CVE-2019-18939: Missing Authentication for Critical Function

eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi and exec1.cgi scripts, which execute TCL script content from an HTTP POST request...

CVE-2019-18938: Missing Authentication for Critical Function

eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the save.cgi script for payload upload and the testtcl.cgi script for its execution...

CVE-2019-18937: Missing Authentication for Critical Function

eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi script, which executes TCL script content from an HTTP POST request...

CVE-2019-18668

An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This...

CVE-2019-18668

Summary of CVE-2019-18668 : The Currency Switcher addon for WooCommerce (versions prior to 2.11.2) is vulnerable. If a user supplies a currency not configured by the administrator, the plugin may accept it and fall back to the default currency for price calculations. As a result, an attacker coul...

Currency Switcher addon for WooCommerce security bypass vulnerability

Currency Switcher addon for WooCommerce is a currency switcher addon for use in the WooCommerce e-commerce platform. A security bypass vulnerability exists in Currency Switcher addon for WooCommerce versions prior to 2.11.2, which can be exploited by an attacker to purchase items at a low price...

PT-2019-15568

Name of the Vulnerable Software and Affected Versions Currency Switcher addon for WooCommerce versions prior to 2.11.2 Description An issue allows an attacker to purchase items at a significantly cheaper price by providing a non-existent currency that is worth less than the default currency. If a...

CVE-2019-14424

A Local File Inclusion LFI issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request...

Cross site request forgery (csrf)

A Local File Inclusion LFI issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request...

WordPress iThemes Exchange Membership Add-on Cross-Site Scripting Vulnerability

iThemes Exchange for WordPress is a plugin for creating e-commerce websites using the WordPress content management system. membership Add-on is one of the plugins for website membership functionality. A cross-site scripting vulnerability exists in the WordPress iThemes Exchange Membership Add-on...

WordPress iThemes Exchange 2Checkout Add-on Cross-Site Scripting Vulnerability

iThemes Exchange for WordPress is a plugin for creating e-commerce sites using the WordPress content management system. 2Checkout Add-on is one of the 2Checkout payment gateway plugins. A cross-site scripting vulnerability exists in WordPress iThemes Exchange 2Checkout Add-on. An attacker can...

CVE-2019-15818: URL Redirection to Untrusted Site

The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist...

PT-2019-14407

Name of the Vulnerable Software and Affected Versions simple-301-redirects-addon-bulk-uploader plugin versions 1.2.4 and earlier Description The issue concerns the lack of authentication requirement for certain actions in the plugin. Specifically, the actions action=bulk301export and...

CVE-2019-15776

The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file...

PT-2019-14385

Name of the Vulnerable Software and Affected Versions simple-301-redirects-addon-bulk-uploader plugin versions prior to 1.2.5 Description The issue concerns the lack of protection against 301 redirect rule injection via a CSV file in the simple-301-redirects-addon-bulk-uploader plugin for...

CVE-2019-15776: URL Redirection to Untrusted Site

The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file...

Compassion Switzerland addons for Odoo SQL Injection Vulnerability

Odoo is an enterprise resource planning ERP and customer relationship management CRM system from Odoo Belgium. The system is developed in Python with PostgreSQL as the database and includes modules for sales management, inventory management, financial management, etc. Compassion Switzerland addon...

PT-2019-7296

Name of the Vulnerable Software and Affected Versions profile-builder plugin versions prior to 2.1.4 Description The issue concerns a lack of access control for activating or deactivating addons via AJAX, allowing unauthorized actions. Recommendations For versions prior to 2.1.4, update to versio...

CVE-2015-9337: Improper Access Control

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX...

CVE-2019-9584

eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to improper access control for all /addons/mh/ pages...