CVE-2016-6485

The CVE-2016-6485 entry concerns Magento 2’s Framework/Encryption/Crypt.php, where the __construct uses PHP rand to generate the initialization vector. This weak RNG undermines cryptographic protection, making it easier for remote attackers to guess IV values. Documents consistently describe inse...

CVE-2016-6485

The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...

Magento RSS Brute Force Attempt

A remote attacker can attempt to obtain login credentials to the built-in RSS feed functionality of the Magento platform using brute force. Successful exploitation would allow an attacker to obtain unauthorized access to the Magento Admin login...

SUPEE-9652 - Remote Code Execution using mail vulnerability

More info at https://magento.com/security/patches/supee-9652...

SUPEE-9652 - Remote Code Execution using mail vulnerability

More info at https://magento.com/security/patches/supee-9652...

Magento < 2.0.6 RCE Vulnerability

Magento Web E-Commerce Platform is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

marketplace.magento.com IFRAME Injection vulnerability

Vulnerable URL: https://marketplace.magento.com/catalogsearch/result/?cat=8= XANY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.08.2017 Vulnerability type:| IFRAME Injection Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

Immunity Canvas: MAGENTO_SET_PAY_INFO

Name| magentosetpayinfo ---|--- CVE| CVE-2016-4010 Exploit Pack| CANVAS Description| Magento unauthenticated unserialize 2.0.6 Notes| Repeatability: Infinite VENDOR: Magento CVE Url: https://vulners.com/cve/CVE-2016-4010 CVE Name: CVE-2016-4010...

Design/Logic Flaw

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

Immunity Canvas: MAGENTO_SET_PAYMENT_INFO

Name| magentosetpaymentinfo ---|--- CVE| CVE-2016-4010 Exploit Pack| CANVAS Description| Magento unauthenticated unserialize 2.0.6 Notes| Repeatability: Infinite VENDOR: Magento CVE Url: https://vulners.com/cve/CVE-2016-4010 CVE Name: CVE-2016-4010...

CVE-2016-4010

CVE-2016-4010 affects Magento CE/EE before 2.0.6 and enables unauthenticated remote code execution via crafted serialized shopping cart data, due to a PHP object injection in the checkout/cart flow. OpenVAS and exploit references describe Magento

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

marketplace.magento.com XSS vulnerability

Vulnerable URL: https://marketplace.magento.com/catalogsearch/result/?cat=8='+" XSS+by+xany Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

Magento Community Edition < 1.9.3 Multiple Vulnerabilities

Binary data 8963.prm...

Magento Community Edition 2.x < 2.0.10 Multiple Vulnerabilities

Binary data 8964.prm...

Magento Community Edition 2.1.x < 2.1.2 Multiple Vulnerabilities

Binary data 8965.prm...

Magento CMS APPSEC-1484 Remote Code Execution Vulnerability

Magento CMS is the United States Magento company's set of open source PHP e-commerce content management system CMS. A remote code execution vulnerability exists in Magento CMS. An attacker can exploit this vulnerability to execute arbitrary code in the context of an affected application...

Magento CMS Invitations Feature HTML Injection Vulnerability

Magento CMS is the United States Magento company's set of open source PHP e-commerce content management system CMS. An HTML injection vulnerability exists in Magento CMS due to failure to adequately filter user input data. An attacker could exploit this vulnerability to execute arbitrary script...