CVE-2020-24404

Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization...

Magecart hackers launched largest ever attack against Magento stores

By Waqas Around 1,904 individual online stores were hacked due to the outdated Magento 1 platform. Here's what happened. This is a post from HackRead.com Read the original post: Magecart hackers launched largest ever attack against Magento stores...

Magecart Attack Impacts More Than 10K Online Shoppers

One of the largest known Magecart campaigns to date took place over the weekend, with nearly 2,000 e-commerce sites hacked in an automated campaign that may be linked to a zero-day exploit. The attacks have impacted tens of thousands of customers, who had their credit-card and other information...

Authentication Bypass

dweeves/magmi is susceptible to authentication bypass. It is possible because it uses a default login magmi:magmi basic authentication when a database connection failure is introduced by a malicious user by sending 151 simultaneous requests to the Magento website, leading to a "Too many...

Adobe Magento Authentication Bypass Vulnerability

Adobe Magento is the United States of America Odobie Adobe company's set of open source PHP e-commerce system . The system provides rights management , search engines and payment gateways and other functions . A remote authentication bypass vulnerability exists in versions prior to Adobe...

CVE-2020-5777

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting maxconnections default 151 is lower than Apache or...

Atos Magento Command Injection (CVE-2020-13404)

A command injection vulnerability exists in Atos Magento. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Magento Mass Importer Unauthenticated Access

Magento Mass Importer Magmi is a Magento database client used to perform raw bulk operations on the models of the online store. The purpose of this software is to help Magento websites administrators to manage their catalog through a dedicated web interface. By directly accessing the Magmi URL wi...

Magento Mass Importer < 0.7.24 Remote Authentication Bypass

Magento Mass Importer Magmi is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer versions before 0.7.24 suffer from a remote authentication bypass vulnerability by exhausting the database connections pool and then allowing an...

Magento Mass Importer Cross-Site Request Forgery

Magento Mass Importer Magmi is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer suffers from a cross-site request forgery vulnerability, which could be used by an attacker to target a privileged user and perform malicious actio...

magento.catalog.cepshop.hu Cross Site Scripting vulnerability OBB-1276073

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-13404

The ATOS/Sips aka Atos-Magento community module 3.0.0 to 3.0.5 for Magento allows command injection...

CVE-2020-13404

The ATOS/Sips aka Atos-Magento community module 3.0.0 to 3.0.5 for Magento allows command injection...

Command injection

The ATOS/Sips aka Atos-Magento community module 3.0.0 to 3.0.5 for Magento allows command injection...

CVE-2020-13404

The CVE-2020-13404 vulnerability affects the ATOS/Sips (Atos-Magento) community module for Magento, version 3.0.0 through 3.0.5. The issue is a command injection vulnerability in the module that could enable remote code execution on the affected Magento site. The reported CVSS metrics indicate a ...

CVE-2020-13404

The ATOS/Sips aka Atos-Magento community module 3.0.0 to 3.0.5 for Magento allows command injection...

Magento <= 2.3.5-p1 Multiple Vulnerabilities (APSB20-47)

Magento is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cross-site Scripting (XSS)

magento is vulnerable to cross-site scripting XSS. The vulnerability exists as it does not sanitize the values of importedfile, 'Download', and $row-getData'errorfile', allowing an attacker to inject and execute arbitrary Javascript in a user's browser...

Critical Magento Flaws Allow Code Execution

Critical flaws in Adobe’s Magento e-commerce platform – which is commonly targeted by attackers like the Magecart cybergang – could enable arbitrary code execution on affected systems. Magento is a popular, Adobe-owned open-source e-commerce platform that powers many online shops. Adobe on Tuesda...

CVE-2020-9690

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...