Adobe Magento 代码问题漏洞

Adobe Magento is Adobe's one with PHP written in open source e-commerce platform.Magento Community Edition is the community edition, later renamed Magento Open Source, Magento Enterprise Edition is the enterprise edition, later renamed Magento Magento Enterprise Edition is the enterprise edition,...

Magento Web Skimmers Piggyback in Ongoing Costway Website Compromise

Two web skimmers have been discovered on the payment webpages of Costway, one of the top retailers in North America and Europe, which sells appliances, furniture and more. The skimmers are targeting consumers’ credit-card payment details. In a twist, researchers say one of these web skimmers is...

Credit card skimmer piggybacks on Magento 1 hacking spree

Back in the fall of 2020 threat actors started to massively exploit a vulnerability in the no-longer maintained Magento 1 software branch. As a result, thousands of e-commerce shops were compromised and many of them injected with credit card skimming code. While monitoring activities tied to this...

The vulnerability of the Magento Commerce software platform for developing and managing online stores, related to cross-site scripting, allows attackers to access confidential information.

The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to cross-site scripting. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

OpenMage Magento Lts Code Execution Vulnerability

OpenMage Magento Lts Magento is an e-commerce system organized by OpenMage. A security vulnerability in OpenMage Magento Lts before versions 19.4.10 and 20.0.5 can be exploited by an attacker to remotely execute code, which can be injected into the server by an administrator with the privilege to...

CVE-2020-26295

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 an...

Remote code execution

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an...

CVE-2020-26295

OpenMage (Magento CE fork) is affected in versions before 19.4.10 and 20.0.5. An administrator with permissions to import/export data and edit CMS pages could inject an executable file on the server via layout XML. The issue is fixed in 19.4.10 and 20.0.5; upgrade to these versions or later to re...

OpenMage Magento Lts 代码问题漏洞

OpenMage Magento Lts Magento is an e-commerce system organized by OpenMage. A security vulnerability in OpenMage Magento Lts before versions 19.4.10 and 20.0.5 can be exploited by an attacker to remotely execute code, which can be injected into the server by an administrator with the privilege to...

OpenMage Magento Lts 路径遍历漏洞

OpenMage Magento Lts is an e-commerce system organized by OpenMage. A security vulnerability exists in OpenMage Magento Lts before versions 19.4.10 and 20.0.5, which originates from the fact that an administrator with privileges to import and export data and edit cms pages can inject executable...

Remote code execution

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server...

CVE-2020-26252

CVE-2020-26252 affects OpenMage prior to versions 19.4.10 and 20.0.6, where an administrator with permission to update product data can store an executable file on the server and load it through layout XML, enabling remote code execution. The issue is fixed in OpenMage versions 19.4.10 and 20.0.6...

The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from improper code generation. This allows attackers to introduce arbitrary code.

The vulnerability of the Magento Commerce development and management software platform is related to improper code generation. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the generated PHP files and execute it using specially crafted requests...

CVE-2021-21013

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object vulnerability IDOR in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's accou...

CVE-2021-21012

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object vulnerability IDOR in the checkout module. Successful exploitation could lead to sensitive information disclosure...

CVE-2021-21013

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object vulnerability IDOR in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's accou...

CVE-2021-21012

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object vulnerability IDOR in the checkout module. Successful exploitation could lead to sensitive information disclosure...

Design/Logic Flaw

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object vulnerability IDOR in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's accou...

Information disclosure

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object vulnerability IDOR in the checkout module. Successful exploitation could lead to sensitive information disclosure...

CVE-2021-21013

Magento CVE-2021-21013 describes an insecure direct object reference (IDOR) in the customer API module impacting Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier. Successful exploitation could disclose sensitive information and allow updating information on another ...