CVE-2022-30799

Online Ordering System v1.0 by oretnom23 has SQL injection via store/orderpage.php...

CVE-2022-30799

Online Ordering System v1.0 by oretnom23 has SQL injection via store/orderpage.php...

CVE-2022-30423

Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...

CVE-2022-30423

Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...

CVE-2022-30423

Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...

Information disclosure

Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...

solidus_backend cross-site request forgery vulnerability

Solidus is an open source e-commerce system. solidusbackend is the administrative interface of the Solidus e-commerce framework. solidusbackend is vulnerable to cross-site request forgery, which can be exploited by attackers to change the status of order adjustments while holding an order number,...

Online Ordering System SQL注入漏洞

Online Ordering System is a multi-store ordering system that can be used by any small business. statements, which can be exploited to execute illegal SQL commands to steal sensitive database data...

Merchandise Online Store 代码问题漏洞

Merchandise Online Store is a Merchandise Online Store system developed by Carlo Montero. A security vulnerability exists in Merchandise Online Store v1.0, which is caused by a remote code injection issue in the user profile upload port on the system information page...

Online Ordering System SQL注入漏洞

Online Ordering System is a multi-store ordering system that can be used by any small business. version 1.0 of Online Ordering System is vulnerable to a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements on the store/orderpage.php page, which cou...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF by allowing attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Remediation Upgrade solidusbackend to version...

CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

Impact CSRF vulnerability allowing attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Reproduction steps: - Take an order's number. - Log in as an administrator. - Visit that order's adjustments section...

Cross site request forgery (csrf)

solidusbackend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery CSRF vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the...

CVE-2022-30799

Online Ordering System v1.0 by oretnom23 has SQL injection via store/orderpage.php...

Latest Mobile Malware Report Suggests On-Device Fraud is on the Rise

An analysis of the mobile threat landscape in 2022 shows that Spain and Turkey are the most targeted countries for malware campaigns, even as a mix of new and existing banking trojans are increasingly targeting Android devices to conduct on-device fraud ODF. Other frequently targeted countries...

Android apps with millions of downloads exposed to high-severity vulnerabilities

Microsoft uncovered high-severity vulnerabilities in a mobile framework owned by mce Systems and used by multiple large mobile service providers in pre-installed Android System apps that potentially exposed users to remote albeit complex or local attacks. The vulnerabilities, which affected apps...

Android apps with millions of downloads exposed to high-severity vulnerabilities

Microsoft uncovered high-severity vulnerabilities in a mobile framework owned by mce Systems and used by multiple large mobile service providers in pre-installed Android System apps that potentially exposed users to remote albeit complex or local attacks. The vulnerabilities, which affected apps...

CVE-2022-30423

Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...

CVE-2022-30423

CVE-2022-30423 affects Merchandise Online Store v1.0 by oretnom23. The vulnerability is described as an arbitrary code execution (RCE) in the user profile upload point on the system information page. The available connected documents corroborate an RCE impact but do not provide technical details ...

ChromeLoader targets Chrome Browser users with malicious ISO files

If you’re on the hunt for cracked software or games, be warned. Rogue ISO archive files are looking to infect your systems with ChromeLoader. If you think campaigns such as this only target Windows users, you’d sadly be very much mistaken. The attack sucks in several operating systems and even us...