6801 matches found
CVE-2024-6074 WP eStore < 8.5.5 - Reflected XSS in Customer Editing
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-6074 WP eStore < 8.5.5 - Reflected XSS in Customer Editing
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
TCP Checksum Interoperability with RFC1624
Customer installed a Repeater 8540 at Data Center and two Branch Repeater 300 appliances at two branch offices for the Proof of Concept POC test. After installation, customers in the branch offices reported that ICA sessions stopped responding from time to time. The session does not respond to...
Crooks Steal Phone, SMS Records for Nearly All AT&T Customers
AT&T Corp. disclosed today that a new data breach has exposed phone call and text message records for roughly 110 million people -- nearly all of its customers. AT&T said it delayed disclosing the incident in response to "national security and public safety concerns," noting that some of the...
Dangerous monitoring tool mSpy suffers data breach, exposes customer details
In a new episode of Spy vs Spy, the mobile monitoring app mSpy has suffered a data breach that exposed information about millions of its customers. As Malwarebytes Labs has reported before, the types of companies that make mobile applications that enable users to non-consensually spy and monitor ...
“Nearly all” AT&T customers had phone records stolen in new data breach disclosure
In a déjà-vu nightmare, US phone giant AT&T has notified customers that cybercriminals managed to download phone call and text message records of "nearly all of AT&T cellular customers from May 1, 2022 to October 31, 2022 as well as on January 2, 2023". In a filing with the Securities and Exchang...
AT&T Discloses Breach of Customer Data
On July 12, AT&T released a public statement on unauthorized access of customer data from a third-party cloud platform. AT&T also provided recommendations and resources for affected customers. CISA encourages customers to review the following AT&T article for additional information and follow...
Worldwide Support Services Delivery Guide - 2024
Worldwide Support Services Delivery Guide -2024 Information To our Citrix customers and partners, we want to thank you for choosing our products and services. Our goal is to ensure your success, and we have created thisWorldwide Support Services Delivery Guide to help you achieve just that. The...
RocketChat LiveChat Security Breach
RocketChat LiveChat is a small, lightweight application from RocketChat, Inc. designed to provide B2C business-to-customer communication between agents and website visitors. A security vulnerability exists in RocketChat LiveChat that stems from the presence of a NoSQL injection that can leak...
CVE-2024-39519
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service DoS. On all ACX 7000 Series platforms running Junos OS Evolved...
UAE’s Lulu Hypermarket Data Breach: Hackers Claim Millions of Customer Records
Lulu Hypermarket has experienced a major data breach, exposing over 200,000 customer records. The attack, claimed by IntelBroker…...
Peloton accused of providing customer chat data to train AI
It seems that Peloton may have been providing more training than just for its customers, as its set to face court in California accused of using user chat data to train AI. Peloton Interactive, Inc. is a US-based exercise equipment and media company, known for its stationary bicycles, treadmills,...
WordPress FULL Customer Plugin <= 3.1.12 is vulnerable to Cross Site Scripting (XSS)
Software FULL Customer Type Plugin Vulnerable versions = 3.1.12 Fixed in 3.1.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6447 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d63d6fb916ff Credits stealthcopter...
Windows Virtual Delivery Agent for CVAD and Citrix DaaS Security Bulletin CVE-2024-6151
Description of Problem A vulnerability has been identified that impacts Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS. Refer to below for further details: Affected Versions The vulnerability affects the following supported versions of Windows Virtual...
CVE-2023-3290
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user customer in the system. This results in unauthorized data manipulation...
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2024-5491 and CVE-2024-5492
Description of Problem Two vulnerabilities have been discovered in NetScaler ADC formerly Citrix ADC and NetScaler Gateway formerly Citrix Gateway. Refer to below for further details: Affected Versions The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the...
CVE-2024-39598
SAP CRM WebClient UI Framework allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the applicati...
Easy!Appointments Security Vulnerability
Easy!Appointments is a web-based appointment and schedule management system. A security vulnerability exists in Easy!Appointments, which stems from an insecure authorization issue in the /customers/customerId interface. A low-privilege attacker can exploit this vulnerability to obtain, modify, or...
SAP CRM 安全漏洞
SAP CRM is a customer relationship management system from SAP in Germany. SAP CRM suffers from an authorization issue vulnerability that stems from not performing the necessary authorization checks on authenticated users, which could be exploited by an attacker to cause privilege escalation and...
SAP CRM Cross-Site Scripting Vulnerability
SAP CRM is a customer relationship management system from SAP, a German company. A cross-site scripting vulnerability exists in SAP CRM that stems from insufficient input validation and allows an unauthenticated attacker to craft a URL link embedded with a malicious script that, when clicked by a...