4306 matches found
CVE-2021-33353
Directory Traversal vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via the file attachment directory setting...
Wyomind Magento 跨站脚本漏洞
Wyomind Magento is a ticketing system from Wyomind. A security vulnerability exists in Wyomind Help Desk Magento 2 extension version v.1.3.6 and prior versions. An attacker can exploit the vulnerability to elevate privileges via a specially crafted payload in the ticket message field...
CVE-2021-33351
Cross Site Scripting Vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before and fixed in v.1.3.7 allows attackers to escalte privileges via a crafted payload in the ticket message field...
Wyomind Magento 代码问题漏洞
Wyomind Magento is a ticketing system from Wyomind. A security vulnerability exists in Wyomind Help Desk Magento 2 extension version v.1.3.6 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code by uploading a phar file via the ticket message field...
PT-2023-12206 · Wyomind · Wyomind Help Desk Magento 2 Extension
Name of the Vulnerable Software and Affected Versions: Wyomind Help Desk Magento 2 extension versions 1.3.6 and earlier Description: The issue allows an attacker to execute arbitrary code via a phar file upload in the ticket message field. This is achieved by exploiting a weakness in the...
CVE-2021-33351
CVE-2021-33351 affects the Wyomind Help Desk Magento 2 extension up to version 1.3.6 (prior to 1.3.7). The vulnerability is a Cross Site Scripting (XSS) issue in the ticket message field that attackers can exploit to escalate privileges. Root cause described in the connected sources points to cra...
Wyomind Magento 路径遍历漏洞
Wyomind Magento is a ticketing system from Wyomind. A security vulnerability exists in Wyomind Help Desk Magento 2 extension version v.1.3.6 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code via file attachment directory settings...
PT-2023-12205 · Wyomind · Wyomind Help Desk Magento 2 Extension
Name of the Vulnerable Software and Affected Versions: Wyomind Help Desk Magento 2 extension versions 1.3.6 and before Description: The issue allows attackers to escalate privileges via a crafted payload in the ticket message field. This is a Cross Site Scripting vulnerability. Recommendations: F...
CVE-2021-33352
An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via a phar file upload in the ticket message field...
CVE-2021-33353
CVE-2021-33353 affects Wyomind Help Desk for Magento 2 (extension version 1.3.6 and earlier). The root cause is a directory traversal vulnerability in the file attachment directory setting, allowing an attacker to execute arbitrary code. The issue is fixed in version 1.3.7. Exploitation details a...
CVE-2021-33353
Directory Traversal vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via the file attachment directory setting...
Remote Code Execution (RCE)
openmage/magento-lts is vulnerable to Remote Code Execution RCE. The vulnerability exists due to insufficient input validation which allows an administrator with upload file permission to create products which results in arbitrary code execution via the convert profile...
Remote Code Execution
openmage/magento-lts is vulnerable to Remote Code Execution. The vulnerability exists in the deleteDirectory function in Storage.php which allows an attacker to delete arbitrary files and execute arbitrary code into the server...
Remote Code Execution (RCE)
openmage/magento-lts is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the lack of validation in the $this, $callback, and $alias parameters in the getChildGroup function of Abstract.php, allowing an attacker to bypass the block blacklist and inject and execute malicious...
Denial Of Service (DoS)
openmage/magento-lts is vulnerable to Denial Of Service DoS. The vulnerability exists in the filter function of MaliciousCode.php, allowing an attacker to cause an application crash through an infinite loop by providing malicious input...
CVE-2021-41143
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue...
CVE-2021-41143
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue...
CVE-2021-41143 OpenMage LTS arbitrary file deletion in customer media allows for remote code execution
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue...
Fix for arbitrary file deletion in customer media allows for remote code execution
Impact Magento admin users with access to the customer media could execute code on the server...