Design/Logic Flaw

The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs...

CVE-2015-9348

The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs...

CVE-2015-9348: Improper Input Validation

The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs...

PT-2019-7307

Name of the Vulnerable Software and Affected Versions sell-downloads plugin versions prior to 1.0.8 Description The issue is related to insufficient restrictions on brute-force guessing of purchase IDs. Recommendations For versions prior to 1.0.8, update to version 1.0.8 or later to resolve the...

GitLab: Stealing data from customers.gitlab.com without user interaction

Summary An attacker can link her own customers.gitlab.com account to the one of the victim, and these give access to 3 different vulnerabilities: - destroying subscriptions of the victim - buying new subscriptions using victim credit card for its own groups - some minor information disclosure abo...

cPanel Information Disclosure Vulnerability (CNVD-2019-28994)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An information disclosure vulnerability exists in the WHM 'Purchase and Install an SSL Certificate' page in cPanel versions prior...

CVE-2016-10797: Exposure of Sensitive Information to an Unauthorized Actor

cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains SEC-133...

Zoho ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-24542)

Zoho ManageEngine ServiceDesk Plus SDP is a web-based IT helpdesk software with integrated asset and project management capabilities, based on the ITIL framework. A cross-site scripting vulnerability exists in the Purchase component in Zoho ManageEngine ServiceDesk Plus 10.5. An attacker can...

CVE-2019-12539

An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189...

Code injection

An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189...

CVE-2019-12539

An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189...

CVE-2019-12539

CVE-2019-12539 describes a cross-site scripting flaw in the Purchase component of Zoho ManageEngine ServiceDesk Plus, exposed via the SearchN.do search field. Connected sources corroborate an XSS vulnerability distinct from CVE-2019-12189 and, in at least one entry, reference SDP version 10.5 as ...

PT-2019-12843

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus affected versions not specified Description A security issue was found in the Purchase component of the software, where there is a possibility of XSS via the SearchN.do search field. Recommendations At the...

CVE-2019-12539: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189...

Gmail wittingly storing your online purchase data for years

By Waqas Google knows "what, when, where & how much" about your online shopping but claims it does not use the data for advertisement. Gmail is home to more than 1.5 billion users which makes it a lucrative service for Google whose business model demands data collected from users' online searches...

Multiple Apple Products iAP and CoreCrypto Buffer Overflow Vulnerabilities

Apple iOS is an operating system developed for mobile devices.Apple tvOS is an operating system for smart TVs.Apple macOS Mojave is a specialized operating system developed for Mac computers.Apple macOS Mojave is a specialized operating system developed for Mac computers. A buffer overflow...

SQL Injection Vulnerability in Purchase Frontend ge***.aspx Page of Purchase System

Purchase system Purchase is a purchasing management system features include: product requisitioning, warehousing, inventory counts, data reports and more. A SQL injection vulnerability exists in the front-end ge.aspx page of Purchase, which can be exploited by attackers to obtain sensitive...

SQL Injection Vulnerability in Purchase Frontend pr***.aspx Page of Purchase System

Purchase system Purchase is a purchasing management system features include: product requisitioning, warehousing, inventory counts, data reports and more. A SQL injection vulnerability exists in the front-end pr.aspx page of Purchase, which can be exploited by attackers to obtain sensitive...

Mail.ru: Make user buy items via clickjacking possibility

Clickjacking attack could allow to force user to buy some item on lootdog.io...

mooSocial Store 2.6 SQL Injection

Exploit Title: mooSocial Store Plugin 2.6 - SQL Injection Exploit Author: Andrea Bocchetti Date: 2018-08-28 Google Dork: N/A - Vendor: https://moosocial.com/product/store-plugins/ Software Link: https://moosocial.com/product/store-plugins/ Demo URL: http://addons.moosocial.com/stores Purchase lin...