web server OS via t...
CVE-2015-8819
This CVE-2015-8819 entry is rejected and not used ; it does not represent an active vulnerability.
SUSE: Security Advisory (SUSE-SU-2020:1135-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Apple iCloud 10.x < 10.8 Multiple Vulnerabilities
According to its version, the iCloud application installed on the remote Windows host is 10.x prior to 10.8. It is, therefore, affected by multiple vulnerabilities: - Multiple arbitrary code execution vulnerabilities exist with in the WebKit due to multiple memory corruption issues. An...
WordPress WooCommerce CardGate Payment Gateway 3.1.15 Plugin - Payment Process Bypass Exploit
Exploit for php platform in category web applications Exploit Title: WordPress Plugin WooCommerce CardGate Payment Gateway 3.1.15 - Payment Process Bypass Exploit Author: GeekHack Vendor Homepage: https://www.cardgate.com www.curopayments.com Software Link:...
CVE-2020-8819
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefore bypass...
CVE-2020-8819
The CVE-2020-8819 entry refers to the CardGate Payments plugin for WooCommerce (up to version 3.1.15). The underlying issue is lack of origin authentication in the IPN callback processing function (cardgate/cardgate.php), which allows an attacker to remotely replace critical plugin settings (merc...
WordPress WooCommerce CardGate Payment Gateway 3.1.15 Bypass
Exploit Title: WordPress Plugin WooCommerce CardGate Payment Gateway 3.1.15 - Payment Process Bypass Discovery Date: 2020-02-02 Public Disclosure Date: 2020-02-22 Exploit Author: GeekHack Vendor Homepage: https://www.cardgate.com www.curopayments.com Software Link:...
WordPress Plugin WooCommerce CardGate Payment Gateway 3.1.15 - Payment Process Bypass
Exploit Title: WordPress Plugin WooCommerce CardGate Payment Gateway 3.1.15 - Payment Process Bypass Discovery Date: 2020-02-02 Public Disclosure Date: 2020-02-22 Exploit Author: GeekHack Vendor Homepage: https://www.cardgate.com www.curopayments.com Software Link:...
CardGate < 3.1.16 - Unauthorised Payments Hijacking and Order Status Spoofing
Lack of origin authentication CWE-346 at IPN callback processing function allow even unauthorized attacker to remotely replace critical plugin settings merchant id, secret key etc with known to him and therefore bypass payment process eg. spoof order status by manually sending IPN callback reques...
About the security content of iCloud for Windows 7.15 - Apple Support
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...
CVE-2019-8819
CVE-2019-8819 is a WebKit/WebKit-related memory corruption issue that could be triggered by processing malicious web content, potentially enabling arbitrary code execution. The initial entry notes a fix in iOS 13.2/iPadOS 13.2, tvOS 13.2, Safari 13.0.3, and related Apple components. Connected sou...
SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2019:3044-1)
This update for webkit2gtk3 to version 2.26.2 fixes the following issues : Webkit2gtk3 was updated to version 2.26.2 WSA-2019-0005 and WSA-2019-0006, bsc1155321 bsc1156318 Security issues addressed : CVE-2019-8625: Fixed a logic issue where by processing maliciously crafted web content may lead t...
About the security content of iCloud for Windows 7.15
About the security content of iCloud for Windows 7.15 This document describes the security content of iCloud for Windows 7.15 About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...
CVE-2018-8819
The CVE-2018-8819 issue affects Automated Logic Corporation (ALC) WebCTRL versions 6.0, 6.1 and 6.5. It is an XML External Entity (XXE) vulnerability in a weakly configured XML parser that allows an unauthenticated attacker to disclose full file contents from the underlying web server OS via the ...
How I Found CVE-2018-8819: Out-of-Band (OOB) XXE in WebCTRL
I like to do bug bounties from time to time, mostly when I am sacrificing sleep once the kids are finally out cold. This seemed like a worthy experience to document. Let me just start by saying I dont plan on going into the whole recon bits too deeply here. Maybe I will someday if I ever have...