Shopify: Order Creation Webhooks can be edited/deleted by STAFF with `Settings` only permission

Hi, A STAFF with just Settings permission can only create 1 type of webhook called Shop Update as seen below. F368739 Attempting to create a Order Creation webhook via burp proxy gives a 403 -Forbidden response with the message indicating that You do not have permission to create webhooks with...

Microsoft SharePoint Enterprise Server Remote Elevation of Privilege Vulnerability (CNVD-2019-00965)

Microsoft SharePoint Enterprise Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. An...

CVE-2018-16587

In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to...

Oracle MySQL Client Component Access Control Error Vulnerability

Oracle MySQL is an open source relational database management system from Oracle, MySQL Client is a client component. An access control error vulnerability exists in the Oracle MySQL Client component. An attacker could exploit this vulnerability to unauthorized update, insert, or delete data,...

Oracle Solaris Local Vulnerability (CNVD-2018-09103)

Oracle Sun Systems Products Suite is a suite of Sun systems products from Oracle Corporation, of which Solaris is a Unix-like operating system. A local security vulnerability exists in Oracle Solaris, where the 'Network Services Library' subcomponent is affected. An attacker could exploit the...

NiuShop_b2c_data_release has multiple vulnerabilities

NiuShop open source mall system is by Shanxi Niu Cool Information Technology Co., Ltd. completely independent design, research and development of a set of PHP open source e-commerce system . NiuShopb2cdatarelease exists to bypass the payment vulnerability , file upload vulnerability , arbitrary...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2017-15383)

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Corporation, of which Oracle Partner Management is a partner management component. A security vulnerability exists in the User Interface subcomponent of the Oracle Partner...

Unauthorised Release Deletion

github.com/gogits/gogs is vulnerable to unauthorised release deletions. A malicious user can delete another user's repository releases by modifying a post request...

Oracle Siebel Remote Vulnerability (CNVD-2017-00909)

Oracle Siebel CRM is the United States Oracle Oracle company's set of customer relationship management solutions , which includes sales management , marketing management , customer service systems , call centers and other modules.Siebel UI Framework is one of the framework components based on the...

Xoops 2.5.7.2 - Arbitrary User Deletions CSRF

No description provided by source...

Xoops 2.5.7.2 - Cross-Site Request Forgery (Arbitrary User Deletions)

Exploit for php platform in category web applications var c=-1 var amttodelete=100 var id=document.getElementById"ids" var frm=document.getElementById"CSRF" function doit c++ arguments1.valu...

Xoops 2.5.7.2 - Cross-Site Request Forgery (Arbitrary User Deletions)

Xoops 2.5.7.2 - Cross-Site Request Forgery Arbitrary User Deletions var c=-1 var amttodelete=100 var id=document.getElementById"ids" var frm=document.getEleme...

Xoops 2.5.7.2 - Cross-Site Request Forgery (Arbitrary User Deletions)

var c=-1 var amttodelete=100 var id=document.getElementById"ids" var frm=document.getElementById"CSRF" function doit c++ arguments1.value=c arguments0...

XOOPS 2.5.7.2 Cross Site Request Forgery

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/XOOPS-CSRF.txt Vendor: ============= xoops.org Product: ================ Xoops 2.5.7.2 Vulnerability Type: =================================== CSRF - Arbitrary User Deletions...

Blink Denial of Service Vulnerability (CNVD-2015-08388)

Blink is a browser typography engine developed by Google and Opera Software. Blink suffers from a denial of service vulnerability. Allows remote attackers to cause a denial of service or unspecified other impact by exploiting unanticipated object deletions...

[SECURITY] Fedora 19 Update: chkrootkit-0.49-9.fc19

chkrootkit is a tool to locally check for signs of a rootkit. It contains: chkrootkit: shell script that checks system binaries for rootkit modification. ifpromisc: checks if the network interface is in promiscuous mode. chklastlog: checks for lastlog deletions. chkwtmp: checks for wtmp deletions...

DEBIAN-CVE-2014-2672

Race condition in the athtxaggrsleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service system crash via a large amount of network traffic that triggers certain list deletions...

Race condition

Race condition in the athtxaggrsleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service system crash via a large amount of network traffic that triggers certain list deletions...

CVE-2014-2672

CVE-2014-2672 : A race condition in the Linux kernel’s ath9k driver (ath_tx_aggr_sleep in drivers/net/wireless/ath/ath9k/xmit.c) before 3.13.7 can be triggered by a high volume of network traffic, enabling remote attackers to cause a denial of service (system crash). Public sources in connected d...

UBUNTU-CVE-2014-2672

Race condition in the athtxaggrsleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service system crash via a large amount of network traffic that triggers certain list deletions...