Security Bulletin: Order Management is subject to an Apache Batik vulnerability and could allow a remote attacker to obtain sensitive information.

Summary Order Management removed parts of legacy code that carried vulnerabilites. The code did contain CVE-2015-0250, however the specific code related to the vulnerability is not in use, therefore the risk is lower. This bulletin identifies the steps to take to address the vulnerability...

Security Bulletin: Order Management could be subject to multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x.

Summary Order Management removed parts of legacy code that carried vulnerabilites. The code did contain CVE-2012-0838, CVE-2011-1772, CVE-2008-6504, CVE-2010-1870, CVE-2012-0394, however the specific code related to the vulnerability is not in use, therefore the risk is lower. This bulletin...

Security Bulletin: Order Management is subject to vulnerabilities regarding XML service where a remote attacker could exploit this vulnerability.

Summary Order Management removed parts of legacy code that carried vulnerabilites. The code did contain CVE-2009-2625, CVE-2013-4002, CVE-2012-0881, however the specific code related to the vulnerability is not in use, therefore the risk is lower. This bulletin identifies the steps to take to...

Security Bulletin: Struts Vulnerability - Order Management does contain the Struts code and it is vulnerable with lower risk [CVE-2023-50164]

Summary Order Management does contain the Struts code and it is vulnerable CVE-2023-50164, however the specific code related to the vulnerability is not in use, therefore the risk is lower. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...

CVE-2023-52215

CVE-2023-52215 affects the WordPress plugin “Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce.” The issue is an unauthenticated SQL injection via the userToken parameter in versions up to 1.5.1 (up to and including 1.5.1). A fix is available in versio...

CVE-2023-22088

Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications component: User Management. Supported versions that are affected are 7.4.0 and 7.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ...

Security Bulletin: Apache Commons vulnerability

Summary Apache Commons vulnerability Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function. By sending a specially-crafted...

Security Bulletin: Struts vulnerability

Summary Apache Struts is vulnerable to a denial of service Vulnerability Details CVEID:CVE-2023-41835 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by an incomplete cleanup of the struts.multipart.saveDir directory after an upload request is denied. By sending a speciall...

Security Bulletin: Struts vulnerability

Summary Apache Struts is vulnerable to a denial of service Vulnerability Details CVEID:CVE-2023-34149 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by a flaw with only handling setProperty but not getProperty. By sending a specially crafted request, a remote attacker cou...

Security Bulletin: Apache Struts Vulnerability

Summary Apache Struts Vulnerability Vulnerability Details CVEID:CVE-2023-34396 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by a flaw when processing Multipart request containing non-file normal form fields. By sending a specially crafted request, a remote attacker coul...

Security Bulletin: FasterXML jackson-databind vulnerabilites impact IBM Sterling Order Management

Summary Various FasterXML jackson-databind vulnerabilites include the following: could allow a remote attacker to execute arbitrary code on the system, could provide weaker than expected security, could allow a remote attacker to obtain sensitive information, could be vulnerable to a denial of...

PT-2023-32015 · Ecshop · Ecshop

Name of the Vulnerable Software and Affected Versions: ECshop version 4.1.1 Description: A critical issue has been found in an unknown functionality of the file /admin/order.php. The manipulation of the goods id argument leads to SQL injection. This issue can be exploited remotely. Recommendation...

SAP Commerce Information Disclosure Vulnerability

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. The product supports sales management, marketing management, order management, and operations management. An information disclosure vulnerability exists in SAP Commerce OCC API that originates from the HYCOM 2105, HYCOM...

Purchase Order Management v1.0 - SQL Injection

Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchaseorder/classes/Master.php?f=deleteitem. id: CVE-2022-28022 info: name: Purchase Order Management v1.0 - SQL Injection author: theamanrawat severity: critical description: | Purchase Order...

HikaShop Joomla Plugin, , SQL Injection

anyone with access to the order management in the backend of HikaShop to be able to use a MySQL injection to extract data from the database. "payment methods" restriction setting to custom fields of the "order" table in HikaShop 4.4.1, so prior versions of HikaShop are not impacted...

CVE-2023-2293

A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been classified as problematic. This affects an unknown part of the file classes/Master.php?f=saveitem. The manipulation of the argument description with the input alertdocument.cookie leads to cross site...

Cross site scripting

A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been classified as problematic. This affects an unknown part of the file classes/Master.php?f=saveitem. The manipulation of the argument description with the input alertdocument.cookie leads to cross site...

CVE-2023-2293

CVE-2023-2293 affects SourceCodester Purchase Order Management System 1.0, with the vulnerability located in the file path likely involved in the save_item operation (classes/Master.php?f=save_item). The root cause is cross-site scripting via the description parameter, where input such as can be...

CVE-2023-2293 SourceCodester Purchase Order Management System cross site scripting

A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been classified as problematic. This affects an unknown part of the file classes/Master.php?f=saveitem. The manipulation of the argument description with the input alertdocument.cookie leads to cross site...

PT-2023-18773 · Sourcecodester · Sourcecodester Purchase Order Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Purchase Order Management System version 1.0 Description: A problematic issue has been found in the system, affecting an unknown part of the file classes/Master.php?f=save item. The manipulation of the description argument with...