PT-2024-1795 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page...

PT-2024-1798 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier Description: The issue is related to an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could...

Adobe Commerce Cross-Site Request Forgery Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A cross-site request forgery vulnerability exists in Adobe Commerce, which stems from the impact of the presence of a cross-site request forgery CSRF...

Adobe Commerce operating system command injection vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce suffers from an operating system command injection vulnerability that stems from the presence of operating system command injection, whic...

Adobe Commerce resource management error vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A resource management error vulnerability exists in Adobe Commerce version 2.4.6-p3 and prior to versions 2.4.5-p5 and 2.4.4-p6, which stems from the...

Vulnerabilities fixed in Adobe Commerce and Magento

Adobe has fixed vulnerabilities in Adobe Commerce and Magento Open Source. The vulnerabilities allow an authenticated malicious person to cause a denial-of-service execute arbitrary code or to bypass a security measure. circumvention. Adobe has released updates to fix the vulnerabilities in Adobe...

Microsoft and Adobe Patch Tuesday, February 2024 Security Update Review

The new Microsoft Patch Tuesday Edition for February 2024 is now live! We invite you to join us to review and discuss the details of these security updates and patches. Microsoft Patch Tuesday for February 2024 Microsoft Patch Tuesdays February 2024 edition addressed 79 vulnerabilities, including...

Adobe Releases Security Updates for Multiple Products

Adobe has released security updates to address vulnerabilities in Adobe software. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Adobe Security Bulletins and apply the necessa...

APSB24-03 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, security feature bypass, and application denial-of-service...

Accepting Ethereum (ETH) for Businesses, An Overview

By Owais Sultan In the rapidly evolving world of digital commerce, cryptocurrencies have emerged as a game-changer, with Ethereum at the… This is a post from HackRead.com Read the original post: Accepting Ethereum ETH for Businesses, An Overview...

CVE-2024-0678

The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-0678 Order Delivery Date for WP e-Commerce <= 1.2 - Unauthenticated Stored Cross-Site Scripting

The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-0678

The CVE-2024-0678 entry concerns the WordPress plugin Order Delivery Date for WP e-Commerce. The vulnerability is a Stored Cross-Site Scripting (XSS) in the available-days-tf parameter, affecting all versions up to 1.2. Root cause: insufficient input sanitization and output escaping. Impact: unau...

CVE-2024-0678: Improper Neutralization of Input During Web Page Generation

The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2024-15742

Name of the Vulnerable Software and Affected Versions Order Delivery Date for WP e-Commerce plugin for WordPress versions up to, and including, 1.2 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticat...

BIT-LIFERAY-2023-42627

Multiple stored cross-site scripting XSS vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a 1...

WordPress Order Delivery Date for WP e-Commerce Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Order Delivery Date for WP e-Commerce Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0678 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9f553bdb479d Credits...

CLSA-2024-1705940980 Update of ca-certificates

Update to CKBI 2.64 from NSS 3.95 - Removed: - Certificate "Chambers of Commerce Root - 2008" - Certificate "E-Tugra Certification Authority" - Certificate "Global Chambersign Root - 2008" - Certificate "Hongkong Post Root CA 1" - Certificate "Symantec Class 1 Public Primary Certification...

VulnCheck KEV: CVE-2023-35813

Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3...

Welcart e-Commerce < 2.9.6 - Admin+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection in all versions up to 2.9.5 inclusive via deserialization of untrusted input in the welcartconfirmcheckajax function. This makes it possible for administrators to inject a PHP Object. No POP chain is present in the vulnerable plugin. If...