Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure

The plugin does not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data Make a booking to get a customer account Login via API and get access token: curl...

CVE-2021-33853

A Cross-Site Scripting XSS attack can cause arbitrary code javascript to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS payload is executed when the...

CafePress faces $500,000 fine for data breach cover up

The US Federal Trade Commission FTC has announced that it took action against online customized merchandise platform CafePress over allegations that it failed to secure consumers’ sensitive personal data and covered up a major breach. CafePress is a popular online custom T-shirt and merchandise...

CVE-2020-36519

Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rewrite feature. The domain being spoofed must be a customer in the Mimecast grid from which the spoofing occurs...

Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure

The plugin does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious actor can abuse this vulnerabilit...

Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update

The plugin does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it. 1. Make a booking to become customer ...

Shopware Access Control Error Vulnerability

Shopware is a suite of open source e-commerce software from the German company Shopware. Shopware is vulnerable to an access control error that stems from not properly setting sensitive HTTP headers to non-cacheable, which could be exploited by an attacker to enable HTTP caching and then have...

Critical RCE Bugs Found in Pascom Cloud Phone System Used by Businesses

Researchers have disclosed three security vulnerabilities affecting Pascom Cloud Phone System CPS that could be combined to achieve a full pre-authenticated remote code execution of affected systems. Kerbit security researcher Daniel Eshetu said the shortcomings, when chained together, can lead t...

PT-2022-16851 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.4.8.2 Description: The issue is a result of improper API route checking, allowing modification of customers and creation of orders without App Permission. This affects Shopware, an open commerce platform based on...

SalesAgility SuiteCRM 安全漏洞

Salesagility SalesAgility SuiteCRM is a suite of enterprise-grade, open source Customer Relationship Management CRM from Salesagility UK. A security vulnerability exists in SalesAgility SuiteCRM that stems from incorrect authorization in the GitHub repository salesagility suitecrm prior to 7.12.5...

Cisco stands on guard with our customers in Ukraine

As the Russia-led invasion intensifies, Ukraine is being attacked by bombs and bytes. Cisco is working around the clock on a global, company-wide effort to protect our customers there and ensure that nothing goes dark. Cisco Talos has taken the extraordinary step of directly operating security...

CVE-2022-25394

Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php...

CVE-2022-25394

Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php...

CVE-2022-25394

CVE-2022-25394 affects the Medical Store Management System v1.0. The vulnerability is a SQL injection in the cid parameter of customer-add.php, with CVSS-3.1 base score 9.8 (CRITICAL) and high impact on confidentiality, integrity, and availability. The attack vector is network and requires no pri...

Data breaches leave customers very shaky, report says

Data breaches are one of the most reported cyberattacks against businesses—regardless of size and industry. And while this has highlighted cybersecurity gaps on so many fronts, some companies are still not prioritizing them as they should. Some have scrambled to be compliant but then find...

Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Program Management (CVE-2021-35557)

Summary IBM Emptoris Program Management supports Oracle database server as a backend database. The remediated version of Oracle database server has been certified by IBM Emptoris Program Management. Vulnerability Details CVEID: CVE-2021-35557 DESCRIPTION: An unspecified vulnerability in Oracle...

WordPress "Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer" plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer" plugin versions = 1.0.0. Solution No patched version available...

WordPress PureDevs Customer History for WooCommerce plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress PureDevs Customer History for WooCommerce plugin versions = 1.0.0. Solution Update the WordPress PureDevs Customer History for WooCommerce plugin to the latest available version at least 1.0.1...

WordPress Product Customer List for WooCommerce plugin < 3.0.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Product Customer List for WooCommerce plugin versions 3.0.0. Solution Update the WordPress Product Customer List for WooCommerce plugin to the latest available version at least 3.0.0...

WordPress Customer Chat Facebook plugin <= 1.1.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Customer Chat Facebook plugin versions = 1.1.1. Solution No patched version available...