UBUNTU-CVE-2023-5421

An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was...

OTRS Cross-Site Scripting Vulnerability

OTRS is an application from OTRS Germany. A service management software. A security vulnerability exists in OTRS versions prior to 7.0.47, 8.0.37, and OTRS Community Edition versions 6.0.X through 6.0.34, which originates from the fact that an attacker with the privilege to create and change...

PT-2023-24740 · Easyuse · Easyuse Mailhunter Ultimate

Name of the Vulnerable Software and Affected Versions: EasyUse MailHunter Ultimate versions 2023 and earlier Description: The issue allows remote authenticated users to execute arbitrary SQL commands via the ctl00$ContentPlaceHolder1$txtCustSQL parameter in the create customer group function. Thi...

Bykea: Exposed trip_no in WebSocket Responses Leading to Excessive information Disclosure

The vulnerability in Bykea's WebSocket implementation was that the tripno identifier was exposed to drivers before a bid was accepted. This identifier could be used to access customer tracking URLs, revealing excessive information of the customers to unauthorized drivers. The issue was resolved b...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization through the V1/customers/me endpoint. An attacker can achieve information exposure and privilege escalation by triggering an insecure direct object...

CVE-2023-38218 Incorrect Authorization - Customer account takeover

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation...

CVE-2023-38250 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could lead in arbitrary code execution by an admin-privileg...

K000137106: HTTP/2 vulnerability CVE-2023-44487

Security Advisory Description The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-44487 also known as HTTP/2 Rapid Reset Attack Impact BIG-IP and...

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-4966 and CVE-2023-4967

Multiple vulnerabilities have been discovered in NetScaler ADC formerly Citrix ADC and NetScaler Gateway formerly Citrix Gateway. Affected Versions: The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities: NetScaler ADC and NetScaler...

WordPress Customer Reviews for WooCommerce Plugin <= 5.36.0 is vulnerable to Broken Access Control

Software Customer Reviews for WooCommerce Type Plugin Vulnerable versions = 5.36.0 Fixed in 5.36.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-45101 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8cd1a8d284a7 Credits Abdi Prana...

Achieving DORA Compliance with Qualys: A Comprehensive Approach

In the ever-changing landscape of finance and technology, it is crucial to have robust operational resilience and compliance frameworks. The Digital Operational Resilience Act DORA framework is a significant step in this direction, as it is intended to strengthen the resilience of financial...

Major CRM Provider Really Simple Systems Leaked 3M Customer Records

By Deeba Ahmed Really Simple Systems exposed its database publicly without any password or security authentication. KEY FINDINGS A global CRM… This is a post from HackRead.com Read the original post: Major CRM Provider Really Simple Systems Leaked 3M Customer Records...

CVE-2023-44075

Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the Address parameter...

CVE-2023-1832

An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant...

Motel One Group’s Swift Response Thwarts Ransomware Attack

By Waqas Europe's Leading Hotel Operator Takes Immediate Action to Protect Customer Data. This is a post from HackRead.com Read the original post: Motel One Groups Swift Response Thwarts Ransomware Attack...

Call centres. Outbound call verification

TL;DR: Stop asking customers to verify themselves Reduce friction and annoyance Empower your staff to be more effective Develop an alternative model that works best for you I’m sure we’ve all experienced authenticating ourselves when calling a company. You have a hopefully trusted contact number,...

Strategies for Integrating Pay-Per-Minute Chat Software in Customer Service

By Owais Sultan Enhancing customer interaction is paramount for any business. Integrating pay-per-minute chat software can revitalize your customer service, providing… This is a post from HackRead.com Read the original post: Strategies for Integrating Pay-Per-Minute Chat Software in Customer Serv...

Threat Roundup for September 22 to September 29

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between Sept. 22 and Sept. 29. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Malwarebytes MDR wins G2 awards for "Best ROI," "Easiest to Use," and more

Malwarebytes Managed Detection and Response MDR earned a placed in 12 new reports on G2s Fall 2023 reports, winning badges for "Easiest to do Business With," "Best Est. ROI," "Easiest to Use," and "Easiest Admin." Purpose-built for resource constrained teams, Malwarebytes MDR provides IT staff wi...

T-Mobile spills billing information to other customers

Some T-Mobile customers logged into their accounts on Wednesday to find another customers billing and account information showing on their online dashboards. T-Mobile denied there was an attack, but confirmed there had been a data leak. It said a "temporary system glitch" had misplaced some...