WordPress YITH WooCommerce PDF Invoice and Shipping List plugin <=1.2.12 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce PDF Invoice and Shipping List plugin versions =1.2.12. Solution Update the WordPress YITH WooCommerce PDF Invoice and Shipping List plugin to the latest available versio...

CVE-2019-18608

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...

Information disclosure

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...

WordPress Easy Digital Downloads Simple Shipping extension cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Easy Digital Downloads EDD Simple Shipping extension is a digital product sales plugin used in it. A cross-site...

CVE-2015-9527

The Easy Digital Downloads EDD Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9527

The CVE-2015-9527 entry concerns the WordPress Easy Digital Downloads (EDD) Simple Shipping extension. A cross-site scripting (XSS) flaw exists due to misuse of add_query_arg, affecting EDD releases across multiple branches: 1.8.x before 1.8.7; 1.9.x before 1.9.10; 2.0.x before 2.0.5; 2.1.x befor...

On-Board 'Mystery Boxes' Threaten Global Shipping Vessels

Commercial shipping environments are rife with vulnerabilities, according to researchers – up to and including unpatched “mystery boxes” that no one knows anything about. “In every single nautical pen test to date we have unearthed a system or device, that of the few crew that were aware, no one...

A week in security (October 7 – 13)

Last week on Malwarebytes Labs, we peered into the possible future of cybersecurity insurance, described the process for securing today’s managed service provider, and provided an in-depth explainer on the business espionage tactic known as “war shipping.” Further, in considering the intersection...

Explained: war shipping

Yesterday, Mike from the mailroom came up and asked whether I knew anyone called “Simon Smith.” He received an envelope addressed to our company and to the attention of Mr. Smith, but there was no one by that name on his list of employees. It wasn’t on mine either and HR was unaware of a person b...

How to Ship Your Ecommerce Goods At Lightning Speed

By Uzair Amir Want better results for your Ecommerce store? Here are some well-rounded tips on how you can ship faster and more expediently while spending less money. This is a post from HackRead.com Read the original post: How to Ship Your Ecommerce Goods At Lightning Speed...

CVE-2015-9375

Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via addqueryarg and removequeryarg...

PRODSECBUG-2245: Stored cross-site scripting in store shipping methods configuration

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...

PRODSECBUG-2322: Arbitrary code execution due to unsafe handling of a shipping gateway

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...

PRODSECBUG-2276: Insecure Direct Object Reference (IDOR) vulnerability can expose order shipping details

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...

Ruby: Ruby is shipping a vulnerable jQuery

No this isn't a report about the website! Ruby ships Darkfish as part of RDoc https://github.com/ruby/ruby/tree/HEAD/lib/rdoc/generator/template/darkfish https://github.com/ruby/rdoc/tree/master/lib/rdoc/generator/template/darkfish https://github.com/ged/darkfish Darkfish includes jQuery v1.6.4,...

ThreatList: Credential-Sniffing Phishing Attacks Erupted in 2018

Phishing attacks have continued to grow over the past year – but now, it appears that more bad actors are launching these tricky attacks in hopes of scooping up credentials, rather than a previously-popular goal of infecting victims’ devices with malware. The new trend was outlined by Proofpoint...

Shipping Firms Speared with Targeted 'Whaling' Attacks

Scammers are honing in on the shipping industry, using “whaling,” a.k.a. business email compromise BEC attacks, to scoop up credentials, or worse, compromise critical systems. Hackers are launching whaling attacks to target various types of employees with some serious online and sometimes...

WordPress Baggage Freight Shipping Australia plugin 0.1.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability found by Kaimi in WordPress Baggage Freight Shipping Australia plugin version 0.1.0. Solution 08.01.2019 - we were unable to find a patched version of this plugin...

WordPress Plugin Baggage Freight Shipping Australia Arbitrary File Upload Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An arbitrary file upload vulnerability exists in the WordPress plugin Baggage Freight Shipping Australia. Allows an attacker ...

WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload

WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload Exploit Title: WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload Date: 2018-12-24 Software Link: https://wordpress.org/plugins/baggage-freight/ Exploit Author: Kaimi Website:...