316 matches found
CVE-2021-32720
Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details order ID, order number, items total, and token value of all placed orders were exposed to unauthorized users. If exploited properly, a few additional informatio...
CVE-2021-32720
Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details order ID, order number, items total, and token value of all placed orders were exposed to unauthorized users. If exploited properly, a few additional informatio...
Design/Logic Flaw
Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details order ID, order number, items total, and token value of all placed orders were exposed to unauthorized users. If exploited properly, a few additional informatio...
CVE-2021-32720
CVE-2021-32720 affects Sylius prior to 1.9.5 and 1.10.0-RC.1, where details of all placed orders (order ID, order number, items total, token value) were exposed to unauthorized users via new API endpoints. Potential additional data include the number of items in the cart and shipping date; while ...
CVE-2021-32720 List of order ids, number, items total and token value exposed for unauthorized uses via new API
Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details order ID, order number, items total, and token value of all placed orders were exposed to unauthorized users. If exploited properly, a few additional informatio...
Sylius 信息泄露漏洞
Sylius is a Polish company Sylius set of open source e-commerce platform based on the Symfony framework . A security vulnerability exists in Sylius versions prior to 1.9.5 and 1.10.0-RC, which stems from the fact that some of the details of an order placed in Sylius order ID, order number, total...
Lack Of E-Mail Verification
sylius/sylius suffers from a lack of e-mail verification. A registered and verified user in a shop is able to change it to another e-mail, without the need to re-verify on the new e-mail address...
Sylius Cross-Site Scripting Vulnerability (CNVD-2020-63212)
Sylius is a Polish company Sylius set of open source e-commerce platform based on the Symfony framework . Sylius has a security vulnerability where 该漏洞源于用户可以通过电子邮件[email protected]在商店中注册 performs authentication, 将其更改为电子邮件[email protected] and maintains the authenticated and enabled state. This...
CVE-2020-15245
In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that th...
CVE-2020-15245
In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that th...
Design/Logic Flaw
In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email email protected, verify it, change it to the mail email protected and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this w...
CVE-2020-15245
In Sylius, prior to versions 1.6.9, 1.7.9, and 1.8.3, a user could register with [email protected], verify, then change the email to [email protected] and remain verified and enabled. This allows accounts to be associated with different verified emails, though it does not let an attacker take ove...
CVE-2020-15245 Email verification bypass in Sylius
In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that th...
GHSA-6GW4-X63H-5499 Ability to switch customer email address on account detail page and stay verified
Impact The user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any...
Ability to switch customer email address on account detail page and stay verified
Impact The user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any...
Sylius Injection Vulnerability (CNVD-2020-49008)
Sylius is a Polish company Sylius set of open source e-commerce platform based on the Symfony framework . An injection vulnerability exists in Sylius ResourceBundle, which stems from the program's failure to properly handle request parameters. An attacker can exploit the vulnerability to execute...
Remote Code Execution (RCE)
sylius/resource-bundle is vulnerable to remote code execution RCE. The vulnerability exists as it does not sanitize the value of $variable in ParametersParser.php...
Remote Code Execution (RCE)
sylius/resource-bundle is vulnerable to remote code execution RCE. The vulnerability exists as the value of $variable in OptionsParser.php is not sanitized...
Sylius Injection Vulnerability
Sylius is a Polish company Sylius set of open source e-commerce platform based on the Symfony framework . An injection vulnerability exists in Sylius ResourceBundle, which stems from the program's failure to properly handle request parameters. An attacker can exploit the vulnerability to execute...