GHSA-J65R-G7Q2-F8V3 Pimcore customers' list user password hash is disclosed

Impact The customer view exposes the hashed password along with other deails. An attacker is then able to enum password of a particular id, likewise we can replace id with other user , for example 1015, password hash can be disclosed which can be further cracked with hashcat Patches Update to...

CVE-2023-2881

Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10...

Format string

Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10...

PT-2023-20061 · Square Pig · Fusioninvoice

Name of the Vulnerable Software and Affected Versions: Square Pig FusionInvoice version 2023-1.0 Description: A Stored Cross Site Scripting XSS issue allows attackers to execute arbitrary code via the description or content fields in expenses, tasks, and customer details. This enables malicious...

PT-2023-21983 · Pimcore · Pimcore/Customer-Data-Framework

Name of the Vulnerable Software and Affected Versions: pimcore/customer-data-framework versions prior to 3.3.10 Description: The issue concerns storing passwords in a recoverable format. An attacker can exploit this by enumerating passwords for specific IDs, potentially leading to the disclosure ...

CVE-2023-2881 Storing Passwords in a Recoverable Format in pimcore/customer-data-framework

Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10...

CVE-2023-25439

Stored Cross Site Scripting XSS vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content fields to the expenses, tasks, and customer details...

Pimcore 安全漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A security vulnerability exists in Pimcore...

CVE-2023-2868

A remote command injection vulnerability exists in the Barracuda Email Security Gateway appliance form factor only product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file tape archives. The vulnerability ste...

CVE-2023-2864

A vulnerability was found in SourceCodester Online Jewelry Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file customer.php of the component POST Parameter Handler. The manipulation of the argument Custid leads to cross site scripting. The...

Online Jewelry Store 跨站脚本漏洞

Online Jewelry Store is an online jewelry store for janobe individual developers. A cross-site scripting vulnerability exists in SourceCodester Online Jewelry Store version 1.0, which stems from a problem in the customer.php file and can be exploited by an attacker to conduct a cross-site scripti...

Microsoft Build 2023: Announcing new identity, compliance, and security features from Microsoft Security

At Microsoft Build 2023—an event for developers by developers—we’re going to announce exciting new features and technologies, share ideas, and help everyone boost their skills so we can all build a more secure future together. This year’s Microsoft Build offers a full program, both online and...

Billing Management System SQL Injection Vulnerability

Billing Management System is a simple web application for managing customer billing for electricity supplier companies. A SQL injection vulnerability exists in Billing Management System v1.0, which stems from a lack of validation of externally entered SQL statements in the parameter id of...

CVE-2023-2756 SQL Injection in pimcore/customer-data-framework

SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10...

CVE-2023-2756

CVE-2023-2756 is a SQL injection vulnerability in Pimcore’s customer-data-framework prior to version 3.3.10. The issue affects the Pimcore product/component and is rooted in insecure handling of SQL queries within the segment/authorization logic, allowing an administrator-like user to execute arb...

Pimcore SQL注入漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A SQL injection vulnerability exists in Pimcore...

Business Logic Flaws

pimcore/customer-management-framework-bundle is vulnerable to Business Logic Flaws. The Conditions tab is vulnerable to business logic errors due to allowing a negative number as a counter...

PT-2023-22622 · Unknown · Scquickaccounting

Name of the Vulnerable Software and Affected Versions: scquickaccounting versions prior to 3.7.3 Description: The issue is related to insecure permissions in the ps customer table, allowing unauthorized access to sensitive information such as name, surname, and email. This lack of permissions...

CSV Injection

pimcore/customer-management-framework-bundle is vulnerable to CSV Injection. The vulnerability exists because the getExportData function of AbstractExporter.php does not properly escape CSV records in the Firstname, Lastname, Street, Zip & City input fields, which allows an attacker to inject and...

CVE-2023-32075

The Customer Management Framework CMF for Pimcore adds functionality for customer data management. In pimcore/customer-management-framework-bundle prior to version 3.3.9, business logic errors are possible in the Conditions tab since the counter can be a negative number. This vulnerability is...