Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book

Impact There is a possibility to save XSS code in province field in the Checkout and Address Book and then execute it on these pages. The problem occurs when you open the address step page in the checkout or edit the address in the address book. This only affects the base UI Shop provided by...

CVE-2024-25511

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicnew.aspx...

CVE-2024-25510

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/addresspublicshow.aspx...

PT-2024-20973 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/AddressBook/address public new.aspx" API endpoint. Recommendations: For...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the id parameter of the /AddressBook/addresspublicnew.aspx file that lacks validation of externally entered SQL statements. An attacker can exploit this...

PT-2024-20972 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/AddressBook/address public show.aspx" API endpoint. Recommendations: For...

Cross-Site Scripting

sylius/sylius is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input anitaization within the Province field in the Address Book. This allows attackers to inject malicious scripts, which can be executed in the browsers of other users who view the Province field...

GHSA-MW82-6M2G-QH6C Duplicate Advisory: Sylius Cross Site Scripting (XSS) vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7prj-9ccr-hr3q. This link is maintained to preserve external references. Original Description Sylius 1.12.13 is vulnerable to Cross Site Scripting XSS via the "Province" field in Address Book...

CVE-2024-29376

Sylius 1.12.13 is vulnerable to Cross Site Scripting XSS via the "Province" field in Address Book...

PT-2024-22871

Name of the Vulnerable Software and Affected Versions: Sylius versions 1.12.13 through 1.12.15 Sylius versions prior to 1.13.1 Description: The issue is related to Cross Site Scripting XSS via the "Province" field in Address Book. There is a possibility to save XSS code in the province field in t...

CVE-2024-29376

Sylius 1.12.13 is vulnerable to Cross Site Scripting XSS via the "Province" field in Address Book...

CVE-2024-29376

Summary: CVE-2024-29376 affects Sylius 1.12.13 with a Cross Site Scripting (XSS) flaw in the Province field of the Address Book (and Checkout flow). The public advisories confirm an XSS payload risk when saving/entering the Province value, enabling script execution on affected pages. Root cause d...

CVE-2024-29376

Sylius 1.12.13 is vulnerable to Cross Site Scripting XSS via the "Province" field in Address Book...

CVE-2024-23759

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function...

CVE-2023-6230

Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.: Satera LBP670C...

CVE-2023-6232

Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.: Satera LBP670C...

CVE-2023-6230

Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.: Satera LBP670C...

Buffer overflow

Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.: Satera LBP670C...

Buffer overflow

Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.: Satera LBP670C...

CVE-2023-6232

Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.: Satera LBP670C...