4415 matches found
GHSA-FVRF-9428-527M Backport for CVE-2021-21024 Blind SQLi from Magento 2
Impact This vulnerability allows an administrator unauthorized access to restricted resources. We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html. Patches Has the...
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Impact This vulnerability allows an administrator unauthorized access to restricted resources. We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html. Patches Has the...
Remote Code Execution (RCE)
openmage/magento-lts is vulnerable to remote code execution. An attacker is able to upload malicious code via the callbackOptions array due to the lack of validation of the uploaded classes are of Zend3 feature objects...
Privilege Escalation
openmage/magento-lts is vulnerable to privilege escalation. An attacker is able to access the admin console through a vulnerability due to an blind SQL injection vulnerability in the Search module...
Magento-lts SQL Injection Vulnerability
Magento lts is a long term support alternative to Magento Community Edition CE. A SQL injection vulnerability exists in Magento-lts. The vulnerability stems from insufficient handling of user-supplied data in the "lib/Varien/Db/Adapter/Pdo/Mysql.php" script when processing field names. An attacke...
Magento lts code issue vulnerability
Magento lts is a long term support alternative to Magento Community Edition CE. A code issue vulnerability exists in Magento lts. The vulnerability exists due to insufficient validation of the stream name in "lib Zend Http Response stream .php". A remote attacker could use this vulnerability to...
CVE-2021-21427
Magento-lts is a long-term support alternative to Magento Community Edition CE. A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in...
CVE-2021-21427
Magento-lts is a long-term support alternative to Magento Community Edition CE. A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in...
CVE-2021-21426
Magento-lts is a long-term support alternative to Magento Community Edition CE. In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework...
CVE-2021-21426
Magento-lts is a long-term support alternative to Magento Community Edition CE. In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework...
CVE-2021-21427
Magento-lts is a long-term support alternative to Magento Community Edition CE. A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in...
Design/Logic Flaw
Magento-lts is a long-term support alternative to Magento Community Edition CE. A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in...
Deserialization of untrusted data
Magento-lts is a long-term support alternative to Magento Community Edition CE. In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework...
CVE-2021-21427
CVE-2021-21427 applies to Magento-lts, a long-term support variant of Magento CE. The vulnerability is a backport of CVE-2021-21024 and affects magento-lts versions before 19.4.13 and 20.0.9, where an administrator could gain unauthorized access to restricted resources. The issue is mitigated by ...
CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2
Magento-lts is a long-term support alternative to Magento Community Edition CE. A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in...
CVE-2021-21426
CVE-2021-21426 relates to Magento-lts (versions <= 19.4.12 and
CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper
Magento-lts is a long-term support alternative to Magento Community Edition CE. In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework...
Daniel Fahlke magento-lts 代码问题漏洞
Magento lts is a long term support alternative to Magento Community Edition CE. A code issue vulnerability exists in Magento lts. The vulnerability exists due to insufficient validation of the stream name in "lib Zend Http Response stream .php". A remote attacker could use this vulnerability to...
Daniel Fahlke magento-lts SQL注入漏洞
Magento lts is a long term support alternative to Magento Community Edition CE. A SQL injection vulnerability exists in Magento-lts. The vulnerability stems from insufficient handling of user-supplied data in the "lib/Varien/Db/Adapter/Pdo/Mysql.php" script when processing field names. An attacke...
