Filtered by vendor Oroinc
Subscribe
Search
Total
6 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-32064 | 1 Oroinc | 1 Orocommerce | 2023-12-01 | N/A | 4.3 MEDIUM |
| OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and 5.1.1. | |||||
| CVE-2023-32065 | 1 Oroinc | 1 Orocommerce | 2023-12-01 | N/A | 5.8 MEDIUM |
| OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1. | |||||
| CVE-2023-32063 | 1 Oroinc | 1 Client Relationship Management | 2023-12-01 | N/A | 5.0 MEDIUM |
| OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1. | |||||
| CVE-2023-32062 | 1 Oroinc | 1 Oroplatform | 2023-12-01 | N/A | 4.3 MEDIUM |
| OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1. | |||||
| CVE-2021-41236 | 1 Oroinc | 1 Oroplatform | 2022-01-08 | 3.5 LOW | 4.8 MEDIUM |
| OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible. | |||||
| CVE-2021-39198 | 1 Oroinc | 1 Client Relationship Management | 2021-11-23 | 5.8 MEDIUM | 5.4 MEDIUM |
| OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package. | |||||