PT-2024-27627 · Woocommerce · Cc & Bcc For Woocommerce Order Emails

Name of the Vulnerable Software and Affected Versions: CC & BCC for Woocommerce Order Emails versions 1.4.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, which means...

CVE-2024-6932 ClassCMS cross site scripting

A vulnerability was found in ClassCMS 4.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/?action=home&do=shop:index&keyword=&kind=all. The manipulation of the argument order leads to cross site scripting. The attack can be...

PT-2024-37970 · Classcms · Classcms

Name of the Vulnerable Software and Affected Versions: ClassCMS version 4.5 Description: A vulnerability has been found in an unknown functionality of the file "/admin/?action=home&do=shop:index&keyword=&kind=all". The manipulation of the order argument leads to cross-site scripting. The attack c...

ClassCMS 跨站脚本漏洞

ClassCMS is China ClassCMS open source a simple , flexible , secure , easy to expand the content management system . ClassCMS cross-site scripting vulnerability , the vulnerability stems from /admin/?action=home&do=shop:index&keyword=&kind=all file in the order parameter contains cross-site...

The vulnerability of the Packet Forwarding Engine (PFE) module in Juniper Networks’ Junos OS network devices of the EX4300 series allows a attacker to compromise the integrity of the protected information.

The vulnerability of the Packet Forwarding Engine PFE module in Juniper Networks’ Junos OS networking devices of the EX4300 series is related to the absence of blocking mechanisms for outgoing traffic when certain actions are performed in the wrong order. Exploiting this vulnerability can allow a...

PT-2024-29867

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the mailbox: mtk-cmdq component. When mtk-cmdq unbinds, a WARN ON message with condition pm runtime get sync 0 occurs. T...

CVE-2024-40633 Customer data leak via adjustments API endpoint in Sylius

Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the /api/v2/shop/adjustments/id endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve ord...

CVE-2024-40633 Customer data leak via adjustments API endpoint in Sylius

Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the /api/v2/shop/adjustments/id endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve ord...

CVE-2024-40633

Summary: CVE-2024-40633 affects Sylius (Symfony-based) in the /api/v2/shop/adjustments/{id} endpoint. The flaw enables an attacker to enumerate valid adjustment IDs and retrieve order tokens, potentially exposing sensitive guest customer order details. Affected/Root cause: Unauthenticated access ...

CVE-2024-6830

A vulnerability, which was classified as critical, was found in SourceCodester Simple Inventory Management System 1.0. Affected is an unknown function of the file action.php of the component Order Handler. The manipulation of the argument orderid leads to sql injection. It is possible to launch t...

CVE-2024-6830

A vulnerability, which was classified as critical, was found in SourceCodester Simple Inventory Management System 1.0. Affected is an unknown function of the file action.php of the component Order Handler. The manipulation of the argument orderid leads to sql injection. It is possible to launch t...

CVE-2024-6830

CVE-2024-6830 affects SourceCodester Simple Inventory Management System 1.0, specifically the Order Handler’s file action.php. The vulnerability arises from an unauthenticated manipulation of the order_id argument, leading to SQL injection. It is described as exploitable remotely, with public dis...

CVE-2024-6830 SourceCodester Simple Inventory Management System Order action.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Simple Inventory Management System 1.0. Affected is an unknown function of the file action.php of the component Order Handler. The manipulation of the argument orderid leads to sql injection. It is possible to launch t...

SUSE CVE-2022-48783

In the Linux kernel, the following vulnerability has been resolved: net: dsa: lantiqgswip: fix use after free in gswipremove ofnodeputpriv-ds-slavemiibus-dev.ofnode should be done before mdiobusfreepriv-ds-slavemiibus...

SUSE CVE-2024-40975

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: Unregister devices in reverse order Not all subsystems support a device getting removed while there are still consumers of the device with a reference to the device. One example of this is the...

kernel: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map

A vulnerability was found in the mlx5etxwqecomplete function in the Linux kernel. The CPU or compiler may reorder two of the functions: mlx5eptpmetadatamapput and mlx5eptpsqtrackmetadata, and a situation could arise where metadata tracking occurs before the metadata map is fully populated. This...

Simple Inventory Management System SQL注入漏洞

Simple Inventory Management System is a simple inventory management system. A SQL injection vulnerability exists in Simple Inventory Management System version 1.0 due to a lack of validation of the parameter orderid against externally entered SQL statements. An attacker can exploit this...

PT-2024-37890 · Sourcecodester · Sourcecodester Inventory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Inventory Management System version 1.0 Description: A critical issue was found in the Order Handler component of the affected software, specifically in an unknown function of the file action.php. The manipulation of the...

CVE-2024-40975

A vulnerability was found in platform/x86 in the Linux kernel. This issue was resolved by changing the device removal order to unregister devices in reverse order of their registration. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the...

DEBIAN-CVE-2022-48792

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted SSP/STP sastask Currently a use-after-free may occur if a sastask is aborted by the upper layer before we handle the I/O completion in mpisspcompletion or mpisatacompletion. In this...