CVE-2023-36644

== Software afectado %hardbreaks Proveedor: ITB-GmbH Productos afectados: TradePro v9.5 Componente: Printmail Plugin Confirmado: sí == Vector de ataque %hardbreaks Tipo: Control de acceso incorrecto Tipo de acceso: Remoto Impacto: Divulgación de información El control de acceso incorrecto en el...

CVE-2023-36643

== 受影响软件 %hardbreaks 供应商： ITB-GmbH 受影响产品： TradePro v9.5 组件： 函数 Customer；操作 oordershow 已确认： 是 == 攻击向量 %hardbreaks 类型： 不正确的访问控制 访问方式： 远程 影响： 信息泄露 ITB-GmbH TradePro v9.5 中函数 customer、操作 oordershow 存在不正确的访问控制，通过向一个 https 端点传递任意订单号，远程攻击者可获取在线商店的所有订单。 == 描述 bestellid 应事先已知，但可轻易枚举或利用...

CVE-2023-36645

== 受影响软件 %hardbreaks 厂商： ITB-GmbH 受影响产品： TradePro v9.5 组件： 功能 customer；操作 oordershow 已确认： 是 == 攻击向量 %hardbreaks 类型： SQLi 访问类型： 远程 影响： 信息泄露；权限提升 在 ITB-GmbH TradePro v9.5 的 customer 功能、oordershow 操作中存在 SQL 注入漏洞，允许远程攻击者在目标系统上执行 SQL 查询。 == 描述 使用有效但未经过身份验证的会话 Cookie 调用...

EUVD-2023-40587

Malicious code in bioql PyPI...

EUVD-2023-40589

Malicious code in bioql PyPI...

EUVD-2023-40588

Malicious code in bioql PyPI...

CVE-2023-36645

SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function...

CVE-2023-36644

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin...

CVE-2023-36645

SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function...

CVE-2023-36644

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin...

CVE-2023-36644

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin...

CVE-2023-36645

SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function...

CVE-2023-36645

SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function...

CVE-2023-36643

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer function...

CVE-2023-36643

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer function...

CVE-2023-36643

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer function...

CVE-2023-36645

SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function...

CVE-2023-36643

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer function...

CVE-2023-36645

SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function...

ITB-GmbH TradePro 安全漏洞

ITB-GmbH TradePro is a complete B2B e-shop from ITB-GmbH. A security vulnerability exists in ITB-GmbH TradePro version v9.5, which stems from incorrect access control. A remote attacker uses the vulnerability to receive all orders from the online store via the oordershow component in the customer...