351 matches found
Referrer discount token amount can be manipulated
Handle cmichel Vulnerability details The Unlock.recordKeyPurchase function is called on each key purchase MixinPurchase.purchase and mints UDT tokens to the referrer. The amount to mint is based on the transaction's gas price which is controlled by the caller purchaser: uint tokensToDistribute =...
Free BrewDog beer with a side order of shareholder PII?
TL;DR BrewDog exposed the details of over 200,000 ‘Equity for Punks’ shareholders for over 18 months plus many more customers Every mobile app user was given the same hard coded API Bearer Token, rendering request authorisation useless It was therefore trivial for any user to access any other...
WordPress Package Quantity Discount plugin <= 1.1.1 - Multiple vulnerabilities
Multiple vulnerabilities Authenticated Arbitrary WordPress Options Change, Read and Deletion / Authenticated User Enumeration / Authenticated Plugin Settings Change, Import and Export were discovered by Jerome Bruandet NinTechNet in the WordPress Package Quantity Discount plugin versions = 1.1.1...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
Cross site request forgery (csrf)
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
CVE-2020-22403
Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...
CVE-2020-22403
CVE-2020-22403 affects the Express cart package for Node.js (v1.1.16). A CSRF vulnerability arises from missing/insufficient CSRF protections, enabling an attacker to perform unintended actions such as creating an administrator account or adding a discount code. The issue is confirmed across mult...
PT-2021-10761 · Npm · Express-Cart
Name of the Vulnerable Software and Affected Versions: Express cart versions 1.1.10 and earlier Express cart version 1.1.16 Description: A Cross Site Request Forgery CSRF issue allows attackers to add an administrator account, add a discount code, or have other unspecified impacts. This issue...
Google Cloud Certifications — Get Prep Courses and Practice Tests at 95% Discount
As cloud computing continues to grow, Google Cloud is quickly becoming one of the most popular solutions. However, relatively few engineers know this platform well. This leaves the door open for aspiring IT professionals who take the official exams. The Google Cloud Certifications Practice Tests ...
Google Cloud Certifications — Get Prep Courses and Practice Tests at 95% Discount
As cloud computing continues to grow, Google Cloud is quickly becoming one of the most popular solutions. However, relatively few engineers know this platform well. This leaves the door open for aspiring IT professionals who take the official exams. The Google Cloud Certifications Practice Tests ...
nopCommerce Cross-Site Scripting Vulnerability (CNVD-2021-14161)
nopCommerce is an open source e-commerce shopping cart software. A reflective cross-site scripting vulnerability exists in the Discount Coupon component in nopCommerce 4.30. An attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...
CVE-2021-26916
In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter...
CVE-2021-26916
CVE-2021-26916 in nopCommerce 4.30 is a reflected cross-site scripting vulnerability in the Discount Coupon component. The flaw allows an attacker to inject arbitrary web script or HTML via the DiscountCode parameter located in Filters/CheckDiscountCouponAttribute.cs. The description across multi...
CVE-2021-26916
In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter...
nopCommerce 跨站脚本漏洞
nopCommerce is an open source e-commerce shopping cart software. A reflective cross-site scripting vulnerability exists in the Discount Coupon component in nopCommerce 4.30. An attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...
chariotdiscount.com Cross Site Scripting vulnerability OBB-1411944
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Stubborn WooCommerce Plugin Bugs Gets Third Patch
E-commerce sites using the WordPress plugin Discount Rules for WooCommerce are being urged to patch two high-severity cross-site scripting flaws that could allow an attacker to hijack a targeted site. Two fixes for the flaws, first available on Aug. 22 and second on Sept. 2, failed to patch the...
Discount Rules for WooCommerce < 2.2.1 - Multiple Authorization Bypass
On August 20th 2020 WebARX disclosed multiple vulnerabilities affecting the Discount Rules for WooCommerce WordPress plugin, which were patched in version 2.1.0 see references. Some time after, the Wordfence Threat Intelligence Team discovered several additional authorization bypass vulnerabiliti...
Discount Rules for WooCommerce < 2.1.0 - Multiple Vulnerabilities
The Discount Rules for WooCommerce plugin versions below 2.1.0 suffers from multiple vulnerabilities such as SQL injection, authorization issues and unauthenticated stored cross-site scripting. The issues in this plugin are caused due to a lack of authorization and nonce token check. The plugin...