UBUNTU-CVE-2019-25025

The activerecord-sessionstore aka Active Record Session Store component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a...

Rafael França activerecord-session_store 安全漏洞

Rafael França activerecord-sessionstore is an open source application by Rafael França. A default class is provided, but any object with a textual sessionid and data attribute duck-typed into the Active Record Session class is sufficient. A security vulnerability exists in all versions of...

EulerOS Virtualization for ARM 64 3.0.6.0 : libdb (EulerOS-SA-2021-1555)

According to the version of the libdb packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138,...

Qualcomm 封闭源组件安全漏洞

A security vulnerability exists in the Qualcomm closed source component that stems from a check time or use time window when processing a store SCM command, where a pointer used may be invalid at a specific time when executing a store SCM call...

ALERT: Malicious Amazon Alexa Skills Can Easily Bypass Vetting Process

Researchers have uncovered gaps in Amazon's skill vetting process for the Alexa voice assistant ecosystem that could allow a malicious actor to publish a deceptive skill under any arbitrary developer name and even make backend code changes after approval to trick users into giving up sensitive...

Prestashop 操作系统命令注入漏洞

PrestaShop is a full-featured, cross-platform, free and open source e-commerce solution designed for web 2.0. A CSV injection vulnerability exists in PrestaShop versions prior to 1.7.2. An attacker can exploit this vulnerability by using the store search keyword in the admin panel to conduct a CS...

CVE-2020-36003

The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases...

CVE-2020-36003

The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases...

Sql injection

The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases...

CVE-2020-36003

The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases...

CVE-2020-36003

The CVE-2020-36003 entry concerns Online Book Store v1.0 where the id parameter in detail.php is vulnerable to union-based blind SQL injection, allowing an attacker to retrieve databases. Root cause is lack of input validation/sanitization on the id parameter, leading to database information disc...

CVE-2020-36003

The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases...

PHPGurukul Online Book Store SQL注入漏洞

Online BookStore is an online bookstore program. There is a sql injection vulnerability in Online Book Store v1.0. The vulnerability is caused by the id parameter in detail.php not filtering special characters, and an attacker can execute arbitrary SQL statements through this vulnerability...

Microweber Path Traversal Vulnerability

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A path traversal vulnerability exists in Microweber that arises from a failure of a...

SUSE-SU-2021:0448-1 Security update for SUSE Manager Server 4.0

This update fixes the following issues: cpu-mitigations-formula: - Handle unsupported target systems gracefully bsc1179273 - add mitigations for Xen hypervisor nutch-core: - Fix XXE injection in DmozParser CVE-2021-23901 bsc1181356 smdba: - Do not remove the database if there is no backup and dea...

Important: kernel-livepatch-4.14.209-160.339

Issue Overview: A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to...

Important: kernel-livepatch-4.14.203-156.332

Issue Overview: A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to...

Important: kernel-livepatch-4.14.214-160.339

Issue Overview: A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to...

Important: kernel-livepatch-4.14.209-160.335

Issue Overview: A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to...

Leak of information via Store-API

Impact Leak of information via Store-API Patches We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 The vulnerability could only be fixed by...