xt:Commerce version 5.4.1, 6.2.1, and 6.2.2 suffer from an improper access control vulnerability. A logged-in customer can create and alter addresses. These addresses are referenced by incrementing IDs. On saving an address, an attacker could change the ID of the address to write the data to. If the ID belongs to an address which does not belong to the current logged-in user, every field in the address is set to null. An attacker could use this to null all addresses in a shop.
f54fc2ef6644a4e641224c9d4bbfedbcbc95e27c9202e6200a1ccd2764b4b697Infosysta Jira version 1.6.13_J8 suffers from a user name disclosure vulnerability.
506fa47855ab00052d2c3b374f021b09caf1e85be4e4a010161eed8775c5f5b8Infosysta Jira version 1.6.13_J8 suffers from an authentication bypass vulnerability that allows you to see project lists.
5759cf071d560c4da28fae8baa88ebacb2d306e5d1cfc0ae9d1a454907d296b8Infosysta Jira version 1.6.13_J8 suffers from an authentication bypass vulnerability that allows you to see push notifications for a given user.
01fd0ed65d6bb484afc3a2b833eae1e73bda43947aa08a133d177919fadef778
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed