6825 matches found
PT-2023-12734
Name of the Vulnerable Software and Affected Versions Firmanet Software and Technology Customer Relation Manager versions prior to 2022.03.13 Description The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This means an...
Shipt: Improper Access Control + Financial fraud allows attacker to disclose + add arbitrary products to another's user's order
The vulnerability allowed an attacker to add arbitrary products to another user's order before it was placed. The attacker could also disclose the content of the victim's order, including their physical address. This was possible due to improper access control and lack of input validation on the...
Fastly Secret Disclosure
Correspondence from Fastly declined to comment regarding new discovered vulnerabilities within their website. Poor practices regarding password changes. 1. Reset user password 2. Access link sent 3. Temporary password sent plaintext // HTTP POST request POST...
Computer Parts Sales and Inventory System SQL注入漏洞
Computer Parts Sales and Inventory System is a computer parts sales and inventory system by Warren Daloyan, an individual developer. SourceCodester Computer Parts Sales and Inventory System version 1.0 suffers from a SQL injection vulnerability that originates from a security issue in the file...
Wiz and SentinelOne announce exclusive partnership to deliver end to end cloud security
Leading cybersecurity companies partner to increase customer value and disrupt the enterprise security industry...
Malicious Package
Overview ing-feat-customer-video is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
The benefits of a customer-centric cloud security mindset
Why a customer focus unlocks new levels of innovation and enables security team success...
MAL-2023-524 Malicious code in ing-feat-customer-video (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c3fc5de716b81fb2390c30a9d7aa59bfc20904a4e5361564c1bc356cd5d0011 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Hackers Exploit Containerized Environments to Steal Proprietary Data and Software
A sophisticated attack campaign dubbed SCARLETEEL is targeting containerized environments to perpetrate theft of proprietary data and software. "The attacker exploited a containerized workload and then leveraged it to perform privilege escalation into an AWS account in order to steal proprietary...
Wordfence WooCommerce 2FA: Set Up This New Feature To Protect Your Customers
On February 15, we made the exciting announcement that the latest release of Wordfence, version 7.9.0, includes a new feature: WooCommerce 2FA two-factor authentication for customer level users. What does this mean for you as an e-commerce store operator? And how can you start using this feature?...
PT-2023-16777 · Sourcecodester · Sourcecodester Computer Parts Sales/Inventory System
Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Parts Sales and Inventory System version 1.0 Description: A vulnerability has been found in the SourceCodester Computer Parts Sales and Inventory System, affecting unknown code of the file customer.php. The manipulatio...
SourceCodester Computer Parts Sales and Inventory System 跨站脚本漏洞
Computer Parts Sales and Inventory System is a computer parts sales and inventory system by Warren Daloyan, an individual developer. A cross-site scripting vulnerability exists in SourceCodester Computer Parts Sales and Inventory System version 1.0, which stems from unknown problematic code in th...
LastPass Reveals Second Attack Resulting in Breach of Encrypted Password Vaults
LastPass, which in December 2022 disclosed a severe data breach that allowed threat actors to access encrypted password vaults, said it happened as a result of the same adversary launching a second attack on its systems. The company said one of its DevOps engineers had their personal home compute...
SQL Injection in 'core/ajax/ajax_data.php'
Description There exists an SQL injection affecting the customerid parameter located in the file core/ajax/ajaxdata.php Let's take a look at the following code: https://github.com/unilogies/bumsys/blob/9dc2de204116297a7e528c38bc3b1e89bf40f907/core/ajax/ajaxdata.phpL537 sql where stockproductid =...
CVE-2023-24653
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under the Change Password function...
CVE-2023-24656
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the subject parameter under the Create Ticket function...
CVE-2023-24651
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter on the registration page...
CVE-2023-24652
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the Description parameter under the Create ticket function...
