CVE-2024-37889

MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6...

CVE-2024-37889 MyFinances Allows Unauthorized Access to Other Customer Data

MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6...

CVE-2024-37889

MyFinances vulnerability CVE-2024-37889 affects the MyFinances web application, where a signed-in user can access invoices and PII/financial data from other accounts via a specific method. Root cause details are not fully disclosed in the provided documents beyond the access mechanism; the impact...

LNbits Security Vulnerabilities

LNbits is a Python server open-sourced by LNbits. A security vulnerability exists in versions of LNbits prior to 0.12.6 that stems from the fact that if a payment invoice in Eclair is not cleared within an internal timeout period, it will be treated as a payment failure, even if the payment is...

CVE-2024-30517

Missing Authorization vulnerability in Sliced Invoices.This issue affects Sliced Invoices: from n/a through 3.9.2...

CVE-2024-30517

Missing Authorization vulnerability in Sliced Invoices.This issue affects Sliced Invoices: from n/a through 3.9.2...

CVE-2024-30517 WordPress Sliced Invoices plugin <= 3.9.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sliced Invoices.This issue affects Sliced Invoices: from n/a through 3.9.2...

CVE-2024-30517

CVE-2024-30517 is a Missing/Broken Authorization vulnerability in the WordPress plugin Sliced Invoices, affecting versions up to and including 3.9.2. The root cause is missing authorization checks that can enable unauthorized access to invoices or related data. Multiple connected sources corrobor...

CVE-2024-30517 WordPress Sliced Invoices plugin <= 3.9.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sliced Invoices.This issue affects Sliced Invoices: from n/a through 3.9.2...

PT-2024-23444 · Unknown · Sliced Invoices

Name of the Vulnerable Software and Affected Versions: Sliced Invoices versions 3.9.2 and earlier Description: A Missing Authorization issue affects Sliced Invoices, allowing unauthorized access. The estimated number of potentially affected devices worldwide is not specified. There is no...

WordPress plugin Sliced Invoices Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns

Cybersecurity researchers have observed a spike in email phishing campaigns starting early March 2024 that delivers Latrodectus, a nascent malware loader believed to be the successor to the IcedID malware. "These campaigns typically involve a recognizable infection chain involving oversized...

CVE-2023-51546

Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.2.1...

CVE-2023-51546

Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.2.1...

CVE-2023-51546 WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerability

Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.2.1...

PT-2024-14197 · Webtoffee · Woocommerce Pdf Invoices

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions 4.2.1 and earlier Description: The issue is related to Improper Privilege Management, allowing Privilege Escalation in WebToffee WooCommerce PDF Invoices,...

WordPress plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in the...

GHSA-7PJR-2RGH-FC5G Anonymous PrestaShop customer can download other customers' invoices

Impact Since PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. Patches Patched in 8.1.6 Workarounds Upgrade to 8.1.6 Thank you to Samuel Bodevin, who found this vulnerability and shared it with the PrestaShop...

Anonymous PrestaShop customer can download other customers' invoices

Impact Since PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. Patches Patched in 8.1.6 Workarounds Upgrade to 8.1.6 Thank you to Samuel Bodevin, who found this vulnerability and shared it with the PrestaShop...

CVE-2024-3047

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web...