4928 matches found
PT-2019-18945
Name of the Vulnerable Software and Affected Versions Magento versions prior to 1.9.4.3 Magento Commerce versions prior to 1.14.4.3 Description The issue allows an authenticated user with administrative privileges for editing attribute sets to execute arbitrary code through custom layout...
CVE-2019-8090: Undefined Security Weakness
An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature...
CVE-2019-8137: Undefined Security Weakness
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate CMS section of the website can trigger remote code execution via custom layout update...
CVE-2019-8126: Improper Restriction of XML External Entity Reference
An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external...
PT-2019-18913
Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1 Description A remote code execution issue exists, allowing an authenticated user with privileges to manipulate the CMS section of the website to trigger remot...
CVE-2019-8091: Undefined Security Weakness
A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3. An authenticated admin user with privileges to access product attributes can leverage layout updates to trigger remote code execution...
PT-2019-18879
Name of the Vulnerable Software and Affected Versions Magento 1 versions prior to 1.9.4.3 Magento 1 versions prior to 1.14.4.3 Description A remote code execution issue exists, allowing an authenticated admin user with access to product attributes to trigger remote code execution through layout...
PT-2019-18926
Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1, excluding 2.3.2-p1 Description A remote code execution issue exists, allowing an authenticated user with privileges to manipulate layouts and images to inser...
CVE-2019-8150: Undefined Security Weakness
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate layouts and images can insert a malicious payload into the page layout...
CVE-2019-8231: Undefined Security Weakness
In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification...
PT-2019-19193
Name of the Vulnerable Software and Affected Versions Apple macOS versions prior to 10.15 Description A logic issue was addressed with improved restrictions, which may allow a malicious application to determine kernel memory layout. Recommendations For versions prior to 10.15, update to macOS...
Apple macOS Catalina IOGraphics Component Logic Vulnerability
Apple macOS Catalina is a proprietary operating system developed by Apple Inc. for Mac computers.IOGraphics is one of the input and output graphics components. A security vulnerability exists in the IOGraphics component in Apple macOS Catalina versions prior to 10.15. An attacker can exploit this...
macOS < 10.15 Multiple Vulnerabilities
The remote host is running a version of macOS / Mac OS X that is prior to 10.15. It is, therefore, affected by multiple vulnerabilities. - An application may be able to execute arbitrary code with kernel privileges CVE-2019-8748 - Multiple issues in PHP CVE-2019-11041, CVE-2019-11042 - Processing...
IoT: a malware story
Since 2008, cyber-criminals have been creating malware to attack IoT-devices, such as routers and other types of network equipment. You will find a lot of statistics on this on Securelist, most notably, here and here. The main problem with these IoT/embedded devices is that one simply cannot...
PRODSECBUG-2446: Remote code execution via custom layout update in create product functionality
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2414: Remote code execution through custom layout update of the content management functionality
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
CVE-2017-5447
An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...
Real-life social engineering. Two days in tweets
This is the write-up of my live tweets while on a recent social engineering engagement. It’s all available on my feed @ghostie I did this because I wanted to share what it's like to prep for, and work through a job, warts and all. If you can take anything away, to enhance your technique, or defen...
