CVE-2023-36644

== 受影响软件 %hardbreaks 供应商： ITB-GmbH 受影响产品： TradePro v9.5 组件： Printmail 插件 已确认： 是 == 攻击向量 %hardbreaks 类型： 不正确的访问控制 访问方式： 远程 影响： 信息泄露 ITB-GmbH TradePro v9.5 中的 printmail 插件存在不正确的访问控制，允许远程攻击者通过向一个 https 端点传递任意订单编号，接收来自在线商店的所有订单确认信息。 == 描述 orderid 应事先已知，但可以被轻易枚举，或通过 SQLi...

EUVD-2023-40589

Malicious code in bioql PyPI...

EUVD-2023-40588

Malicious code in bioql PyPI...

EUVD-2023-40587

Malicious code in bioql PyPI...

CVE-2023-36645

SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function...

CVE-2023-36644

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin...

CVE-2023-36645

SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function...

CVE-2023-36643

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer function...

CVE-2023-36645

SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function...

ITB-GmbH TradePro 安全漏洞

ITB-GmbH TradePro is a complete B2B e-shop from ITB-GmbH. A security vulnerability exists in ITB-GmbH TradePro version v9.5, which stems from incorrect access control. A remote attacker uses the vulnerability to receive all orders from the online store via the oordershow component in the customer...

CVE-2023-36643

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer function...

CVE-2023-36645

SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function...

CVE-2023-36645

The CVE-2023-36645 entry concerns ITB-GmbH TradePro v9.5 with a SQL injection via the oordershow component in the customer function. Connected PT-2024-12574 details show the root cause as an access-control weakness allowing remote exploitation to execute SQL queries. Affects ITB-GmbH TradePro 9.5...

CVE-2023-36643

Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow component in customer function...

CVE-2023-36644

CVE-2023-36644 affects ITB-GmbH TradePro v9.5. The issue stems from Incorrect Access Control in the printmail plugin, enabling remote attackers to retrieve all order confirmations from the online shop. Connected sources corroborate the affected product (TradePro v9.5) and the vulnerability class ...