GHSA-5834-XV5Q-CGFW Shopware vulnerable to persistent cross site scripting (XSS) in customer module

Impact Persistent XSS in customer module Patches We recommend updating to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plugin:...

Shopware vulnerable to persistent cross site scripting (XSS) in customer module

Impact Persistent XSS in customer module Patches We recommend updating to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plugin:...

T-Mobile agrees to pay customers $350 million in settlement over data breach

T-Mobile has agreed to pay $350 million to settle class action claims related to a 2021 cyberattack which impacted around 80 million US residents. Under the proposed settlement, T-Mobile would also commit to an aggregate incremental spend of $150 million for data security and related technology i...

PT-2022-20563 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions 5.7.0 through 5.7.13 Description: A persistent cross-site scripting XSS issue exists in the customer module. This allows for malicious scripts to be executed in the context of the user's session. Users are recommended to...

Citrix ADC and Citrix Gateway Security Bulletin for CVE-2022-27509

A vulnerability has been discovered in Citrix ADC and Citrix Gateway which enables an attacker to create a specially crafted URL that redirects to a malicious website. This vulnerability has the following identifier: CVE-ID| Description| CWE| Pre-conditions ---|---|---|--- CVE-2022-27509|...

Spryker Commerce OS Remote Command Execution Vulnerability

Spryker Commerce OS with spryker/http module versions prior to 1.7.0 suffer from a remote command execution vulnerability due to a predictable value in use. Title ===== SCHUTZWERK-SA-2022-003: Remote Command Execution in Spryker Commerce OS Status ====== PUBLISHED Version ======= 1.0 CVE referenc...

Information Leakage Vulnerabilities in the Intelligent Customer Service System of Beijing Qimo Technology Co.

Beijing SevenStranger Technology Co., Ltd. is a technology company with AI and communication technology as its core and data as its driving force. An information leakage vulnerability exists in the intelligent customer service system of Beijing Seven Mor Technology Co. Ltd, which can be exploited...

CVE-2022-2293

A vulnerability classified as problematic was found in SourceCodester Simple Sales Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /cissms/index.php/orders/create. The manipulation of the argument customername with the input alert"XSS" leads to cross...

Siemens EN100 Ethernet Module

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: EN100 Ethernet Module Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer. 2. RISK EVALUATION Successful exploitation of this vulnerability could...

For Finserv Ransomware Attacks, Obtaining Customer Data Is the Focus

Welcome back to the third installment of Rapid7's Pain Points: Ransomware Data Disclosure Trends blog series, where we're distilling the key highlights of our ransomware data disclosure research paper one industry at a time. This week, we'll be focusing on the financial services industry, one of...

Simplessus 路径遍历漏洞

Simplessus is a modern software for managing customer relationships from the German company Simplessus. A security vulnerability exists in Simplessus version 3.7.7 that stems from a path traversal vulnerability in Simplessus...

Sql injection

prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue...

CVE-2022-31101 SQL Injection in prestashop/blockwishlist

prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue...

CVE-2022-31101 SQL Injection in prestashop/blockwishlist

prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue...

What Are Shadow IDs, and How Are They Crucial in 2022?

Just before last Christmas, in a first-of-a-kind case, JPMorgan was fined $200M for employees using non-sanctioned applications for communicating about financial strategy. No mention of insider trading, naked shorting, or any malevolence. Just employees circumventing regulation using, well, Shado...

BlockWishList SQL Injection vulnerability

Impact An authenticated customer can perform SQL injection Patches Issue is fixed in 2.1.1...

GHSA-2JX3-5J9V-PRPP BlockWishList SQL Injection vulnerability

Impact An authenticated customer can perform SQL injection Patches Issue is fixed in 2.1.1...

The vulnerability of the CRM User Management Framework component of the Oracle Common Applications application in the Oracle E-Business Suite system, which allows a perpetrator to gain unauthorized access to protected information or to modify, add, or delete data.

The vulnerability of the CRM User Management Framework component of the Oracle Common Applications application in the Oracle E-Business Suite exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker who operates remotely to gain unauthorized acces...

Avos ransomware group expands with new attack arsenal

By Flavio Costa, Chris Neal and Guilherme Venere. In a recent customer engagement, we observed a month-long AvosLocker campaign. The attackers utilized several different tools, including Cobalt Strike, Sliver and multiple commercial network scanners. The initial ingress point in this incident...

Malicious code in customer-stories-feed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 821bb90da51629b7a3ced3499eee822c96045e3b8dc9cad26684c1a2697b1826 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...