CVE-2023-32694

Saleor Core is a composable, headless commerce API. Saleor's validatehmacsignature function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could...

Design/Logic Flaw

Saleor Core is a composable, headless commerce API. Saleor's validatehmacsignature function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could...

CVE-2023-32694 Non-constant time HMAC comparison in Adyen plugin in Saleor

Saleor Core is a composable, headless commerce API. Saleor's validatehmacsignature function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could...

CVE-2023-32694

CVE-2023-32694 affects Saleor Core where the non-constant time HMAC signature validation in the Adyen plugin can be exploited via timing attacks to infer the secret key and forge events, potentially corrupting database state (e.g., marking an order as paid). Concrete details across connected sour...

CVE-2023-32694 Non-constant time HMAC comparison in Adyen plugin in Saleor

Saleor Core is a composable, headless commerce API. Saleor's validatehmacsignature function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could...

CVE-2023-32694

Saleor Core is a composable, headless commerce API. Saleor's validatehmacsignature function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could...

Saleor security vulnerabilities

Github saleor is a headless GraphQL commerce platform that delivers a super-fast, dynamic, personalized shopping experience. Beautiful online store, anywhere, on any device. A security vulnerability exists in Saleor Core that stems from vulnerability to timing attacks, which can be exploited by a...

CVE-2023-32694: Observable Discrepancy

Saleor Core is a composable, headless commerce API. Saleor's validatehmacsignature function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could...

SUSE CVE-2017-12618

Apache Portable Runtime Utility APR-util 1.6.0 and prior fail to validate the integrity of SDBM database files used by aprsdbm functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and...

Database Integrity Vulnerabilities in Boeing’s Onboard Performance Tool

This post is released in a co-ordinated manner with Boeing. TL;DR: Security gaps in older, unprotected Windows desktop versions of Boeing’s Onboard Performance Tool OPT could make certain Electronic Flight Bags EFB more susceptible to attack. In particular, OPT’s use of plain text configuration...

CVE-2022-32248

Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the database. This leads to an impact on the integrity of the data...

Input validation

Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the database. This leads to an impact on the integrity of the data...

CVE-2022-32248

Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the database. This leads to an impact on the integrity of the data...

CVE-2022-32248

CVE-2022-32248 describes an input validation error in SAP S/4HANA (Manage Checkbooks component) affecting versions 101–106. The issue allows an attacker to insert or edit the value of an existing database field, leading to data integrity impact. The CVSS shows a network attack vector, no authenti...

CVE-2020-3378: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface for Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An...

Engel & Völkers Technology GmbH: SQL Injection at /displayPDF.php (printshop.engelvoelkers.com)

Intro An SQL injection has been identified. Through this vulnerability an attacker could execute arbitrary SQL statements compromising the integrity of the database and obtain sensitive information, violating the confidentiality of the data. Given the great impact of the vulnerability and...

Unspecified Vulnerability in Oracle Database Mobile/Lite Server

Oracle Database Mobile/Lite Server is the United States Oracle Oracle company for mobile devices with the database. An unspecified vulnerability exists in Oracle Database Mobile/Lite Server versions 10.3.0.3, 11.3.0.2, and 12.1.0.0 that could allow a remote, authenticated user to affect the...

PhpVibe 3.1 Cross Site Scripting / SQL Injection

Exploit Title: PhpVibe 3.1 - Multiples Vulnerabilites Product: PhpVibe Official site: http://phprevolution.com/ Risk Level: High Exploit Author: Esac Demo : http://playviralvideos.com Last Checked: 13/08/2013 +----------+ | OVERVIEW | +----------+ PhpVibe is a Premium video sharing cms with or...

AlstraSoft EPay Enterprise 4.0 SQL Injection

Exploit Title: AlstraSoft EPay Enterprise v4.0 Blind SQL Injection Google Dork: Copyright @ 2010 iPayGold.com Date: Decembar/6/2011 Author: Don BalcanCrew & BalcanHack Software Link: http://www.alstrasoft.com/epayenterprise.htm Version: 4.0 Tested on: Apache/1.3.37 An attacker may execute arbitra...

Esselbach Storyteller CMS System Version 1.8 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Esselbach Storyteller CMS System Version 1.8 page.php Remote SQL Injection Vulnerability Date: March, 9th 2011 GMT +7 Author: Shamus Software Link: http://www.esselbach.com/ Version : Esselbach Storyteller CMS System Version 1.8...