4490 matches found
Mirasvit Helpdesk MX Cross-Site Scripting Vulnerability
Mirasvit Helpdesk MX is a set of extension support platform for Magento e-commerce system from Mirasvit. The platform provides a variety of extension modules for Magento. A cross-site scripting vulnerability exists in the administration interface of Mirasvit Helpdesk MX versions prior to 1.5.3. A...
Mirasvit Helpdesk MX Code Execution Vulnerability
Mirasvit Helpdesk MX is a set of extension support platform for Magento e-commerce system from Mirasvit. The platform provides a variety of extension modules for Magento. A security vulnerability exists in Mirasvit Helpdesk MX versions prior to 1.5.3. A remote attacker can exploit the vulnerabili...
Cross site scripting
Cross-site scripting XSS vulnerability in Magento E-Commerce Platform 1.9.0.1...
CVE-2014-9758
Cross-site scripting XSS vulnerability in Magento E-Commerce Platform 1.9.0.1...
CVE-2014-9758
CVE-2014-9758 is a cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1. Affected component: Magento 1.9.0.1 web application. Root cause: XSS in the platform. Impact per sources: Confidentiality LOW, Integrity LOW, Availability NONE (CVSS3.1); Attack vector NETWORK, Use...
CVE-2014-9758
Cross-site scripting XSS vulnerability in Magento E-Commerce Platform 1.9.0.1...
Magento CMS 'RetrieveImage.php' Arbitrary File Upload Vulnerability
Magento CMS is an open source PHP e-commerce content management system CMS of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions . Magento CMS has an arbitrary file upload vulnerability. An attacker can use this...
Magento Vimeo Invalid Image Cross Site Request Forgery
A cross-site request forgery vulnerability exists in Magento. The vulnerability is due to insufficient CSRF protections, that enables an attacker to upload arbitrary files including PHP files to a target server. A remote attacker can exploit this vulnerability by enticing a target authenticated...
Magento Arbitrary File Upload Vulnerability
Magento Web E-Commerce Platform is prone to an arbitrary file upload vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Magento Cross-Site Request Forgery Vulnerability
Magento is an open source PHP e-commerce system from the U.S. company Magento. Magento suffers from a cross-site request forgery vulnerability. A remote user can create specially crafted HTML pages or URLs that, when loaded by a target authenticated user, will take action against the target...
'High Risk' Zero-Day Leaves 200,000 Magento Merchants Vulnerable
A popular version of the open source Magento ecommerce platform is vulnerable to a zero-day remote code execution vulnerability, putting as many as 200,000 online retailers at risk. The warning comes from security firm DefenseCode, which found and originally reported the vulnerability to Magento ...
Magmi Cross-Site Scripting Vulnerability
Magmi is a set of import tools for importing product catalogs into the Magento system. A cross-site scripting vulnerability exists in Magmi version 0.7.22, which stems from the program failing to adequately filter user submissions to the magmi-git-master/magmi/web/ajaxgettime.php; URL. A remote...
Inchoo Facebook Connect Cross Site Scripting
https://www.osisecurity.com.au/inchoo-facebook-connect-extension-for-magento-parameter-xss.html Date: 04-Apr-2017 Product: Inchoo Facebook Connect Magento Plugin Vulnerability: Reflected cross-site scripting. Details: Within ./app/code/community/Inchoo/Facebook/Block/Channel.php return 'isSecure ...
Hackers with Credit Card Scrapers Continue to Target Magento
Attackers continue to take aim at the e-commerce platform Magento. Researchers said last week they came across a malicious function snuck into one of the platform’s modules in order to steal credit card information. Code for the function was injected into a .php file for SF9 Realex, a module that...
CVE-2016-6485
The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...
CVE-2016-6485
The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...
CVE-2016-6485
The CVE-2016-6485 entry concerns Magento 2’s Framework/Encryption/Crypt.php, where the __construct uses PHP rand to generate the initialization vector. This weak RNG undermines cryptographic protection, making it easier for remote attackers to guess IV values. Documents consistently describe inse...
CVE-2016-6485
The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...
Magento RSS Brute Force Attempt
A remote attacker can attempt to obtain login credentials to the built-in RSS feed functionality of the Magento platform using brute force. Successful exploitation would allow an attacker to obtain unauthorized access to the Magento Admin login...
