6796 matches found
Log in to Customer portal can redirect user to a completely different URL
h3. Issue Summary Able to redirect to a completely different URL after login to JSM portal This is reproducible on Data Center: yes h3. Steps to Reproduce Set up a JSM project Open an incognito window Browse the link JIRABASEURL/servicedesk/customer/user/login?absolute=true&destination=//google.c...
CVE-2023-38035 – API Authentication Bypass on Sentry Administrator Interface
A vulnerability has been discovered in Ivanti Sentry, formerly known as MobileIron Sentry. This vulnerability impacts versions 9.18 and prior. The vulnerability does not impact other Ivanti products, such as Ivanti EPMM or Ivanti Neurons for MDM. If exploited, this vulnerability enables an...
Inventory Management System SQL注入漏洞
Inventory Management System is an inventory management system by stemword individual developers. Inventory Management System version 1.0 has a SQL injection vulnerability that originates from the parameter customer in the file app/ajax/searchsellpaymenreport.php that can lead to SQL injection...
PT-2023-29211 · Sourcecodester · Sourcecodester Inventory Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Inventory Management System version 1.0 Description: A critical issue was found in the SourceCodester Inventory Management System, affecting an unknown function of the file app/ajax/search sell paymen report.php. The manipulati...
PT-2023-29215 · Sourcecodester · Sourcecodester Inventory Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Inventory Management System version 1.0 Description: A critical issue has been found in the SourceCodester Inventory Management System, affecting an unknown functionality of the file app/ajax/search sales report.php. The...
Inventory Management System SQL注入漏洞
Inventory Management System is an inventory management system by stemword individual developers. An SQL injection vulnerability exists in Inventory Management System version 1.0, which stems from the parameter customer in the file app/ajax/searchsalesreport.php, which can lead to SQL injection...
CVE-2023-31939
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomerid parameter at customeredit.php...
CVE-2023-31939
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomerid parameter at customeredit.php...
CVE-2023-31939
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomerid parameter at customeredit.php...
CVE-2023-31939
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomerid parameter at customeredit.php...
PT-2023-23537 · Unknown · Online Travel Agency System
Name of the Vulnerable Software and Affected Versions: Online Travel Agency System version 1.0 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the costomer id parameter at the "customer edit.php" endpoint. This enables the attacker to manipulate database...
Citrix Content Collaboration ShareFile Improper Access Control Vulnerability
Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers...
Improper Input Validation
prestashop/prestashop is vulnerable to Improper Input Validation. The vulnerability exists in the delete function at CustomerMessage.php because the file input is not properly handled which allows an attacker delete an arbitrary file...
CVE-2023-4242
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about...
CVE-2023-4243
CVE-2023-4243 affects the FULL – Customer WordPress plugin. Root cause: improper authorization in the /install-plugin REST route allows authenticated users with subscriber-level or higher to install plugins from arbitrary remote locations, enabling potential code execution. Affected: FULL – Custo...
WordPress FULL Customer Plugin <= 2.2.3 is vulnerable to Sensitive Data Exposure
Software FULL Customer Type Plugin Vulnerable versions = 2.2.3 Fixed in 2.3 OWASP Top 10 A5: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-4242 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 83963600e826 Credits Ramuel Gall Required privilege...
WordPress FULL Customer Plugin <= 2.2.3 is vulnerable to Broken Access Control
Software FULL Customer Type Plugin Vulnerable versions = 2.2.3 Fixed in 2.3 OWASP Top 10 A6: Security Misconfiguration Classification Broken Access Control CVE CVE-2023-4243 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 72dc4e55ce85 Credits Ramuel Gall Required privile...
Citrix Hypervisor Security Bulletin for CVE-2023-20569, CVE-2023-34319 and CVE-2022-40982
Description of Problem An issue has been discovered in Citrix Hypervisor 8.2 CU1 LTSR that may allow malicious, privileged code in a guest VM to cause the host to crash. This issue has the following identifier: CVE-2023-34319 In addition, Intel has disclosed a security issue affecting certain Int...