1177 matches found
PT-2022-23834 · Unknown · Sourcecodester Online Medicine Ordering System
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Medicine Ordering System version 1.0 Description: A critical issue has been found in the system, affecting an unknown function of the file "admin/?page=orders/view order". The manipulation of the id argument leads to SQL...
WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability
Auth. Sensitive Data Exposure vulnerability discovered by Lana Codes Patchstack Alliance in WordPress Phone Orders for WooCommerce plugin versions = 3.7.1. Solution Update the WordPress Phone Orders for WooCommerce plugin to the latest available version at least 3.7.2...
The vulnerability of the D-Bus inter-process communication system, related to memory corruption after deallocation, allows a malicious actor to trigger a service failure.
The vulnerability of the D-Bus inter-process communication mechanism is related to a memory usage error that occurs after freeing memory, caused by messages with non-sequential byte orders and Unix file descriptors. Exploiting this vulnerability can allow an attacker to cause service failures...
Upgraded Q -> M from 873 [1666362235337]
Judge has assessed an item in Issue 873 as Medium risk. The relevant finding follows: Avoid payableaddress.transfer GolomTraderpayEther uses payableaddress.transfer to send native ETH. It's considered a best practice to avoid this pattern for ETH transfers, since it forwards a fixed gas stipend...
CVE-2022-41407
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
CVE-2022-41407
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
CVE-2022-41408
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
Sql injection
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
Sql injection
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
Online Pet Shop We App SQL注入漏洞
Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A security vulnerability exists in version 1.0 of Online Pet Shop We App, which stems from an SQL injection issue in the id parameter of the /admin/?page=orders/vieworder location...
CVE-2022-41407
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
CVE-2022-41408
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...
Online Pet Shop We App SQL注入漏洞
Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A security vulnerability exists in version 1.0 of Online Pet Shop We App, which stems from an SQL injection issue in the id parameter of the /admin/?page=orders/vieworder location...
blockRange should have a minimal value
Lines of code Vulnerability details Impact The blockRange doesn't have any minimal value so owner can call the setBlockRange function to change the blockRange value to a lower value which will automaticaly block the matching of some of the orders that have expirationTime == 0. Proof of Concept Th...
Asset that seller or buyer does not intend to sell or buy can be unexpectedly sold or bought
Lines of code Vulnerability details Impact Calling the execute function further calls the validateSignatures function, which executes if order.order.trader == msg.sender return true; . This means that the user, who calls the execute function, does not need to verify that the corresponding order w...
execute does not work for ERC1155 tokens orders where amount > 1
Lines of code Vulnerability details Impact StandardPolicyERC1155 functions canMatchMakerBid and canMatchMakerBid always return amount == 1, regardless of the function arguments. This means that calling execute on an agreed order of ERC1155 token with an amount 1 will always transfer amount == 1 o...
onlineorders.org.uk Cross Site Scripting vulnerability OBB-2981048
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2021-45788
Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter...
