Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the index.js file. PoC: var a =require"wc-cmd"; a"touch JHU" Note: CVE-2020-28431 has been retracted because it was found to be invalid. Remediation There is no fixed...

PT-2020-22147

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow read error. Technical details about the crash include the fp read unsigned bin and mp read unsigned bin...

PT-2020-22098

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow write crash. The crash involves the RsaPad PSS, wc RsaPad ex, and RsaPublicEncryptEx functions. No informati...

WordPress WC Marketplace plugin <= 3.5.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Jerome Bruandet NinTechNet in WordPress WC Marketplace plugin versions = 3.5.7. Solution Update the WordPress WC Marketplace plugin to the latest available version at least 3.5.8...

@ionic/angular (>=4.3.0-dev.201904161617.4474974, <=4.3.0), dos-wc-library (>=0.7.7, <=0.7.21) potentially affected by unknown CVE via @ionic/core (4.3.0-dev.201904171418.07e739a)

@ionic/core NPM version 4.3.0-dev.201904171418.07e739a is affected by a known vulnerability. The following packages have a transitive dependency on @ionic/core and may be impacted: - @ionic/angular =4.3.0-dev.201904161617.4474974, =0.7.7, =0.7.21 Source cves: unknown CVE Source advisory:...

CVE-2019-20891

WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery CSRF issue with resultant stored cross-site scripting XSS via includes/admin/importers/class-wc-product-csv-importer-controller.php...

CVE-2019-20891: Cross-Site Request Forgery (CSRF)

WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery CSRF issue with resultant stored cross-site scripting XSS via includes/admin/importers/class-wc-product-csv-importer-controller.php...

PT-2020-10856

Name of the Vulnerable Software and Affected Versions WooCommerce versions prior to 3.6.5 Description The issue arises when WooCommerce handles CSV imports of products, leading to a cross-site request forgery CSRF problem that results in stored cross-site scripting XSS. This occurs via the...

PT-2020-12799

Name of the Vulnerable Software and Affected Versions wolfSSL version 4.3.0 Description The issue is related to the mulmod code in the wc ecc mulmod ex function in ecc.c, which does not properly resist timing side-channel attacks. This could potentially allow an attacker to exploit the timing...

CVE-2018-11106

NETGEAR has released fixes for a pre-authentication command injection in requesthandler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to...

PT-2019-16022

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 4.3.0 Description The issue is related to the wc ecc mulmod ex function, which does not properly resist side-channel attacks. Recommendations For versions prior to 4.3.0, update to version 4.3.0 or later to resolve th...

PT-2019-16023

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 4.3.0 Description The issue is related to the mishandling of calls to the wc SignatureGenerateHash function, which can lead to fault injection in RSA cryptography. Recommendations For versions prior to 4.3.0, update t...

CVE-2019-12241

The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...

PT-2019-12712

Name of the Vulnerable Software and Affected Versions The Carts Guru plugin version 1.4.5 Description The issue allows for Insecure Deserialization via a cartsguru-source cookie to the classes/wc-cartsguru-event-handler.php file. Recommendations For The Carts Guru plugin version 1.4.5, consider...

CVE-2019-12241: Deserialization of Untrusted Data

The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php...

CVE-2017-18356: Improper Control of Generation of Code

In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection...

wc-advisor.com XSS vulnerability

Open Bug Bounty ID: OBB-389074 Description| Value ---|--- Affected Website:| wc-advisor.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

Cross-site Scripting (XSS)

woocommerce is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through the range parameter in the wc-reports page...

Cross-Site Scripting (XSS)

woocommerce is vulnerable to cross-site scripting XSS attacks. The attacks can be launched because wp-admin/admin.php does not sanitize the QUERYSTRING in the wc-reports page...

BSA-2017-332

Security Advisory ID : BSA-2017-332 Component : IBM JDK Revision : 3.0: Final IBM JDK versions 6.0.16.45, 7.0.10.5, 7.1.4.5, and 8.0.4.5 correct a security issue. IBMSDK, Java Technology Edition is vulnerable XML External Entity Injection XXE error when processing XML data. A remote attacker coul...