CWE-840

A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the function postProcess of the file modules/coingate/controllers/front/callback.php of the component Payme…

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which le…

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shad…

A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a singl…

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of differ…

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library S…

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the…

yetiforcecrm is vulnerable to Business Logic Errors

yetiforcecrm is vulnerable to Business Logic Errors

Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.

calibre-web is vulnerable to Business Logic Errors

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.

Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.

Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.

Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.

Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.

Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.

Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if …

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accident…

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.

Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.

Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage t…

Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.

Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.

Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.

The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions.  Successful exploitation of…

Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.

Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.

Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.

An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, …

A vulnerability classified as problematic was found in SourceCodester Online Mobile Management Store 1.0. Affected by this vulnerability is an unknown functionality of the component Product Price Handler. The manipulation of the argument q…

A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0 and classified as problematic. This issue affects some unknown processing of the file /shop.php. The manipulation of the argument product_price leads to business logic e…

Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.

Access control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability.

LaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service integrity.