WordPress WP Customer Reviews Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WP Customer Reviews WordPress plugin before 3.5.6, which can ...

Microsoft named a Visionary in the 2021 Gartner Magic Quadrant for SIEM for Azure Sentinel

We’re pleased to announce that in its first year of inclusion in the Gartner Magic Quadrant report, Microsoft Azure Sentinel has been named a Visionary, where we were recognized for our completeness of vision for SIEM.1 Gartner has said that “cloud SIEM will be the future of how many organization...

Kaseya Left Customer Portal Vulnerable to 2015 Flaw in its Own Software

Last week cybercriminals deployed ransomware to 1,500 organizations, including many that provide IT security and technical support to other companies. The attackers exploited a vulnerability in software from Kaseya, a Miami-based company whose products help system administrators manage large...

File Upload Vulnerability in ZDNT's Customer Resource Management System (CNVD-2021-51371)

ZDNT Customer Resource Management System is a foreign trade management and foreign trade customer management and other functions of the software. A file upload vulnerability exists in ZDARNT Customer Resource Management System, which can be exploited by attackers to gain control of the server...

File Upload Vulnerability in Travel Management System in PHP

Travel Management System in PHP is an automated system designed to help customers easily check their parcel details while helping travel companies track packages online. A file upload vulnerability exists in Travel Management System in PHP, which can be exploited by an attacker to upload a webshe...

jSonar to Begin a New Chapter in Collaboration

A message from JSonar co-founder and CTO, Ron Bennatan. My wife complains that I’m a boring person. I’ve been doing the same thing for 25 years now – databases, then security, then database security, then data security and then some data lake security. But by that account Tom Brady is a boring...

XSS Vulnerability in Meiqiao Online Customer Service System

Chengdu Meichai Network Technology Co., Ltd. provides one-stop customer interaction SaaS services; at present, Meichai has online customer service, call center and customer service robots and other products, which are committed to helping enterprises and customers to improve the efficiency of...

More Russian Hacking

Two reports this week. The first is from Microsoft, which wrote: As part of our investigation into this ongoing activity, we also detected information-stealing malware on a machine belonging to one of our customer support agents with access to basic account information for a small number of our...

SQL Injection Vulnerability in Chengdu Zero Takeoff Network Customer Management CRM System (CNVD-2021-50629)

Customer management CRM system is zero takeoff network development, based on the GPLv3 protocol release, for small and medium-sized management activities, to provide customer relationship management CRM, sales and marketing inventory JXC, human resources HRM, logistics office supplies, fixed...

07FLY-CRM Customer Relationship Management System suffers from SQL injection vulnerability (CNVD-2021-49593)

07FLY-CRM customer relationship management system is based on the GPLv3 agreement issued for small and medium-sized enterprise management activities , currently provides customer relationship manager CRM, sales and marketing inventory JXC, the software is open source and free of charge . 07FLY-CR...

Security Bulletin: A denial of service vulnerability in OpenSSL affects IBM InfoSphere Information Server

Summary A denial of service vulnerability in OpenSSL used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an...

BNG Gateway For Woocommerce <= 1.6.10 - CSRF Bypass

The plugin does not properly perform CSRF checks, allowing attackers to make logged in users perform unwanted actions, such as add a new billing method to an existing customer, and delete a payment method...

SQL Injection Vulnerability in Chengdu Zero Takeoff Network Customer Management CRM System

Customer management CRM system is zero takeoff network development, based on the GPLv3 protocol release, for small and medium-sized management activities, to provide customer relationship management CRM, sales and marketing inventory JXC, human resources HRM, logistics office supplies, fixed...

Attackers Breach Microsoft Customer Service Accounts

The same group behind the SolarWinds supply-chain attacks has been targeting Microsoft’s corporate networks to gain access to specific organizations — primarily, U.S.-based IT and government organizations. Microsoft officially announced the attacks after Reuters obtained an email sent to customer...

CVE-2021-28585

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails...

CVE-2021-28563

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

CVE-2021-28563

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

Authorization

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

Input validation

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails...

CVE-2021-28563

Magento Commerce/Open Source prior to 2.4.3 (specifically 2.4.2 and earlier, 2.4.1-p1 and earlier, 2.3.6-p1 and earlier) is affected by an Improper Authorization vulnerability via the Create Customer endpoint. An unauthenticated attacker could cause unauthorized modification of customer data, wit...