CVE-2019-8288

The CVE-2019-8288 entry refers to a Stored Cross-Site Scripting vulnerability in Online Store v1.0, exploitable via the unsanitized adidas_member_user variable in user_view.php. Affected: Online Store v1.0 (component: user_view.php, variable: adidas_member_user). Root cause: lack of input sanitiz...

CVE-2019-8289

CVE-2019-8289 affects Online Store v1.0 with a stored XSS in admin/user_view.php via the adidas_member_email parameter. Root cause: lack of proper input handling in that parameter leading to script injection when the page is rendered. Impact per sources: low confidentiality/integrity impact, no a...

CVE-2019-8289

Vulnerability in Online Store v1.0, stored XSS in admin/userview.php adidasmemberemail variable...

CVE-2019-8290

Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to sentregister.php allowing special characters to be included and an XSS payload to be injected...

CVE-2019-8288

Vulnerability in Online Store v1.0, Stored XSS in userview.php where adidasmemberuser variable is not sanitized...

CVE-2019-8291

The CVE-2019-8291 entry concerns Online Store System v1.0, specifically delete_file.php, which does not verify administrative rights and lacks path traversal protection. Publicly available connected records describe a path traversal vulnerability enabling access to locations outside restricted di...

Fortinet FortiSIEM 5.0 / 5.2.1 Improper Certification Validation

Product Name: FortiSIEM Tested versions: 5.0, 5.2.1 Fixed in version: Only a manual workaround is available from Fortinet as of this writing Weakness Type: CWE-295 - Improper Certificate Validation Discovered by: Andrew Klaus Cybera Canada CVE: Pending == Disclosure Timeline: June 25, 2019: Initi...

PT-2019-18969 · Unknown · Online Store System

Name of the Vulnerable Software and Affected Versions: Online Store System version 1.0 Description: The issue concerns the delete product.php file in the Online Store System, which fails to verify if a user is authenticated or has administrative rights. This oversight allows for arbitrary product...

Top Play Store Weather app steals user data & sends to Chinese server

By Sudais The weather app called Weather Forecast: World Weather Accurate Radar on two of Alcatel's Android smartphone models, namely the Pixi 4 and A3 Max. This is a post from HackRead.com Read the original post: Top Play Store Weather app steals user data & sends to Chinese server...

Malicious Ad Blockers for Chrome Caught in Ad Fraud Scheme

Google has removed two malicious ad blockers from its Chrome Web Store after a researcher discovered they were carrying out ad fraud and deceived Chrome users by using names of legitimate and popular blockers. Researcher Andrey Meshkov from rival ad blocker maker AdGuard discovered that the...

SUSE SLED15 / SLES15 Security Update : kernel-source-rt (SUSE-SU-2019:2430-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (SACK Panic) (SACK Slowness) (Spectre)

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-12126 CVE-2018-12127 CVE-2018-12130: Microarchitectural Store Buffer Data Sampling MSBDS: Stored buffers on some microprocessors utilizing speculative...

How to Protect Your Online Store from Cyber Threats

By Owais Sultan While owning an online store can certainly lead to success, it also opens the door to cyber threats, something that is far too common today. This is a post from HackRead.com Read the original post: How to Protect Your Online Store from Cyber Threats...

WordPress music-store plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. music-store is an online music store plugin used in it. A cross-site scripting vulnerability exists in WordPress music-store plugin...

CVE-2016-10992

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...

CVE-2016-10992

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...

Design/Logic Flaw

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...

CVE-2016-10992

The issue tracked as CVE-2016-10992 affects the WordPress Music Store plugin prior to version 1.0.43. The vulnerability is an Cross-Site Scripting (XSS) flaw exposed through the admin page parameter wp-admin/admin.php?page=music-store-menu-reports_from_year, as documented across multiple sources ...

CVE-2016-10992

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...

The vulnerability of the Windows Store Installer component of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Windows Store Installer component of the Windows operating system is related to errors in handling symbolic links. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

The Joker is haunting Google Play Store with malware

By Sudais Another day, another Android malware - This time; The Joker malware is here not to creep you out but to steal from you. This is a post from HackRead.com Read the original post: The Joker is haunting Google Play Store with malware...