6800 matches found
Kashipara Billing Software SQL Injection Vulnerability
Kashipara Billing Software is an application from Kashipara India. A SQL injection vulnerability exists in Kashipara Billing Software v1.0, which originates when the customerdetails parameter of the buyerinvoicesubmit.php page is processed without filtering the data and sending it to the database...
GHSA-VR7M-R9VM-M4WF PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)
Impact The isCleanHtml method is not used on this this form, which makes it possible to store an xss in DB. The impact is low because the html is not interpreted in BO, thanks to twig's escape mechanism. In FO, the xss is effective, but only impacts the customer sending it, or the customer sessio...
PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)
Impact The isCleanHtml method is not used on this this form, which makes it possible to store an xss in DB. The impact is low because the html is not interpreted in BO, thanks to twig's escape mechanism. In FO, the xss is effective, but only impacts the customer sending it, or the customer sessio...
CVE-2023-50343
HCL DRYiCE MyXalytics is impacted by an Improper Access Control Controller APIs vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users...
CVE-2023-50343
HCL DRYiCE MyXalytics is impacted by an Improper Access Control Controller APIs vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users...
Improper access control
HCL DRYiCE MyXalytics is impacted by an Improper Access Control Controller APIs vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users...
CVE-2023-50343 Improper Access Control (Controller APIs) affects DRYiCE MyXalytics
HCL DRYiCE MyXalytics is impacted by an Improper Access Control Controller APIs vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users...
CVE-2024-21628 XSS can be stored in DB from "add a message form" in order detail page (FO)
PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig's escape...
CVE-2023-45893
An indirect Object Reference IDOR in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...
CVE-2023-45893
An indirect Object Reference IDOR in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...
CVE-2023-45892
An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...
Information disclosure
An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...
Information disclosure
An indirect Object Reference IDOR in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...
CVE-2023-45893
An indirect Object Reference IDOR in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...
PT-2024-13913 · Hcl · Hcl Dryice Myxalytics
Name of the Vulnerable Software and Affected Versions: HCL DRYiCE MyXalytics affected versions not specified Description: The issue is related to an Improper Access Control vulnerability in Controller APIs. Certain API endpoints, such as "/api/v1/login" or "/users/id", are accessible to Customer...
Floorsight Software Customer Portal Security Vulnerability
Floorsight Software Customer Portal is a customer portal from Floorsight Software, Inc. in the United States. A security vulnerability exists in Floorsight Customer Portal Q3 2023. A remote attacker could exploit the vulnerability to view sensitive customer information...
CVE-2023-45893
An indirect Object Reference IDOR in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...
CVE-2023-45893
CVE-2023-45893 describes an indirect Object Reference (IDOR) vulnerability in the Floorsight Customer Portal Q3 2023, affecting the Order and Invoice pages. The issue allows an unauthenticated remote attacker to view sensitive customer information. Primary sources (NVD/Red Hat/CVE records) confir...
Floorsight Insights Security Breaches
Floorsight Software Floorsight Insights is an application from Floorsight Software, Inc. A security vulnerability exists in Floorsight Insights Q3 2023. A remote attacker could view sensitive customer information by exploiting the vulnerability...