CVE-2020-24405

Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization...

PT-2020-4580 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.0 and 2.3.5p1 and earlier Description: The issue is related to an incorrect permissions problem in the Inventory module, which could be exploited by authenticated users to modify inventory stock data without proper...

PT-2020-4579 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.0 and 2.3.5p1 and earlier Description: The issue is related to incorrect user permissions within the Inventory component, allowing authenticated users with Inventory and Source permissions to make unauthorized changes to...

winstonwachter.inventory.gallery Cross Site Scripting vulnerability OBB-1401972

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Important: Red Hat Security Advisory: Satellite 6.7.4 Async Bug Fix Update

Updated Satellite 6.7 packages that fix several bugs are now available for Red Hat Satellite. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other clien...

Wachovia ERP has a logic flaw vulnerability

Huaxia ERP based on SpringBoot framework , aspires to provide small and medium-sized enterprises with open source and good ERP software , currently focusing on sales and inventory + financial functions . HUAXIA ERP has a logic flaw vulnerability that can be exploited by attackers to obtain...

RHEL 7 : Satellite 6.7.4 Async Bug Fix Update (Important) (RHSA-2020:4127)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4127 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide...

CS Money: Improper authentication in the load sell inventory page

Summary: Hello team, I found an endpoint response all data relate to sell mode inventory that doesn't have improper authentication in the link: https://cs.money/loadsellmodeinventory Steps To Reproduce: add details for how we can reproduce the issue 1. Open directly the link:...

Denial Of Service (DoS)

bcoin is vulnerable to denial of service DoS. Lack of proper handling of a large number of inventory inv messages and items allows an attacker to send multiple transaction of inv messages with random hashes to cause an uncontrolled resource consumption and out-of-memory OOM...

Bitcoin Inventory Out-of-Memory Denial-of-Service Attack (CVE-2018-17145)

There was an easily exploitable uncontrolled memory resource consumption denial-of-service vulnerability that existed in the peer-to-peer network code of three implementations of Bitcoin and several alternative chains. For more details please see: https://invdos.net/ For the paper:...

OCS Inventory NG CommandLine.php Command Injection (CVE-2020-14947)

A command injection vulnerability exists in OCS Inventory NG. The vulnerability is due to insufficient input validation in the CommandLine.php...

Detect FritzFrog and Other Malware Infections with Inventory Data

Recently, Guardicore researchers discovered a new type of malware called “FritzFrog,” which targets multiple industry verticals, including government, finance, and healthcare. It employs brute-forcing SSH credentials as an initial attack vector, uses a proprietary P2P protocol to efficiently...

CVE-2020-23836

A Cross-Site Request Forgery CSRF vulnerability in edituser.php in OSWAPP Warehouse Inventory System aka OSWA-INV through 2020-08-10 allows remote attackers to change the admin's password after an authenticated admin visits a third-party site...

CVE-2020-23836

A Cross-Site Request Forgery CSRF vulnerability in edituser.php in OSWAPP Warehouse Inventory System aka OSWA-INV through 2020-08-10 allows remote attackers to change the admin's password after an authenticated admin visits a third-party site...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF vulnerability in edituser.php in OSWAPP Warehouse Inventory System aka OSWA-INV through 2020-08-10 allows remote attackers to change the admin's password after an authenticated admin visits a third-party site...

CVE-2020-23836

A Cross-Site Request Forgery CSRF vulnerability in edituser.php in OSWAPP Warehouse Inventory System aka OSWA-INV through 2020-08-10 allows remote attackers to change the admin's password after an authenticated admin visits a third-party site...

CVE-2020-23836

CVE-2020-23836 describes a CSRF vulnerability in OSWAPP Warehouse Inventory System (OSWA-INV) in edit_user.php up to 2020-08-10 that allows an authenticated admin visiting a third-party site to change the admin password. CVSS v3.1 vectors: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H with base score 8.8 (...

PT-2020-15594

Name of the Vulnerable Software and Affected Versions OSWAPP Warehouse Inventory System aka OSWA-INV versions prior to 2020-08-10 Description A Cross-Site Request Forgery CSRF issue allows remote attackers to change the admin's password after an authenticated admin visits a third-party site. This...

PT-2020-15560

Name of the Vulnerable Software and Affected Versions Spiceworks versions prior to 7.5.00107 Description The issue affects the Custom Groups function, where any name typed in is vulnerable to stored XSS. This occurs because the input is displayed on the http://127.0.0.1/inventory/groups/ page...

CVE-2020-23450: Improper Neutralization of Input During Web Page Generation

Spiceworks Version = 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/inventory/groups/ without output sanitization...