CVE-2019-7855

A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used in gift card generation...

CVE-2019-7854

An insecure direct object reference IDOR vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details...

CVE-2019-7854

CVE-2019-7854 is an insecure direct object reference (IDOR) vulnerability in Magento. Affected: Magento 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. Root cause: misdirected access to sensitive data (unauthorized disclosure of company credit history details) via IDOR. Impact: potenti...

CVE-2019-7852

A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Requests for a specific file path could result in a redirect to the URL of the Magento admin panel, disclosing its location to potentially unauthorized parties...

CVE-2019-7852

CVE-2019-7852 affects Magento 2.x prior to specific hotfix versions: 2.1 < 2.1.18, 2.2 < 2.2.9, and 2.3

CVE-2019-7851

CVE-2019-7851 is a cross-site request forgery vulnerability in Magento 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2 that can lead to unintended data deletion from customer pages. Root cause: CSRF in the affected Magento components. Remediation: apply the security updates—2.1.18, 2.2....

CVE-2019-7851

A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unintended data deletion from customer pages...

CVE-2019-7849

This CVE (CVE-2019-7849) relates to a defense-in-depth check added to mitigate inadequate session validation handling by 3rd party checkout modules in Magento. Affected ranges include Magento 1.x prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior ...

CVE-2019-7849

A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2...

Magento cross-site scripting vulnerability (CNVD-2019-26229)

Magento is an open source e-commerce platform written in PHP. A reflective cross-site scripting vulnerability exists in Magento's customer shopping cart checkout page. An attacker can exploit this vulnerability to execute malicious javascript in the victim's browser by sending a specially crafted...

34.237.203.180 Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-925450 Security Researcher Dewil Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting 34.237.203.180 website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO...

Magento Connect Manager Detected

Magento Connect Manager has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No source...

Magento Administration Panel Login Form Detected

Magento Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...

No man’s land: How a Magecart group is running a web skimming operation from a war zone

Our Threat Intelligence team has been monitoring the activities of a number of threat actors involved in the theft of credit card data. Often referred to under the Magecart moniker, these groups use simple pieces of JavaScript code skimmers typically injected into compromised e-commerce websites ...

Magento 2.1.x < 2.1.18, 2.2.x < 2.2.9, 2.3.x < 2.3.2 Multiple Vulnerabilities (Jun 2019)

Magento is prone to multiple vulnerabilities, including remote code execution RCE, cross-site scripting XSS and others. See the referenced advisories for further details on each specific vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a...

Unspecified Vulnerability in Magento (CNVD-2020-52445)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . A security vulnerability exists in Magento Open Source versions prior to 1.9.4.2 and Magento Commerce versions...

Unspecified vulnerability in Magento (CNVD-2020-52446)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento Open Source versions prior to 1.9.4.2 and Magento Commerce versions...

Unspecified Vulnerability in Magento (CNVD-2020-5244)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . A security vulnerability exists in Magento Open Source versions prior to 1.9.4.2 and Magento Commerce versions...

Magento input validation error vulnerability (CNVD-2019-39384)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento version 2.1 before 2.1.18, version 2.2 before 2.2.9, and version 2.3...

Magento input validation error vulnerability (CNVD-2019-39382)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento version 2.1 before 2.1.18, version 2.2 before 2.2.9, and version 2.3...