4415 matches found
PT-2020-4511 · Adobe · Magento
Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.0 and 2.3.5p1 and earlier Description: The issue is related to incorrect authorization, allowing a user to access resources provisioned under their old role even after an administrator removes the role or disables the...
PT-2020-4582 · Adobe · Magento
Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.0 and 2.3.5p1 and earlier Description: The issue is related to incorrect permissions within the Integrations component, which could be exploited by users with permissions to the Pages resource to delete cms pages via the...
PT-2020-4583 · Adobe · Magento
Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.0 and 2.3.5p1 and earlier Description: The issue is related to an unsafe file upload vulnerability, which could result in arbitrary code execution. This could be exploited by authenticated users with administrative...
APSB20-59 Security updates available for Magento
Magento has released updates for Magento Commerce and Magento Open Source. These updates resolve vulnerabilities rated important and critical. Successful exploitation could lead to arbitrary code execution...
Credit card skimmer targets virtual conference platform
Weve seen many security incidents affecting different websites simultaneously because they were loading the same tampered piece of code. In many instances, this is due to what we call a supply-chain attack, where a threat actor targets one company that acts as an intermediary to others. In todays...
Offering Users More For Their Activity - Similar Items Upon Checkout
The shopping isn't finished once you've purchased your item. If you've ever done shopping online, then you know all about being presented with related items to the one you just purchased. This feature is common for online retail websites and quite useful for both the consumer and the producers. I...
CVE-2020-24404
Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization...
Magecart hackers launched largest ever attack against Magento stores
By Waqas Around 1,904 individual online stores were hacked due to the outdated Magento 1 platform. Here's what happened. This is a post from HackRead.com Read the original post: Magecart hackers launched largest ever attack against Magento stores...
Magecart Attack Impacts More Than 10K Online Shoppers
One of the largest known Magecart campaigns to date took place over the weekend, with nearly 2,000 e-commerce sites hacked in an automated campaign that may be linked to a zero-day exploit. The attacks have impacted tens of thousands of customers, who had their credit-card and other information...
Authentication Bypass
dweeves/magmi is susceptible to authentication bypass. It is possible because it uses a default login magmi:magmi basic authentication when a database connection failure is introduced by a malicious user by sending 151 simultaneous requests to the Magento website, leading to a "Too many...
Adobe Magento Authentication Bypass Vulnerability
Adobe Magento is the United States of America Odobie Adobe company's set of open source PHP e-commerce system . The system provides rights management , search engines and payment gateways and other functions . A remote authentication bypass vulnerability exists in versions prior to Adobe...
CVE-2020-5777
MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting maxconnections default 151 is lower than Apache or...
Atos Magento Command Injection (CVE-2020-13404)
A command injection vulnerability exists in Atos Magento. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Magento Mass Importer Unauthenticated Access
Magento Mass Importer Magmi is a Magento database client used to perform raw bulk operations on the models of the online store. The purpose of this software is to help Magento websites administrators to manage their catalog through a dedicated web interface. By directly accessing the Magmi URL wi...
Magento Mass Importer < 0.7.24 Remote Authentication Bypass
Magento Mass Importer Magmi is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer versions before 0.7.24 suffer from a remote authentication bypass vulnerability by exhausting the database connections pool and then allowing an...
Magento Mass Importer Cross-Site Request Forgery
Magento Mass Importer Magmi is a Magento database client used to perform raw bulk operations on the models of the online store. Magento Mass Importer suffers from a cross-site request forgery vulnerability, which could be used by an attacker to target a privileged user and perform malicious actio...
magento.catalog.cepshop.hu Cross Site Scripting vulnerability OBB-1276073
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-13404
The ATOS/Sips aka Atos-Magento community module 3.0.0 to 3.0.5 for Magento allows command injection...
