https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 20:40:14 +0000 https://cve.radiocsirt.org/vuln/cve-2024-29888 <p><strong>Affected:</strong> saleor</p> <p>Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.</p> <p><strong>Affected:</strong> saleor</p> <p>Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.</p> https://cve.radiocsirt.org/vuln/cve-2024-29888 https://cve.radiocsirt.org/vuln/ghsa-mrj3-f2h4-7w45 <p><strong>Affected:</strong> PyPI: saleor</p> <p>### Summary Using `Pickup: Local stock only` as a click-and-collect points could cause a leak of customer addresses</p> <p>### Details When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address.</p> <p>### Impact The vulnerability can cause the leak of customer&#39;s address when using click-and-collect delivery option marked as `Local stock only`. It has impact on all orders with click-and-collect delivery method marked as `Pickup:Local stock only` The affected versions: `&gt;=3.14.56 &lt;3.14.61`, `&gt;=3.15.31 &lt;3.15.37`, `&gt;=3.16.27 &lt;3.16.34`, `&gt;=3.17.25 &lt;3.17.32`, `&gt;=3.18.19 &lt;3.18.28`, `&gt;=3.19.5 &lt;3.19.15` This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`</p> <p>### Workaround We strongly recommend upgrading to the latest versions, in case of inability to upgrade straight away, possible workarounds are: - turn off click-and-collect delivery method on warehouse view when `Pickup` option is set to `Local stock only`. - cherry-pick the changes from PRs: https://github.com/saleor/saleor/pull/15694 &amp; https://github.com/saleor/saleor/pull/15697</p> <p>### References - Commits introducing the issue (https://github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761 main, https://github.com/saleor/saleor/commit/997f7ea4f576543ec88679a86bfe1b14f7f2ff26 3.14, https://github.com/saleor/saleor…</p> <p><strong>Affected:</strong> PyPI: saleor</p> <p>### Summary Using `Pickup: Local stock only` as a click-and-collect points could cause a leak of customer addresses</p> <p>### Details When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address.</p> <p>### Impact The vulnerability can cause the leak of customer&#39;s address when using click-and-collect delivery option marked as `Local stock only`. It has impact on all orders with click-and-collect delivery method marked as `Pickup:Local stock only` The affected versions: `&gt;=3.14.56 &lt;3.14.61`, `&gt;=3.15.31 &lt;3.15.37`, `&gt;=3.16.27 &lt;3.16.34`, `&gt;=3.17.25 &lt;3.17.32`, `&gt;=3.18.19 &lt;3.18.28`, `&gt;=3.19.5 &lt;3.19.15` This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`</p> <p>### Workaround We strongly recommend upgrading to the latest versions, in case of inability to upgrade straight away, possible workarounds are: - turn off click-and-collect delivery method on warehouse view when `Pickup` option is set to `Local stock only`. - cherry-pick the changes from PRs: https://github.com/saleor/saleor/pull/15694 &amp; https://github.com/saleor/saleor/pull/15697</p> <p>### References - Commits introducing the issue (https://github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761 main, https://github.com/saleor/saleor/commit/997f7ea4f576543ec88679a86bfe1b14f7f2ff26 3.14, https://github.com/saleor/saleor…</p> https://cve.radiocsirt.org/vuln/ghsa-mrj3-f2h4-7w45