CVE-2016-6485

The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...

CVE-2016-6485

The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...

CVE-2016-6485

The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...

CVE-2016-6485

The CVE-2016-6485 entry concerns Magento 2’s Framework/Encryption/Crypt.php, where the __construct uses PHP rand to generate the initialization vector. This weak RNG undermines cryptographic protection, making it easier for remote attackers to guess IV values. Documents consistently describe inse...

Magento RSS Brute Force Attempt

A remote attacker can attempt to obtain login credentials to the built-in RSS feed functionality of the Magento platform using brute force. Successful exploitation would allow an attacker to obtain unauthorized access to the Magento Admin login...

SUPEE-9652 - Remote Code Execution using mail vulnerability

More info at https://magento.com/security/patches/supee-9652...

SUPEE-9652 - Remote Code Execution using mail vulnerability

More info at https://magento.com/security/patches/supee-9652...

Magento < 2.0.6 RCE Vulnerability

Magento Web E-Commerce Platform is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

marketplace.magento.com IFRAME Injection vulnerability

Vulnerable URL: https://marketplace.magento.com/catalogsearch/result/?cat=8= XANY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.08.2017 Vulnerability type:| IFRAME Injection Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

Design/Logic Flaw

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

Immunity Canvas: MAGENTO_SET_PAYMENT_INFO

Name| magentosetpaymentinfo ---|--- CVE| CVE-2016-4010 Exploit Pack| CANVAS Description| Magento unauthenticated unserialize 2.0.6 Notes| Repeatability: Infinite VENDOR: Magento CVE Url: https://vulners.com/cve/CVE-2016-4010 CVE Name: CVE-2016-4010...

Immunity Canvas: MAGENTO_SET_PAY_INFO

Name| magentosetpayinfo ---|--- CVE| CVE-2016-4010 Exploit Pack| CANVAS Description| Magento unauthenticated unserialize 2.0.6 Notes| Repeatability: Infinite VENDOR: Magento CVE Url: https://vulners.com/cve/CVE-2016-4010 CVE Name: CVE-2016-4010...

CVE-2016-4010

CVE-2016-4010 affects Magento CE/EE before 2.0.6 and enables unauthenticated remote code execution via crafted serialized shopping cart data, due to a PHP object injection in the checkout/cart flow. OpenVAS and exploit references describe Magento

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

marketplace.magento.com XSS vulnerability

Vulnerable URL: https://marketplace.magento.com/catalogsearch/result/?cat=8='+" XSS+by+xany Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

Magento Community Edition 2.x < 2.0.10 Multiple Vulnerabilities

Binary data 8964.prm...

Magento Community Edition 2.1.x < 2.1.2 Multiple Vulnerabilities

Binary data 8965.prm...

Magento Community Edition < 1.9.3 Multiple Vulnerabilities

Binary data 8963.prm...