GHSA-6WM4-3RJJ-C8XX Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities

SUPEE-10975, Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 contain multiple security enhancements that help close remote code execution RCE, cross-site scripting XSS, cross-site request forgery CSRF and other vulnerabilities...

PT-2024-40249 · Jquery Foundation +1 · Jquery +2

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions 1.9.0.0 through 1.14.4.0 Magento Open Source versions 1.5.0.0 through 1.9.4.0 Description: The issue concerns multiple vulnerabilities in Magento, including remote code execution RCE, cross-site scripting XSS, and...

PT-2024-40098 · Adobe · Magento Open Source +1

Name of the Vulnerable Software and Affected Versions: Magento Commerce and Open Source versions prior to 2.2.5 Magento Commerce and Open Source versions prior to 2.1.14 Description: The issue concerns remote code execution RCE, Cross-Site Scripting XSS, and other security problems...

PT-2024-40137 · Adobe · Magento Open Source +1

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions prior to 1.14.4.0 Magento Open Source versions prior to 1.9.4.0 Description: The issue concerns remote code execution RCE, cross-site scripting XSS, and cross-site request forgery CSRF among other vulnerabilities...

PT-2024-40414 · Adobe · Magento Open Source +1

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions 1.9.0.0 through 1.14.3.9 Magento Open Source versions 1.5.0.0 through 1.9.3.9 Description: The issue concerns various security vulnerabilities, including authenticated Admin user remote code execution RCE, cross-site...

PT-2024-40195

Name of the Vulnerable Software and Affected Versions: Magento Commerce and Open Source versions prior to 2.3.0 Magento Commerce and Open Source versions prior to 2.2.7 Magento Commerce and Open Source versions prior to 2.1.16 Description: The issue concerns Remote Code Execution RCE and Cross-Si...

CVE-2022-28132

The T-Soft E-Commerce 4 web application is susceptible to SQL injection SQLi attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication...

CVE-2022-28132

The T-Soft E-Commerce 4 web application is susceptible to SQL injection SQLi attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication...

CVE-2022-28132

The T-Soft E-Commerce 4 web application is susceptible to SQL injection SQLi attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication...

CVE-2022-28132

The T-Soft E-Commerce 4 web application is susceptible to an SQL injection (SQLi) vulnerability when an attacker is authenticated as an admin or privileged user . By sending crafted requests, an attacker can access and manipulate the underlying database, potentially bypassing authentication mecha...

CVE-2024-34717

PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available...

CVE-2024-34717 Anonymous PrestaShop customer can download other customers' invoices

PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available...

CVE-2024-34716

PrestaShop CVE-2024-34716 is a XSS flaw affecting 8.1.0–8.1.5 when the customer-thread feature flag is enabled. An attacker can upload a malicious file via the front-office contact form and trigger script execution when an admin opens the attachment in back office, potentially leaking session dat...

CVE-2024-34716 PrestaShop vulnerable to XSS via customer contact form in FO, through file upload

PrestaShop is an open source e-commerce web application. A cross-site scripting XSS vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled throu...

CVE-2024-23576

Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

CVE-2024-23576

Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

CVE-2022-28132: Improper Neutralization of Special Elements used in an SQL Command

The T-Soft E-Commerce 4 web application is susceptible to SQL injection SQLi attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication...

HCL Technologies HCL Commerce security vulnerabilities

HCL Technologies HCL Commerce is a software platform framework for e-commerce from HCL Technologies, USA. The software includes marketing, sales, customer and order processing functionality in a customizable and integrated package. It is a unified platform that provides the ability to conduct...

T-Soft E-Commerce security vulnerabilities

T-Soft E-Commerce is an e-commerce software from T-Soft. A security vulnerability exists in T-Soft E-Commerce 4. An attacker exploited the vulnerability to access and manipulate the database via specially crafted requests...

CVE-2024-23576: Improper Authorization

Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...