Default credentials

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue ...

CVE-2022-24743

Sylius CVE-2022-24743 affects the reset password flow: prior to 1.10.11 and 1.11.2, the reset token was not nulled after a password change, allowing token reuse and potential token leakage leading to unauthorized password changes. The vulnerability is fixed in 1.10.11 and 1.11.2. The provided wor...

CVE-2022-24743 Insufficient Session Expiration in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue ...

CVE-2022-24743 Insufficient Session Expiration in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue ...

CVE-2022-24743 Insufficient Session Expiration in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue ...

CVE-2022-24742

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect...

Design/Logic Flaw

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect...

CVE-2022-24742 Exposure of Sensitive Information Due to Incompatible Policies in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect...

CVE-2022-24742 Exposure of Sensitive Information Due to Incompatible Policies in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect...

CVE-2022-24742 Exposure of Sensitive Information Due to Incompatible Policies in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect...

CVE-2022-24742

CVE-2022-24742 affects Sylius open-source eCommerce platforms. Prior to versions 1.9.10, 1.10.11, and 1.11.2, an attacker could view data after logout if the browser tab remains open and the back button is used; the issue is fixed in those versions and later. The available workarounds involve enf...

CVE-2022-24733

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

Code injection

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

CVE-2022-24733 Improper Restriction of Rendered UI Layers or Frames in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

CVE-2022-24733

Sylius (open-source eCommerce platform) has a clickjacking vulnerability in versions prior to 1.9.10, 1.10.11, and 1.11.2, where an attacker-controlled page could load the site in an iframe and overlay the interface. Root cause: missing X-Frame-Options header allowing framing. Impact: potential U...

CVE-2022-24733 Improper Restriction of Rendered UI Layers or Frames in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

CVE-2022-24733 Improper Restriction of Rendered UI Layers or Frames in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

Sylius 安全漏洞

Sylius is an open source e-commerce platform based on the Symfony framework from the Polish company Sylius. sylius has a security vulnerability that stems from the possibility that an attacker-controlled page could load the website in an iframe. This would enable a clickjacking attack where an...

Sylius 代码问题漏洞

Sylius is an open source e-commerce platform based on the Symfony framework from the Polish company Sylius. Sylius suffers from a code issue vulnerability that could lead to existing token leakage and unauthorized password changes. No details of the vulnerability are currently available...

Sylius 信息泄露漏洞

Sylius is a set of open source e-commerce platform based on the Symfony framework from the Polish company Sylius. Sylius has an information disclosure vulnerability, and no details of the vulnerability are currently available...