CVE-2021-41143 OpenMage LTS arbitrary file deletion in customer media allows for remote code execution

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue...

CVE-2021-41143 OpenMage LTS arbitrary file deletion in customer media allows for remote code execution

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue...

Fix for arbitrary file deletion in customer media allows for remote code execution

Impact Magento admin users with access to the customer media could execute code on the server...

GHSA-5VPV-XMCJ-9Q85 Fix for arbitrary file deletion in customer media allows for remote code execution

Impact Magento admin users with access to the customer media could execute code on the server...

PT-2023-12374 · Unknown · Openmage Lts

Name of the Vulnerable Software and Affected Versions: OpenMage LTS versions prior to 19.4.22 OpenMage LTS versions prior to 20.0.19 Description: The issue affects OpenMage LTS, an e-commerce platform. Magento admin users with access to the customer media could execute code on the server...

CVE-2021-41143: Improper Neutralization of Special Elements used in a Command

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue...

Is Once-Yearly Pen Testing Enough for Your Organization?

Any organization that handles sensitive data must be diligent in its security efforts, which include regular pen testing. Even a small data breach can result in significant damage to an organization's reputation and bottom line. There are two main reasons why regular pen testing is necessary for...

"2.6 million DuoLingo account entries" up for sale

Not a week goes by where we dont see an example of data scraping causing concern for both business and folks at home. The latest target happens to be popular language platform DuoLingo, who is currently digging into a forum post concerning data related to its customer accounts. Scraping data for...

GoTo’s LastPass Breach: Encrypted Customer Data Taken

By Deeba Ahmed GoTo-owned LastPass revealed that hackers stole customers' encrypted data in a November 2022 data breach. This is a post from HackRead.com Read the original post: GoTos LastPass Breach: Encrypted Customer Data Taken...

Microsoft Security reaches another milestone—Comprehensive, customer-centric solutions drive results

Yesterday, we shared some exciting news about the momentum we’re seeing in the security industry. Microsoft Chief Executive Officer Satya Nadella announced that Microsoft Security has surpassed USD20 billion in revenue. I’m grateful to all our customers and partners who have been on this journey...

Privilege Escalation from customer to root

Privilege Escalation from Customer to Root First of all, sorry for the formatting of the report, but this platform is a mess. I can't attach any PoC files added chapters at the end of the report instead, can't attach any screenshots, nor provide a report as PDF. And btw markdown is only partly...

LastPass Parent Company GoTo Suffers Data Breach, Customers' Backups Compromised

LastPass-owner GoTo formerly LogMeIn on Tuesday disclosed that unidentified threat actors were able to steal encrypted backups of some customers' data along with an encryption key for some of those backups in a November 2022 incident. The breach, which targeted a third-party cloud storage service...

Grand Theft Auto 5 exploit allows cheaters to tamper with your data

Yesterday I spent some time helping to fix a relatives gaming PC. Their gaming data tied to Rockstars Grand Theft Auto 5 GTAV had somehow become corrupted and was no longer functional. I managed to repair the account and restore everything back to the way it was, but this isnt the end of the stor...

CVE-2022-4554

B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerability. This has been fixed in the version 1.0.0.347...

Cross site scripting

B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerability. This has been fixed in the version 1.0.0.347...

Riot Games compromised, new releases and patches halted

Popular game developer Riot Games brings word of a system compromise which may cause issues for updates to well known titles, although for the time being it seems as though customer data isn't affected. A social engineering development Making the notification via Twitter late last week, were stil...

CVE-2022-4554 Reflected XSS B2B Dealer Ordering System

B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerability. This has been fixed in the version 1.0.0.347...

CVE-2022-4554: Improper Neutralization of Input During Web Page Generation

B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerability. This has been fixed in the version 1.0.0.347...

WordPress Customer Reviews for WooCommerce Plugin < 5.17.0 is vulnerable to Cross Site Scripting (XSS)

Software Customer Reviews for WooCommerce Type Plugin Vulnerable versions 5.17.0 Fixed in 5.17.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0079 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4f8fa9482f53 Credits...

CVE-2022-4554

The CVE-2022-4554 entry concerns the B2B Customer Ordering System developed by ID Software Project and Consultancy Services. Affected versions are prior to 1.0.0.347 and the vulnerability is an authenticated Reflected XSS vulnerability. The issue is resolved in version 1.0.0.347. Exploitation det...