80 matches found
BIT-ODOO-2021-23178
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead...
Leyka < 3.30.4 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Note: The issue was reported to the...
Improper Access Control
odoo is vulnerable to Improper Access Control. The vulnerability allows an attacker to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead...
DEBIAN-CVE-2021-23178
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead...
CVE-2021-23178
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead...
UBUNTU-CVE-2021-23178
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead...
Improper access control
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead...
CVE-2021-23178
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead...
CVE-2021-23178
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead...
CVE-2021-23178
CVE-2021-23178 affects Odoo 15.0 and earlier (Community/Enterprise). The root cause is improper access control that allows an authenticated user to validate online payments with a tokenized payment method belonging to another user, charging the victim’s payment method. Connected sources (OSV and ...
Malicious code in payment_method (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaf8d7ef9b2e7d4df92b29894c629acbc28978ee0fc89ae8d1b8ce4f45268d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5237 Malicious code in payment_method (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaf8d7ef9b2e7d4df92b29894c629acbc28978ee0fc89ae8d1b8ce4f45268d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Authentication Bypass
bytefury/crater is vulnerable to authentication bypass. The vulnerability exists due to improper user validation handling in payment method delete which allows an unauthenticated user to all expense receipts uploaded to a company...
BNG Gateway For Woocommerce <= 1.6.10 - CSRF Bypass
The plugin does not properly perform CSRF checks, allowing attackers to make logged in users perform unwanted actions, such as add a new billing method to an existing customer, and delete a payment method...
Mail.ru: Пользователь может изменить способ оплаты указав чужой corporation ID
IDOR vulnerability in city-mobil.ru allowed arbitrary organization to be billed for a taxi ride...
Zomato: Availing Zomato gold by using a random third-party `wallet_id`
We received a report from @pandaaaa wherein he demonstrated a way to avail Zomato Gold membership using random Zomato User's wallet. The report was triaged and rewarded with critical severity with a CVSS score of 9.3. It was considered critical since a random user's wallet could have been used fo...
Showmax: Open Redirect in secure.showmax.com
The hacker submitted open redirect vulnerability in one of our payment method flows. The vulnerability could have been also used to perform XSS attack. write-up: https://medium.com/@ahmadbrainworks/bug-bounty-how-i-earned-550-in-less-than-5-minutes-open-redirect-chained-with-rxss-8957979070e5...
PRODSECBUG-2406: Cross-Site Scripting via Payment Method Title
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
Zomato: Able to manipulate order amount by removing cancellation amount and cause financial impact
@sjvino identified an issue where it could have allowed to tamper the cancellation amount and pay less than the actual order amount. Steps submitted by the researcher to reproduce the issue maybe it will help new folks in the community to learn something out of it - - Select Items and add them to...