5158 matches found
PT-2017-6394
Name of the Vulnerable Software and Affected Versions Magento E-Commerce Platform version 1.9.0.1 Description A cross-site scripting XSS issue affects the Magento E-Commerce Platform, allowing potential exploitation. Recommendations For Magento E-Commerce Platform version 1.9.0.1, update to a new...
CVE-2014-9758: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Magento E-Commerce Platform 1.9.0.1...
Magento CMS 'RetrieveImage.php' Arbitrary File Upload Vulnerability
Magento CMS is an open source PHP e-commerce content management system CMS of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions . Magento CMS has an arbitrary file upload vulnerability. An attacker can use this...
Magento Vimeo Invalid Image Cross Site Request Forgery
A cross-site request forgery vulnerability exists in Magento. The vulnerability is due to insufficient CSRF protections, that enables an attacker to upload arbitrary files including PHP files to a target server. A remote attacker can exploit this vulnerability by enticing a target authenticated...
Magento Arbitrary File Upload Vulnerability
Magento Web E-Commerce Platform is prone to an arbitrary file upload vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Magento Cross-Site Request Forgery Vulnerability
Magento is an open source PHP e-commerce system from the U.S. company Magento. Magento suffers from a cross-site request forgery vulnerability. A remote user can create specially crafted HTML pages or URLs that, when loaded by a target authenticated user, will take action against the target...
'High Risk' Zero-Day Leaves 200,000 Magento Merchants Vulnerable
A popular version of the open source Magento ecommerce platform is vulnerable to a zero-day remote code execution vulnerability, putting as many as 200,000 online retailers at risk. The warning comes from security firm DefenseCode, which found and originally reported the vulnerability to Magento ...
Magmi Cross-Site Scripting Vulnerability
Magmi is a set of import tools for importing product catalogs into the Magento system. A cross-site scripting vulnerability exists in Magmi version 0.7.22, which stems from the program failing to adequately filter user submissions to the magmi-git-master/magmi/web/ajaxgettime.php; URL. A remote...
Inchoo Facebook Connect Cross Site Scripting
https://www.osisecurity.com.au/inchoo-facebook-connect-extension-for-magento-parameter-xss.html Date: 04-Apr-2017 Product: Inchoo Facebook Connect Magento Plugin Vulnerability: Reflected cross-site scripting. Details: Within ./app/code/community/Inchoo/Facebook/Block/Channel.php return 'isSecure ...
Hackers with Credit Card Scrapers Continue to Target Magento
Attackers continue to take aim at the e-commerce platform Magento. Researchers said last week they came across a malicious function snuck into one of the platform’s modules in order to steal credit card information. Code for the function was injected into a .php file for SF9 Realex, a module that...
CVE-2016-6485
The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...
CVE-2016-6485
The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...
CVE-2016-6485
The CVE-2016-6485 entry concerns Magento 2’s Framework/Encryption/Crypt.php, where the __construct uses PHP rand to generate the initialization vector. This weak RNG undermines cryptographic protection, making it easier for remote attackers to guess IV values. Documents consistently describe inse...
CVE-2016-6485
The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...
CVE-2016-6485
The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...
PT-2017-8982
Name of the Vulnerable Software and Affected Versions Magento 2 affected versions not specified Description The issue concerns the generation of a random number for the initialization vector in the construct function, located in Framework/Encryption/Crypt.php. This function utilizes the PHP rand...
CVE-2016-6485: Use of a Broken or Risky Cryptographic Algorithm
The construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value...
Magento RSS Brute Force Attempt
A remote attacker can attempt to obtain login credentials to the built-in RSS feed functionality of the Magento platform using brute force. Successful exploitation would allow an attacker to obtain unauthorized access to the Magento Admin login...
