8055 matches found
CVE-2024-34990
In the module "Help Desk - Customer Support Management System" helpdesk up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods HelpdeskHelpdeskModuleFrontController::submitTicket and HelpdeskHelpdeskModuleFrontController::replyTicket allow upload of .php...
CVE-2024-36677
The Login as customer PRO (loginascustomerpro) module by Weblir for PrestaShop is vulnerable in versions prior to 1.2.7 . A guest can access a direct link to connect to every customer account in the shop if the module is not installed or if an administrator-accessible secret is stolen. This vulne...
CVE-2024-36677
In the module "Login as customer PRO" loginascustomerpro 1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to administrator is stolen...
CVE-2024-36677
In the module "Login as customer PRO" loginascustomerpro 1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to administrator is stolen...
CVE-2024-36677: Exposure of Private Personal Information to an Unauthorized Actor
In the module "Login as customer PRO" loginascustomerpro 1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to administrator is stolen...
PT-2024-27120 · Weblir · Weblir Login As Customer Pro
Name of the Vulnerable Software and Affected Versions: Weblir Login as customer PRO module versions prior to 1.2.7 Description: The issue allows a guest to access a direct link to connect to each customer account of the shop if the module is not installed or if a secret accessible to the...
CVE-2024-34990: Unrestricted Upload of File with Dangerous Type
In the module "Help Desk - Customer Support Management System" helpdesk up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods HelpdeskHelpdeskModuleFrontController::submitTicket and HelpdeskHelpdeskModuleFrontController::replyTicket allow upload of .php...
PT-2024-4405 · Unknown · Tailoring Management System
Name of the Vulnerable Software and Affected Versions: Tailoring Management System version 1.0 Description: A critical issue has been found in the Tailoring Management System, affecting an unknown functionality of the file orderadd.php. The manipulation of the customer argument leads to SQL...
CVE-2024-37889
MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6...
CVE-2024-37889
MyFinances vulnerability CVE-2024-37889 affects the MyFinances web application, where a signed-in user can access invoices and PII/financial data from other accounts via a specific method. Root cause details are not fully disclosed in the provided documents beyond the access mechanism; the impact...
CVE-2024-37889 MyFinances Allows Unauthorized Access to Other Customer Data
MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6...
CVE-2024-37889 MyFinances Allows Unauthorized Access to Other Customer Data
MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6...
CVE-2024-37889 MyFinances Allows Unauthorized Access to Other Customer Data
MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6...
CVE-2024-2472
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view...
CVE-2024-2472
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view...
CVE-2024-2472 LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view...
Rockwell Automation FactoryTalk View SE 安全漏洞
Rockwell Automation FactoryTalk View SE is an industrial automation system view interface from Rockwell Automation. An authentication error vulnerability exists in Rockwell Automation FactoryTalk View SE, which can be exploited by an attacker to send packets to a customer's server from a remote...
PT-2024-20516
Name of the Vulnerable Software and Affected Versions LatePoint Plugin versions up to and including 4.9.9 Description The issue is related to a missing capability check on the start or use session for customer function, allowing unauthorized access and modification of data. This enables...