CVE-2023-4947 WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update

The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordereandata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above,...

CVE-2023-4947

The CVE-2023-4947 entry concerns the WooCommerce EAN Payment Gateway plugin for WordPress. A missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0 allows authenticated attackers with contributor-level access or higher to modify EAN numbers on orders. The vulne...

CVE-2023-4947 WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update

The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordereandata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above,...

Former Uber CISO Appealing His Conviction

Joe Sullivan, Ubers CEO during their 2016 data breach, is appealing his conviction. Prosecutors charged Sullivan, whom Uber hired as CISO after the 2014 breach, of withholding information about the 2016 incident from the FTC even as its investigators were scrutinizing the companys data security a...

WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Stripe Payment Gateway Type Plugin Vulnerable versions = 7.6.0 Fixed in 7.6.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-44999 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 1f0dc5b09746 Credits...

CSRF in Payment Types

Description CSRF in Payment Types Proof of Concept 1 .Attacker send form fake to user history.pushState'', '', '/'; document.forms0.submit; 2 .User click , edited unwanted payment types Video Poc https://drive.google.com/file/d/1jI4bW5BJXGdJ7kICI-K1Kmg5y2EPw7f0/view?usp=sharing Payload Poc...

Amazon Prime email scammer snatches defeat from the jaws of victory

More often than not, its our solemn duty on this site to keep you informed about the nature and tactics of dangerous, cunnning, and persistent cybercriminals. This is not one of those days. In fact, this is the oppposite of one of those days. This is about a passable spam email sent by a spammer...

CVE-2023-39645

Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module “Theme Volty CMS Payment Icon” tvcmspaymenticon up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions...

CVE-2023-39645

Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module “Theme Volty CMS Payment Icon” tvcmspaymenticon up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions...

PrestaShop SQL Injection Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts, and product image scaling. PrestaShop suffers from an SQL injection vulnerability that originates from improper neutralization of SQL parameters...

PT-2023-27048 · Unknown +1 · Prestashop +1

Name of the Vulnerable Software and Affected Versions: Theme Volty CMS Payment Icon module for PrestaShop versions up to 4.0.1 Description: The issue is related to improper neutralization of SQL parameters in the Theme Volty CMS Payment Icon module for PrestaShop, allowing a guest to perform SQL...

Silent Skimmer: A Year-Long Web Skimming Campaign Targeting Online Payment Businesses

A financially motivated campaign has been targeting online payment businesses in the Asia Pacific, North America, and Latin America with web skimmers for more than a year. The BlackBerry Research and Intelligence Team is tracking the activity under the name Silent Skimmer, attributing it to an...

CVE-2023-44144

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Dreamfox Payment gateway per Product for WooCommerce plugin = 3.2.7 versions...

CVE-2023-44144

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Dreamfox Payment gateway per Product for WooCommerce plugin = 3.2.7 versions...

CVE-2023-44144 WordPress Dreamfox Media Payment gateway per Product for Woocommerce Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Dreamfox Payment gateway per Product for WooCommerce plugin = 3.2.7 versions...

CVE-2023-44144

The CVE refers to Dreamfox Media Payment gateway per Product for WooCommerce plugin, affected versions

WordPress Plugin Payment gateway per Product for WooCommerce Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Dreamfox Media Payment gateway per Product for Woocommerce < 3.2.8 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2023-29128 · Woocommerce · Dreamfox Media Payment Gateway Per Product For Woocommerce

Name of the Vulnerable Software and Affected Versions: Dreamfox Payment gateway per Product for WooCommerce plugin versions 3.2.7 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject...

Cross site scripting

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "configurationtitle1" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...