PT-2015-6239

Name of the Vulnerable Software and Affected Versions Magento Community Edition CE version 1.9.1.0 Magento Enterprise Edition EE version 1.14.1.0 Description The issue is related to the fetchView function in the Mage Core Block Template Zend class, which does not restrict the stream wrapper used ...

PT-2015-5264

Name of the Vulnerable Software and Affected Versions Magento Community Edition CE version 1.9.1.0 Magento Enterprise Edition EE version 1.14.1.0 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved via the popularityfield expr parameter when eith...

PT-2015-5266

Name of the Vulnerable Software and Affected Versions Magento Community Edition CE version 1.9.1.0 Magento Enterprise Edition EE version 1.14.1.0 Description A remote file inclusion issue exists in the fetchView function within the Mage Core Block Template Zend class, allowing remote administrato...

allegrodos.txt

The description made it easy to create this one. Needed this to confirm if some 2.10-branded products were in fact patched and warranted replacing. Considering there was four years of warning and there are still tons of boxes with this problem, please, people, get your systems pen-tested...