Malicious code in Be.Vlaaոderen.Basisregisters.ParcelRegistry.Aрi.BасkOffice (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaаnderen.Basisregisters.AddressRegistry.Apі.BackOffice.Abstractions (NuGet)

--- -= Per source details. Do not edit below this line.=-...

URL Redirection to Untrusted Site ('Open Redirect')

Overview Affected versions of this package are vulnerable to URL Redirection to Untrusted Site 'Open Redirect' in the endpoint of the library. An attacker can redirect users to malicious sites by exploiting the open redirect vulnerability. Remediation Upgrade Umbraco.Cms.Web.BackOffice to version...

Cross-Site Scripting (XSS)

prestashop/prestashop is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the customer thread feature allowing malicious file uploads through the front-office contact form. When an admin opens the attached file in back office, arbitrary JavaScript will be executed which can...

Storefront user can access history and most viewed data from matching back-office user with the same ID

Impact Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user...

CVE-2023-48296 OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID

OroPlatform is a PHP Business Application Platform BAP. Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4...

Improper Authorization

pimcore/ecommerce-framework-bundle is vulnerable to Improper Authorization. The vulnerability is due to a lack of permission enforcement within the admin/ecommerceframework/admin-order/list endpoint. An unauthorized user can access this endpoint without authorization, resulting in the ability to...

Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

Summary An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Details Permissions do not seem to be enforced when reaching the admin/ecommerceframework/admin-order/list endpoint allowing an authenticated user without the...

PT-2024-19007 · Pimcore · Pimcore Ecommerce Framework Bundle

Name of the Vulnerable Software and Affected Versions: Pimcore Ecommerce Framework Bundle versions prior to 1.0.10 Description: The issue allows an authenticated and unauthorized user to access the back-office orders list and query over the information returned due to a lack of enforced access...

PT-2024-18979 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.3 Description: PrestaShop is an open-source e-commerce platform. The issue arises because the isCleanHtml method is not used on a specific form, allowing the storage of a cross-site scripting payload in the...

Information Disclosure

oro/customer-portal is vulnerable to Information Disclosure. An access control vulnerability allows back-office users to bypass access control ACL restrictions and access information about Customer and Customer User menus...

Information Disclosure

oro/crm-call-bundle is vulnerable to Information Disclosure. The vulnerability allows back-office users to bypass access control ACL restrictions and gain unauthorized access to sensitive information, such as customer call logs and personal data...

Improper Access Control

oro/calendar-bundle is vulnerable to Improper Access Control. The vulnerability exists due to the lack of permission checks in the checkPermissions function of SystemCalendarEventController.php. This allows back-office users to access information from any system calendar event, bypassing ACL...

CVE-2023-32064

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and...

Security feature bypass

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1...

Security feature bypass

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and...

OroCRMCallBundle has incorrect call view page visibility

Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks...

GHSA-897W-JV7J-6R7G OroCRMCallBundle has incorrect call view page visibility

Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks...

OroCalendarBundle has incorrect system calendar events visibility

OroPlatform is a package that assist system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks...

GHSA-X2XM-P6VQ-482G OroCalendarBundle has incorrect system calendar events visibility

OroPlatform is a package that assist system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks...