1045 matches found
CVE-2020-8424
Cups Easy Purchase & Inventory 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php...
CVE-2020-8425
Cups Easy Purchase & Inventory 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php...
CVE-2020-8425
CVE-2020-8425 affects Cups Easy (Purchase & Inventory) 1.0 web application. The vulnerability is a Cross-Site Request Forgery (CSRF) that can lead to admin account deletion via userdelete.php (and related password-reset/administration actions) as described in multiple sources. Exploitation detail...
PT-2020-20128
Name of the Vulnerable Software and Affected Versions Cups Easy Purchase & Inventory version 1.0 Description The issue allows for admin account takeover via the passwordmychange.php endpoint due to a CSRF vulnerability. Recommendations For version 1.0, as a temporary workaround, consider...
PT-2020-20129
Name of the Vulnerable Software and Affected Versions Cups Easy Purchase & Inventory version 1.0 Description The issue allows for Cross-Site Request Forgery CSRF that can lead to the deletion of admin accounts. This is achieved via the userdelete.php endpoint. Recommendations For version 1.0, as ...
CVE-2020-8425: Cross-Site Request Forgery (CSRF)
Cups Easy Purchase & Inventory 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php...
CVE-2020-8424: Cross-Site Request Forgery (CSRF)
Cups Easy Purchase & Inventory 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php...
Shopify: Disclose Any Store products, Files, Purchase Orders Via Email through Shopify Stocky APP
Hello Shopify Security Team! Bug Summary: This bug leads to disclose any store products, files, purchase orders through shopify stocky app. It is bug in shopify app but it effects stores also. Reproduction steps: Go to apps.shopify.com and install the stocky app. Now you will be redirected to thi...
CVE-2019-8682
The issue was addressed with improved UI handling. This issue is fixed in iOS 12.4, watchOS 5.3. A user may inadvertently complete an in-app purchase while on the lock screen...
CVE-2019-8682
The issue was addressed with improved UI handling. This issue is fixed in iOS 12.4, watchOS 5.3. A user may inadvertently complete an in-app purchase while on the lock screen...
Design/Logic Flaw
The issue was addressed with improved UI handling. This issue is fixed in iOS 12.4, watchOS 5.3. A user may inadvertently complete an in-app purchase while on the lock screen...
CVE-2019-8682
The CVE-2019-8682 issue affects Apple’s Wallet component on iOS and watchOS. Root cause: UI handling allowed a user to unintentionally complete an in‑app purchase while on the lock screen. Impact, as stated in Apple/Red Hat entries: potential to complete an in‑app purchase without proper interact...
CVE-2019-8682
The issue was addressed with improved UI handling. This issue is fixed in iOS 12.4, watchOS 5.3. A user may inadvertently complete an in-app purchase while on the lock screen...
PT-2019-19148
Name of the Vulnerable Software and Affected Versions iOS versions prior to 12.4 watchOS versions prior to 5.3 Description The issue allows a user to inadvertently complete an in-app purchase while on the lock screen. This is due to inadequate UI handling. Recommendations For iOS versions prior t...
CVE-2019-8682: Missing Authentication for Critical Function
The issue was addressed with improved UI handling. This issue is fixed in iOS 12.4, watchOS 5.3. A user may inadvertently complete an in-app purchase while on the lock screen...
CVE-2019-18668
An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This...
Device Hopping Shoppers Drive Up Bounce Rates Leading Into Holiday 2019
Executive Summary In 2018, Akamai reported for the first time that shoppers used mobile devices more than desktops for all the major peak traffic events we measured. Interestingly, they often don't complete their purchase on a mobile device. If the most recently concluded back-to-school shopping...
New Threat Actor Fraudulently Buys Digital Certificates to Spread Malware
Researchers have identified a new threat actor that is using impersonation fraud to purchase digital certificates that are then used for the spread of malware. Security firm ReversingLabs identified a bad actor that deceives certificate authorities into selling them legitimate digital certificate...
WordPress sell-downloads plugin information disclosure vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. sell-downloads is a paid downloadable site builder plugin used in it. A security vulnerability exists in WordPress sell-downloads plug...