6788 matches found
CVE-2021-4195 XSS in Firmanet Software and Technology Customer Relation Manager
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Firmanet Software and Technology Customer Relation Manager allows XSS Targeting HTML Attributes. This issue affects Customer Relation Manager: before 2022.03.13...
CVE-2021-4195 XSS in Firmanet Software and Technology Customer Relation Manager
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Firmanet Software and Technology Customer Relation Manager allows XSS Targeting HTML Attributes. This issue affects Customer Relation Manager: before 2022.03.13...
CVE-2021-4195
CVE-2021-4195 affects Firmanet Software and Technology Customer Relation Manager. The issue is an XSS vulnerability caused by improper neutralization of input during web page generation, enabling XSS targeting HTML attributes. Affected version window is before 2022.03.13. The provided documents d...
Dolibarr 16 pre-auth contact database dump
Dolibarr version 16 use auxiliary/scanner/http/dolibarr/16contactdump msf undefined16contactdump show actions ...actions... msf undefined16contactdump set ACTION msf undefined16contactdump show options ...show and set options... msf undefined16contactdump run This module requires Metasploit:...
PT-2023-12734
Name of the Vulnerable Software and Affected Versions Firmanet Software and Technology Customer Relation Manager versions prior to 2022.03.13 Description The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This means an...
Shipt: Improper Access Control + Financial fraud allows attacker to disclose + add arbitrary products to another's user's order
The vulnerability allowed an attacker to add arbitrary products to another user's order before it was placed. The attacker could also disclose the content of the victim's order, including their physical address. This was possible due to improper access control and lack of input validation on the...
Fastly Secret Disclosure
Correspondence from Fastly declined to comment regarding new discovered vulnerabilities within their website. Poor practices regarding password changes. 1. Reset user password 2. Access link sent 3. Temporary password sent plaintext // HTTP POST request POST...
Computer Parts Sales and Inventory System SQL注入漏洞
Computer Parts Sales and Inventory System is a computer parts sales and inventory system by Warren Daloyan, an individual developer. SourceCodester Computer Parts Sales and Inventory System version 1.0 suffers from a SQL injection vulnerability that originates from a security issue in the file...
Wiz and SentinelOne announce exclusive partnership to deliver end to end cloud security
Leading cybersecurity companies partner to increase customer value and disrupt the enterprise security industry...
Malicious Package
Overview ing-feat-customer-video is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
The benefits of a customer-centric cloud security mindset
Why a customer focus unlocks new levels of innovation and enables security team success...
MAL-2023-524 Malicious code in ing-feat-customer-video (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c3fc5de716b81fb2390c30a9d7aa59bfc20904a4e5361564c1bc356cd5d0011 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Hackers Exploit Containerized Environments to Steal Proprietary Data and Software
A sophisticated attack campaign dubbed SCARLETEEL is targeting containerized environments to perpetrate theft of proprietary data and software. "The attacker exploited a containerized workload and then leveraged it to perform privilege escalation into an AWS account in order to steal proprietary...
Wordfence WooCommerce 2FA: Set Up This New Feature To Protect Your Customers
On February 15, we made the exciting announcement that the latest release of Wordfence, version 7.9.0, includes a new feature: WooCommerce 2FA two-factor authentication for customer level users. What does this mean for you as an e-commerce store operator? And how can you start using this feature?...
PT-2023-16777 · Sourcecodester · Sourcecodester Computer Parts Sales/Inventory System
Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Parts Sales and Inventory System version 1.0 Description: A vulnerability has been found in the SourceCodester Computer Parts Sales and Inventory System, affecting unknown code of the file customer.php. The manipulatio...
SourceCodester Computer Parts Sales and Inventory System 跨站脚本漏洞
Computer Parts Sales and Inventory System is a computer parts sales and inventory system by Warren Daloyan, an individual developer. A cross-site scripting vulnerability exists in SourceCodester Computer Parts Sales and Inventory System version 1.0, which stems from unknown problematic code in th...
LastPass Reveals Second Attack Resulting in Breach of Encrypted Password Vaults
LastPass, which in December 2022 disclosed a severe data breach that allowed threat actors to access encrypted password vaults, said it happened as a result of the same adversary launching a second attack on its systems. The company said one of its DevOps engineers had their personal home compute...
SQL Injection in 'core/ajax/ajax_data.php'
Description There exists an SQL injection affecting the customerid parameter located in the file core/ajax/ajaxdata.php Let's take a look at the following code: https://github.com/unilogies/bumsys/blob/9dc2de204116297a7e528c38bc3b1e89bf40f907/core/ajax/ajaxdata.phpL537 sql where stockproductid =...