5158 matches found
CVE-2019-7139
An unauthenticated SQL injection vulnerability exists in Magento due to insufficient validation of externally entered SQL statements, specifically a failure to properly sanitize user-supplied 'from' and 'to' inputs in the prepareSqlCondition function of the ` MagentoFrameworkDBAdapterPdoMysql cla...
CVE-2019-7139
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...
PT-2019-18432
Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description The issue allows an unauthenticated user to execute SQL statements, resulting in arbitrary read access to the underlying...
Magento 2.1.x < 2.1.17 / 2.2.x < 2.2.8 / 2.3.x < 2.3.1 SQL Injection
The Magento application running on the remote web server is affected by a SQL injection vulnerability due to failing to properly sanitize the user-supplied 'from' and 'to' inputs to the 'prepareSqlCondition' function of the '\Magento\Framework\DB\Adapter\Pdo\Mysql' class. An unauthenticated, remo...
CVE-2019-7139: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...
Exploit for CVE-2013-0422
K8tools 20190403 声明: 工具仅供安全研究或授权渗透，非法用途后果自负。 博客: https://www.cnblogs.com/k8gege 下载: https://github.com/k8gege/K8tools 密码: k8gege k8team K8team PS: 不定期更新,文件比较大，可按需下载。 提权工具均可在远控cmd或WebShell下运行，大部份经过修改重新编译兼容性稳定性比网上要好 综合工具 + 综合工具 K8飞刀Final.rar + K8data.mdb K8飞刀漏洞数据库20190402 + K8expList.txt K8飞刀漏洞利用列表...
Magento 2 SQL Injection
SQL Injection vulnerability in Magento 2 Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...
VulnCheck KEV: CVE-2019-7139
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...
Magento Patches Critical SQL Injection and RCE Vulnerabilities
Magento patched 37 vulnerabilities on Thursday, including a host of critical flaws in the e-commerce platform that could have let attackers perform a range of malicious activities, such as take over a site and create new admin accounts. The most serious of the bugs is a remote code-execution RCE...
Critical Magento SQL Injection Vulnerability Discovered – Patch Your Sites
If your online e-commerce business is running over the Magento platform, you must pay attention to this information. Magento yesterday released new versions of its content management software to address a total of 37 newly-discovered security vulnerabilities. Owned by Adobe since mid-2018, Magent...
Critical Magento SQL Injection Vulnerability Discovered – Patch Your Sites
If your online e-commerce business is running over the Magento platform, you must pay attention to this information. Magento yesterday released new versions of its content management software to address a total of 37 newly-discovered security vulnerabilities. Owned by Adobe since mid-2018, Magent...
Magento 2.x Multiple Vulnerabilities (Mar 2019)
Magento 2.x is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:magentocommerce:magento"; if...
Magento 1.x Multiple Vulnerabilities (SUPEE-11086)
Magento 1.x is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:magentocommerce:magento"; if...
Magento 2.2.x < 2.2.8 / 2.3.x < 2.3.1 Unauthenticated SQLi
The Magento application running on the remote web server is affected by a SQL injection vulnerability due to failing to properly sanitize the user-supplied 'from' and 'to' inputs to the 'prepareSqlCondition' function of the 'Magento\Framework\DB\Adapter\Pdo\Mysql' class. An unauthenticated, remot...
Magento 2.3.0 SQL Injection
!/usr/bin/env python3 Magento 2.2.0 = 2.3.0 Unauthenticated SQLi Charles Fol 2019-03-22 SOURCE & SINK The sink from-to SQL condition has been present from Magento 1.x onwards. The source /catalog/productfrontendaction/synchronize from 2.2.0. If your target runs Magento 2.2.0, you need to find...
Magento Core 2.1.x < 2.1.17 / 2.2.x < 2.2.8 / 2.3.x < 2.3.1 SQL Injection vulnerability
Binary data 700490.prm...
Magento Community Edition 1.9.x < 1.9.4.1 / 1.14.x < 1.14.4.1 SQL Injection vulnerability
Binary data 700489.prm...
Magento 2.3.0 SQL Injection Exploit
Magento versions 2.2.0 through 2.3.0 unauthenticated remote SQL injection exploit. !/usr/bin/env python3 Magento 2.2.0 = 2.3.0 Unauthenticated SQLi Charles Fol SOURCE & SINK The sink from-to SQL condition has been present from Magento 1.x onwards. The source...
Magento CMS Multiple Security Vulnerabilities
Description Magento CMS is prone to the following security vulnerabilities. 1. Multiple HTML-injection vulnerabilities 2. Multiple remote code execution vulnerabilities 3. Multiple cross-site scripting vulnerabilities 4. An information-disclosure vulnerability 5. An authorization-bypass...
