Ooroinc

Products

Exploited and recent CVEs

• CVE-2023-48296 Medium 4.3 OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID 0.4%
• CVE-2023-45824 Medium 4.3 OroPlatform's pinned entity creation form shows pages of other users 0.4%
• CVE-2023-32065 Medium 5.8 OroCommerce get-totals-for-checkout API endpoint returns unwanted data 0.5%
• CVE-2023-32064 Medium 5.0 OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility 0.5%
• CVE-2023-32063 Medium 5.0 OroCRMCallBundle has incorrect call view page visibility 0.5%
• CVE-2023-32062 Medium 5.0 OroCalendarBundle has incorrect system calendar events visibility 0.5%
• CVE-2022-41951 High 8.6 OroPlatform vulnerable to path traversal during temporary file manipulations 0.9%
• CVE-2022-35950 Medium 6.9 OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item 0.4%
• CVE-2022-31037 Medium 6.9 OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page 0.5%
• CVE-2021-43852 High 8.8 JavaScript Prototype Pollution in oro/platform 1.1%
• CVE-2021-41236 Medium 6.9 XSS vulnerability in oro/platform 0.7%
• CVE-2021-39198 Medium 4.2 The disqualify lead action may be executed without CSRF token check 0.3%