1388 matches found
CVE-2022-0762 Incorrect Authorization in microweber/microweber
Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3...
CVE-2022-0762
The CVE-2022-0762 entry maps to a Microweber logic flaw: before version 1.3, business logic errors lead to incorrect authorization and allow adding deleted products to a cart and purchasing them. The root cause is unauthorized access within the microweber/microweber repository’s logic. A remediat...
PT-2022-13418 · Unknown · Microweber
Name of the Vulnerable Software and Affected Versions: microweber versions prior to 1.3 Description: The issue concerns business logic errors and incorrect authorization in the microweber repository. This allows users to add deleted products to a cart and buy them, exposing resources to the wrong...
microweber 安全漏洞
Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A logic flaw vulnerability exists in Microweber, which stems from an error in the business...
Microweber 跨站脚本漏洞
Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in Microweber, which stems from the lack of prope...
Microweber跨站脚本漏洞
Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in GitHub, which stems from the lack of proper...
Metasploit Weekly Wrap-Up
Exchange RCE Exchange remote code execution vulnerabilities are always valuable exploits to have. This week Metasploit added an exploit for an authenticated RCE in Microsoft Exchange servers 2016 and server 2019 identified as CVE-2021-42321. The flaw leveraged by the exploit exists in a...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to cross-site scripting. The vulnerability exists in admin page due to the lack of input sanitization in the createmediadir function in the MediaManager.php file allowing an attacker to inject and execute malicious javascript...
Microweber Information Disclosure Vulnerability (CNVD-2022-71439)
Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. An information disclosure vulnerability exists in versions of Microweber prior to 1.3, which stems from the fact that when...
Microweber CMS v1.2.10 Local File Inclusion (Authenticated)
Microweber CMS v1.2.10 has a backup functionality. Upload and download endpoints can be combined to read any file from the filesystem. Upload function may delete the local file if the web service user has access. Module Options msf use auxiliary/gather/microweberlfi msf auxiliarymicroweberlfi sho...
Information Disclosure
microweber is vulnerable to information disclosure. The vulnerability exists due to a lack of sanitization in the plupload.php file allowing a remote attacker to view sensitive informations...
Information Disclosure
microweber is vulnerable to information disclosure. The vulnerability exists due to a lack of sanitization in the Handler.php file allow to view sensitive information in debug mode...
GHSA-MJVC-J6RV-9XJ8 Insertion of Sensitive Information Into Debugging Code in Microweber
Microweber prior to 1.3 may expose sensitive information about a server and a user when running the server in debug mode...
Insertion of Sensitive Information Into Debugging Code in Microweber
Microweber prior to 1.3 may expose sensitive information about a server and a user when running the server in debug mode...
GHSA-HJ8G-CW8X-2C6M Cross-site Scripting in Microweber
Microweber prior to version 1.3 is vulnerable to reflected cross-site scripting...
GHSA-J8CX-J9J2-F29W Insecure Storage of Sensitive Information in Microweber
Microweber prior to version 1.3 does not strip images of EXIF data, exposing information about users' locations, device hardware, and device software...
Insecure Storage of Sensitive Information in Microweber
Microweber prior to version 1.3 does not strip images of EXIF data, exposing information about users' locations, device hardware, and device software...
Cross-site Scripting in Microweber
Microweber prior to version 1.3 is vulnerable to reflected cross-site scripting...
