156 matches found
CVE-2023-48781: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades de Chile para WC: from n/a through 4.3.0...
segurosparaagricultores.com Improper Access Control vulnerability OBB-3810445
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-32296
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kangu para WooCommerce plugin = 2.2.9 versions...
CVE-2023-32296: Improper Neutralization of Input During Web Page Generation
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kangu para WooCommerce plugin = 2.2.9 versions...
WordPress Kangu para WooCommerce Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)
Software Kangu para WooCommerce Type Plugin Vulnerable versions = 2.2.9 Fixed in 2.2.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32296 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c45e61061ad1 Credits Jonas...
CVE-2023-3525: Undefined Security Weakness
The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to 'APPROVED' without...
para-sol.ca Cross Site Scripting vulnerability OBB-3334700
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-47589: Improper Neutralization of Input During Web Page Generation
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in this.Functional CTT Expresso para WooCommerce plugin = 3.2.11 versions...
para-port.com Cross Site Scripting vulnerability OBB-3222686
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
SUSE CVE-2009-3525
The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's kernel boot parameters without providing the...
SUSE CVE-2012-2625
The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service memory consumption via a large 1 bzip2 or 2 lzma compressed kernel image...
PT-2023-13892
Name of the Vulnerable Software and Affected Versions 3com - Asesor de Cookies para normativa española plugin versions = 3.4.3 Description The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin privileges can inject malicious...
CVE-2022-40697: Improper Neutralization of Input During Web Page Generation
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in 3com – Asesor de Cookies para normativa española plugin = 3.4.3 versions...
CVE-2022-1848
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
CVE-2022-1848
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
Code injection
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
CVE-2022-1848 Business Logic Errors in erudika/para
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
CVE-2022-1848 Business Logic Errors in erudika/para
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11...
CVE-2022-1848
CVE-2022-1848 affects the Erudika Para project prior to version 1.45.11. Multiple connected sources describe a business logic error, including a race condition in com.erudika:para-core (validateObject) that can allow a user to abuse account/app-related logic. This is documented across sources (Gi...
