Amazon Linux 2 : unixODBC (ALAS-2019-1354)

A buffer overflow flaw was found in the unicodetoansicopy function of unixODBC. This overflow is not directly controllable by an attacker making the maximum potential impact a crash or denial of service.CVE-2018-7409 An argument order confusion flaw was found in the SQLWriteFileDSN API of unixODB...

CVE-2019-13076

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...

CVE-2019-12918

Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is softwarelibrary.php and affected parameters are order0column and order0dir...

CVE-2019-13076

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...

Sql injection

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...

CVE-2019-12918

Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is softwarelibrary.php and affected parameters are order0column and order0dir...

Medium: unixODBC

Issue Overview: A buffer overflow flaw was found in the unicodetoansicopy function of unixODBC. This overflow is not directly controllable by an attacker making the maximum potential impact a crash or denial of service.CVE-2018-7409 An argument order confusion flaw was found in the SQLWriteFileDS...

The vulnerability of the Order Tracker sub-component of the Oracle iStore component in the Oracle E-Business Suite system allows a perpetrator to access data for modification, addition, or deletion, or to gain unauthorized access to protected information.

The vulnerability of the Order Tracker sub-component of the Oracle iStore component in the Oracle E-Business Suite automation system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain...

WordPress YITH Pre-Order for WooCommerce plugin <= 1.2.0 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH Pre-Order for WooCommerce plugin versions = 1.2.0. Solution Update the WordPress YITH Pre-Order for WooCommerce plugin to the latest available version at least 1.2.1...

WordPress YITH WooCommerce Order Tracking plugin <=1.2.10 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Order Tracking plugin versions =1.2.10. Solution Update the WordPress YITH WooCommerce Order Tracking plugin to the latest available version at least 1.2.11...

Unauthorized Form Data Modification

cezerin is vulnerable to unauthorized form data modification. Internal attributes such as paid and tax in the getValidDocumentForUpdate function in api/server/services/orders/orders.js can be overwritten using a conflicting name from user-input. This allows a malicious user to manipulate an order...

CVE-2019-18608

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...

Information disclosure

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...

CVE-2019-18608

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order e.g., its payment status or shipping fee by adding additional...

CVE-2019-18608

CVE-2019-18608 affects Cezerin v0.33.0, where internal attributes can be overwritten during order processing, allowing a malicious user to modify an order (e.g., payment status or shipping fee) by injecting extra attributes in user input via PUT /ajax/cart during checkout. The issue stems from ge...

The vulnerability of the sub-component “Engineering Change Order” of the Oracle Installed Base component in the Oracle E-Business Suite system allows a malicious actor to gain access to modify, add, or delete data.

The vulnerability of the Engineering Change Order component of the Oracle Installed Base component in the Oracle E-Business Suite system for enterprise automation activities is related to lack of access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to...

Mail.ru: [api.pandao.ru] IDOR for order delivery address

API method in api.pandao.ru was not properly restricted and could be used to view delivery address information of arbitrary order...

CVE-2019-3024

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Engineering Change Order. Supported versions that are affected are 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed...

CVE-2019-2990

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: Order Tracker. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore...

CVE-2019-3024

The CVE-2019-3024 issue affects Oracle E-Business Suite Installed Base, Engineering Change Order component, in versions 12.2.3–12.2.9. The vulnerability allows an unauthenticated, network-accessible attacker to interact via HTTP, with user interaction required for exploitation, potentially enabli...