6801 matches found
DRUPAL-CONTRIB-2024-021
The Commerce View Receipts module enables you to view commerce order receipts in the browser. The module doesn't sufficiently check access permissions, allowing an unauthorised user to view the private information of other customers...
Arris VAP2500 命令注入漏洞
The Arris VAP2500 is a wireless video access point device from Arris USA. A command injection vulnerability exists in the Arris VAP2500 version 08.50, which stems from the fact that manipulation of the parameter customerinfo in the file /diags.php can result in command injection...
The vulnerability of Microsoft Dynamics 365 Customer Insights’ CDP platform allows a hacker to perform spear-phishing attacks.
The vulnerability of the Microsoft Dynamics 365 Customer Insights CDP platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out spear-phishing attacks...
The vulnerability of Microsoft Dynamics 365 Customer Insights’ CDP platform allows a hacker to perform spear-phishing attacks.
The vulnerability of the Microsoft Dynamics 365 Customer Insights CDP platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out spear-phishing attacks...
Dell Data Breach: Personal Information of 49 Million Customers Compromised due to latest API Abuse
Dell recently issued a notice regarding a data breach that occurred on May 9, which has reportedly affected over 49 million customers across the globe. According to a report by BleepingComputer, Dell initiated the distribution of notifications cautioning its customers that their personally...
Financial institutions ordered to notify customers after a breach, have an incident response plan
The Securities and Exchange Commission SEC has announced rules around breaches for certain financial institutions—registered broker-dealers, investment companies, investment advisers, and transfer agents— that require them to have written incident response policies and procedures that can be used...
Unauthorized Data Access
Klaviyo Magento 2 is vulnerable to Unauthorized Data Access. The vulnerability is due to insufficient access controls in an endpoint, allowing attackers to read private customer data from stores by reclaiming guest-carts and accessing order details via the Magento API...
Magento Open Source Security Advisory: Patch SUPEE-10975
Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution RCE, cross-site scripting XSS, cross-site request forgery CSRF, and more. The following issues have been identified and...
GHSA-HVGW-GG3P-295J Read private customer data reclaiming carts in Klaviyo Magento
A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API...
Cross-Site Scripting (XSS)
prestashop/prestashop is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the customer thread feature allowing malicious file uploads through the front-office contact form. When an admin opens the attached file in back office, arbitrary JavaScript will be executed which can...
PT-2024-40329 · Klaviyo · Klaviyo Magento 2
Name of the Vulnerable Software and Affected Versions: Klaviyo Magento 2 affected versions not specified Description: A researcher discovered an issue in a third-party module that allows reading private customer data from stores. This is achieved by reclaiming any guest-cart as one's own and then...
GHSA-45VM-3J38-7P78 PrestaShop cross-site scripting via customer contact form in FO, through file upload
Impact Only PrestaShops with customer-thread feature flag enabled are impacted, starting from PrestaShop 8.1.0. The impact is substantial, when the customer thread feature flag is enabled, through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be...
PrestaShop cross-site scripting via customer contact form in FO, through file upload
Impact Only PrestaShops with customer-thread feature flag enabled are impacted, starting from PrestaShop 8.1.0. The impact is substantial, when the customer thread feature flag is enabled, through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be...
CVE-2024-30048
Dynamics 365 Customer Insights Spoofing Vulnerability...
CVE-2024-30047
Dynamics 365 Customer Insights Spoofing Vulnerability...
CVE-2024-30047
Dynamics 365 Customer Insights Spoofing Vulnerability...
CVE-2024-30048 Dynamics 365 Customer Insights Spoofing Vulnerability
...
CVE-2024-30048
CVE-2024-30048 relates to a spoofing vulnerability in Microsoft Dynamics 365 Customer Insights. The connected advisories indicate an XSS-style issue that could lead to execution of arbitrary code in the victim’s browser or access to sensitive data, with exploitation requiring prior authentication...
