MAL-2023-8601 Malicious code in purchase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 818b7cf6f19f5659849b9ba6ea11d5b53b47330d31838d371590e07f9107bfe3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The user has the ability to bypass a fee claim protection for their own benefit while purchasing tokens

Lines of code Vulnerability details Impact User can bypass a fee claim protection for his own benefit by making multiple purchases instead of one, and as the result claim a fee part by part. Due to code documentation: The reward calculation has to use the old rewards value pre fee-split to not...

CVE-2023-30492

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vark Minimum Purchase for WooCommerce plugin = 2.0.0.1 versions...

CVE-2023-30492

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vark Minimum Purchase for WooCommerce plugin = 2.0.0.1 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vark Minimum Purchase for WooCommerce plugin = 2.0.0.1 versions...

CVE-2023-30492 WordPress Minimum Purchase for WooCommerce Plugin <= 2.0.0.1 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vark Minimum Purchase for WooCommerce plugin = 2.0.0.1 versions...

CVE-2023-30492 WordPress Minimum Purchase for WooCommerce Plugin <= 2.0.0.1 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vark Minimum Purchase for WooCommerce plugin = 2.0.0.1 versions...

CVE-2023-30492

CVE-2023-30492 concerns a stored Cross-Site Scripting (XSS) in the WordPress plugin Minimum Purchase for WooCommerce (by Vark) for versions

WordPress Plugin Minimum Purchase for WooCommerce Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-22728 · Woocommerce · Vark Minimum Purchase For Woocommerce

Name of the Vulnerable Software and Affected Versions: Vark Minimum Purchase for WooCommerce plugin versions = 2.0.0.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher permissions. The vulnerability allows for the...

[ADRIRO-NEW-M-01] Manager authorization in VotiumStrategy still leaves room for unprotected access

Lines of code Vulnerability details Summary Access control has been added to the VotiumStrategy contract with the intention of restricting functionality only to AfEth. However, an error in the implementation still leaves the contract publicly accessible. Impact In the updated codebase, the sponso...

Design/Logic Flaw

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which the registryIsDockerHub function was only checking that the...

CVE-2023-45821

Artifact Hub (artifacthub.io) has a vulnerability in the registryIsDockerHub check where the code only inspects the registry domain ending with docker.io, enabling credential hijacking by using a fake OCI registry on a domain that ends with docker.io. The issue affects how Docker credentials used...

CVE-2023-40625

S4CORE Manage Purchase Contracts App - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and...

CVE-2023-40625

S4CORE Manage Purchase Contracts App - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and...

Authorization

S4CORE Manage Purchase Contracts App - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and...

CVE-2023-40625 Missing Authorization check in SAP Manage Purchase Contracts App

S4CORE Manage Purchase Contracts App - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and...

CVE-2023-40625 Missing Authorization check in SAP Manage Purchase Contracts App

S4CORE Manage Purchase Contracts App - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which has low impact on confidentiality and...

CVE-2023-40625

CVE-2023-40625 involves the SAP S4CORE Manage Purchase Contracts App where versions 102–107 do not perform necessary authorization checks for authenticated users, enabling potential privilege escalation. Connected source PT-2023-27547 corroborates the affected versions and notes remediation: upgr...

SAP S4CORE Security Vulnerability

SAP S4CORE is a Manage Purchase Contracts App from SAP, Germany. A security vulnerability exists in SAP S4CORE Manage Purchase Contracts App versions 102, 103, 104, 105, 106, and 107, which originates from a failure to perform the required authorization checks on authenticated users, allowing an...