Shopware guest session is shared between customers

Impact Guest sessions are shared between customers when HTTP cache is enabled. Setups with Varnish are not affected by this issue Patches We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview...

Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting

The plugin does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a...

Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi

The plugin does not sanitise and escape some parameters before using them in SQL statements via AJAX actions available to unauthenticated users, leading to SQL Injections PoC order and columns parameters are affected curl 'https://example.com/wp-admin/admin-ajax.php' --data...

WordPress Anti-Malware Security and Brute-Force Firewall跨站脚本漏洞

WordPress is a set of blogging platforms developed by the WordPress Wordpress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress Anti-Malware Security and Brute-Force Firewall, which stems from the fact that the plugin does not clean and escape POST da...

CVE-2022-0211

The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2022-0211

The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

Rockwell (CVE-2012-0221) (deprecated)

Plugin deprecated because rslogix and factorytalk is not detectable in this way This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2023/03/10. Deprecat...

SEL Controller Asset Information

It is possible to obtain attributes of the remote SEL Controller device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc...

Schneider (CVE-2013-0687) (deprecated)

Plugin deprecated because micoms1studio is not detectable in this way This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2023/03/10. Deprecated because...

Embed Swagger <= 1.0.0 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0. PoC...

Open redirect in shopware

Impact Arbitrary redirect while using certain URLs Patches We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plugin:...

GHSA-C53V-QMRX-93HG Open redirect in shopware

Impact Arbitrary redirect while using certain URLs Patches We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plugin:...

Insufficient Session Expiration in shopware

Impact Automatically invalidate sessions upon password change Patches We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plugin:...

The vulnerability of the WS-Security plugin in the gSOAP software development environment allows a attacker to cause a service failure.

The vulnerability of the WS-Security plugin in the gSOAP software development environment is related to errors in pointer assignment during SOAP request processing. Exploiting this vulnerability allows an attacker to cause service failures by sending specially crafted HTTP requests...

Wordpress Smart Product Review 1.0.4 Plugin - Shell Upload Exploit

Exploit Title: Wordpress Plugin Smart Product Review 1.0.4 - Arbitrary File Upload Google Dork: inurl: /wp-content/plugins/smart-product-review/ Exploit Author: Keyvan Hardani Vendor Homepage: https://demo.codeflist.com/wordpress-plugins/smart-product-review/ Version: = 1.0.4 Tested on: Kali Linu...

GHSA-4P3X-8QW9-24W9 Authenticated Stored XSS in shopware/shopware

Impact Authenticated Stored XSS in Administration Patches Use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html Workarounds If you cannot use the security plugin, add the following config to your .htaccess file Header set Content-Security-Policy...

Authenticated Stored XSS in shopware/shopware

Impact Authenticated Stored XSS in Administration Patches Use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html Workarounds If you cannot use the security plugin, add the following config to your .htaccess file Header set Content-Security-Policy...

CVE-2021-41188

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the .htaccess file will protect against...

CVE-2021-41188

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the .htaccess file will protect against...

Cross site scripting

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the .htaccess file will protect against...