CVE-2024-7896: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cgi-bin/p1ftpserver.php. The manipulation of the argument adrtxt leads to command injection. The attack ma...

CVE-2024-7898: Use of Default Credentials

A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been...

Tosei Online Store Management System Command Injection Vulnerability

Tosei Online Store Management System is an online store management system from Tosei Corporation. A command injection vulnerability exists in Tosei Online Store Management System versions 4.02, 4.03, and 4.04, which stems from the parameter adrtxt in the file /cgi-bin/p1ftpserver.php that can lea...

CVE-2024-7897: Improper Neutralization of Special Elements used in a Command

A vulnerability classified as critical has been found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This affects an unknown part of the file /cgi-bin/toseikikai.php. The manipulation of the argument kikaibangou leads to command injection. It is possible to initiate the attac...

PT-2024-38667 · Unknown · Tosei Online Store Management System

Name of the Vulnerable Software and Affected Versions: Tosei Online Store Management System versions 4.02 through 4.04 Description: A critical issue affects some unknown functionality of the file /cgi-bin/p1 ftpserver.php. The manipulation of the adr txt argument leads to command injection. The...

WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 4rCanJ0x! Patchstack Alliance in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 1.6.4...

WordPress Ultimate Store Kit Elementor Addons Plugin <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Store Kit Elementor Addons Type Plugin Vulnerable versions = 1.6.4 Fixed in 2.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43342 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bae240e72e97 Credits 4rCanJ0x! Required...

PT-2024-40876 · Apache · Apache Poi

Name of the Vulnerable Software and Affected Versions: Apache POI affected versions not specified Description: A security exception occurs due to a crash in the LZWDecompresser.decompress function. The issue is related to the decompression process in the CompressedStreamStore.decompress method...

Low: ca-certificates

Issue Overview: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from GLOBALTRUST. Certifi 2024.07.04 removes ro...

Medium: python3.9

Issue Overview: A defect was discovered in the Python "ssl" module where there is a memory race condition with the ssl.SSLContext methods "certstorestats" and "getcacerts". The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContex...

July 9, 2024—KB5040434 (OS Build 14393.7159) - EXPIRED

July 9, 2024—KB5040434 OS Build 14393.7159 - EXPIRED Applies To Windows 10, version 1607, all editions Windows Server 2016, all editions EXPIRATION NOTICE IMPORTANT As of March 31, 2026, this update is no longer available from the Microsoft Update Catalog or other release channels. We recommend...

Google Manifest V3 and Malwarebytes Browser Guard

We wanted to update you on some changes that Google’s making, and what we’re doing in Browser Guard to keep you protected. Some of our customers have recently reported seeing messages that say Browser Guard may soon no longer be supported in their browser. Luckily, theres no need for you to worry...

WordPress Store Locator Plus® for WordPress plugin <= 2311.17.01 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peng Zhou Patchstack Alliance in WordPress Plugin Store Locator Plus versions = 2311.17.01...

WordPress Store Locator Plus Plugin <= 2311.17.01 is vulnerable to Sensitive Data Exposure

Software Store Locator Plus Type Plugin Vulnerable versions = 2311.17.01 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-43258 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID cb927bdb788b Credits Peng Zhou Required...

conda-store (>=2024.6.1, <=2024.11.2) potentially affected by CVE-2024-41942 via jupyterhub (2.0.0rc5)

jupyterhub PYPI version 2.0.0rc5 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - conda-store =2024.6.1, =2024.11.2 Source cves: CVE-2024-41942 Source advisory: OSV:PYSEC-2024-200...

CVE-2024-42354

Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1...

CVE-2024-42354 Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1...

CVE-2024-42354

Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1...

CVE-2024-42354 Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1...

CVE-2024-42354 Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1...