6800 matches found
Pimcore Access Control Error Vulnerability
Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. An Access Control Error vulnerability exists in...
PT-2024-15153 · WordPress · Customer Reviews For Woocommerce
Name of the Vulnerable Software and Affected Versions: Customer Reviews for WooCommerce plugin for WordPress versions up to, and including, 5.38.9 Description: The issue arises from missing file type validation in the ivole import upload csv AJAX action, allowing authenticated attackers with...
WordPress Plugin Customer Reviews for WooCommerce Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
GHSA-G273-WPPX-82W4 Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts
Summary An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Details Permissions do not seem to be enforced when reaching the /admin/customermanagementframework/gdpr-data/search-data-objects...
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts
Summary An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Details Permissions do not seem to be enforced when reaching the /admin/customermanagementframework/gdpr-data/search-data-objects...
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list
Summary An authenticated and unauthorized user can access the list of potential duplicate users and see their data. Details Permissions do not seem to be enforced when reaching the /admin/customermanagementframework/duplicates/list endpoint allowing an authenticated user without the permissions t...
GHSA-C38C-C8MH-VQ68 Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list
Summary An authenticated and unauthorized user can access the list of potential duplicate users and see their data. Details Permissions do not seem to be enforced when reaching the /admin/customermanagementframework/duplicates/list endpoint allowing an authenticated user without the permissions t...
WP Customer Area < 8.2.1 - Subscriber+ Account Address Update
Description The plugin does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address. You may get the nonce from your save address form fetch"https://example.com/wp-admin/admin-ajax.php", "headers": "content-type":...
WordPress Export customers list csv for WooCommerce Plugin <= 2.0.7 is vulnerable to Broken Access Control
Software Export customers list csv for WooCommerce Type Plugin Vulnerable versions = 2.0.7 Fixed in 2.0.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e6d6b8682f99 Credits WordFence...
WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak
Description The plugin does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address. PoC Run the below command in the developer console of the browser when being logged in the blog as a subscriber and on your own edit accou...
WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak
Description The plugin does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address. Run the below command in the developer console of the browser when being logged in the blog as a subscriber and on your own edit account...
PT-2024-19008 · Pimcore · Pimcore Customer Management Framework
Name of the Vulnerable Software and Affected Versions: Pimcore Customer Management Framework versions prior to 4.0.6 Description: The issue allows an authenticated and unauthorized user to access the list of potential duplicate users and see their data. This occurs because permissions are not...
WP Customer Area < 8.2.1 - Subscriber+ Account Address Update
Description The plugin does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address. PoC You may get the nonce from your save address form fetch"https://example.com/wp-admin/admin-ajax.php", "headers": "content-type":...
WordPress Customer Reviews for WooCommerce Plugin <= 5.38.9 is vulnerable to Arbitrary File Upload
Software Customer Reviews for WooCommerce Type Plugin Vulnerable versions = 5.38.9 Fixed in 5.38.10 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6979 Patch priority Medium CVSS severity Medium 9.8 Developer Claim ownership PSID f2b42bb42f3b Credits Artem Guzhva...
Login as User or Customer (User Switching) <= 3.8 - Authentication Bypass
Description The Login as User or Customer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.8. This makes it possible for unauthenticated attackers to login as another user and escalate their privileges...
23andMe blames “negligent” breach victims, says it’s their own fault
In a surprising move, in a letter to legal representatives of victims of the recent 23andMe data breach, the company has laid the blame at the feet of victims themselves. 23andMe even goes as far as to claim that this wasn’t a data breach at 23andMe at all. The reasoning: “… unauthorized actors...
CVE-2023-49639
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customerdetails' parameter of the buyerinvoicesubmit.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-49639
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customerdetails' parameter of the buyerinvoicesubmit.php resource does not validate the characters received and they are sent unfiltered to the database...
Sql injection
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customerdetails' parameter of the buyerinvoicesubmit.php resource does not validate the characters received and they are sent unfiltered to the database...
Kashipara Billing Software SQL Injection Vulnerability
Kashipara Billing Software is an application from Kashipara India. A SQL injection vulnerability exists in the v1.0 version of Kashipara Billing Software, which originates when the custmerdetails parameter of the submitmateriallist.php page is processed without filtering the data and sending it t...