AionWeb, Magento, Liferay Portal, SurgeMail, symfony XSS vulnerability

Exploit for php platform in category web applications I will draw your attention to XSS vulnerability in other web applications with swfupload. Earlier I've wrote about swfupload in Dotclear, XenForo, InstantCMS, AionWeb, Dolphin and that this hole is available in many other web applications. In...

CVE-2011-5240

Magento 1.5 and 1.6.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Design/Logic Flaw

Magento 1.5 and 1.6.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2011-5240

Magento 1.5 and 1.6.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2011-5240

Magento 1.5 and 1.6.2 do not verify that the server hostname matches the domain name in the certificate's CN/subjectAltName, enabling MITM via an arbitrary valid X.509 certificate. This is the core vulnerability; exploitation status and concrete fixes/versions are not provided in the connected do...

SEC Consult SA-20121017-1 :: Unirgy uStoreLocator SQL Injection - Magento extension

SEC Consult Vulnerability Lab Security Advisory 20121017-1 ======================================================================= title: SQL Injection product: Unirgy uStoreLocator - Magento extension vulnerable version: =2.0.0 fixed version: =2.0.1 impact: High homepage: http://www.unirgy.com/...

Unirgy uStoreLocator Magento Extension SQL Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: SQL Injection product: Unirgy uStoreLocator - Magento extension vulnerable version: =2.0.1 impact: High homepage: http://www.unirgy.com/ found: 2012-06-18 by: K...

Magento eCommerce Local File Disclosure Vulnerability (Jul 2012)

Magento eCommerce is prone to a local file disclosure vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Magento eCommerce Platform XXE Injection exploit-vulnerability warning-the black bar safety net

0x1 In tick-zone xsser the articlezend framework file read vulnerability analysishas reference to magento, the following is one of the original: According to@crickets brother in the clouds on the vulnerability report warns that some open source software because of the use of zend framework's xml...

Magento File Disclosure

XML external entity vulnerability api/xmlrpc Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Magento eCommerce Platform XXE Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local file disclosure via XXE injection product: Magento eCommerce Platform Enterprise & Community Edition vulnerable version: Magento eCommerce Platform Enterprise Editi...

Magento eCommerce - Local File Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local file disclosure via XXE injection product: Magento eCommerce Platform Enterprise & Community Edition vulnerable version: Magento eCommerce Platform Enterprise Editi...

Magento eCommerce Local File Disclosure

Exploit for php platform in category web applications ======================================================================= title: Local file disclosure via XXE injection product: Magento eCommerce Platform Enterprise & Community Edition vulnerable version: Magento eCommerce Platform Enterprise...

Magento eCommerce - Local File Disclosure

Magento eCommerce - Local File Disclosure SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local file disclosure via XXE injection product: Magento eCommerce Platform Enterprise & Community Edition vulnerable version:...

Vulnerabilities in plugins for MODx CMS, XOOPS, uCoz, Magento and DSP CMS

Hello 3APA3A! Besides tens millions of vulnerable web sites with affected flash files and vulnerable multiple plugins for different engines, which I've wrote about earlier, there are a lot of other vulnerable plugins. Here are new ones some of them are vulnerable to two XSS holes. There are...

Update: Vulnerability in plugins for Typepad, RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and Sweetcron

Hello 3APA3A! One update concerning Cross-Site Scripting vulnerability in multiple plugins for different engines in plugins for Typepad, RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and Sweetcron, which all are ports of WP-Cumulus. Which I wrote...

Vulnerability in plugins for Typepad, RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and Sweetcron

Hello 3APA3A! I want to warn you about Cross-Site Scripting vulnerability in multiple plugins for different engines it's combinations of my three publications which I've made earlier at my site. In plugins for Typepad, RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS,...

WP-Cumulus Variants Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting vulnerability in multiple plugins for different engines it's combinations of my two publications which I've made last week at my site. In plugins for RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion,...

Magento Community Edition 1.3.2.43 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The full text of this advisory can be found at: http://www.madirish.net/?article=445 Description of Vulnerability: - ----------------------------- Magento http://www.magentocommerce.com/ is an eCommerce platform written in MySQL and PHP. Magento...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Magento 1.2.0 and 1.2.1.1 allow remote attackers to inject arbitrary web script or HTML via 1 the username field in an admin/ request to index.php, possibly related to the loginusername parameter and the app/code/core/Mage/Admin/Model/Session.p...