CVE-2019-19683

CVE-2019-19683 affects nopCommerce v4.2.0 when using RoxyFileman. The issue is a path traversal vulnerability: an attacker can exploit ../ traversal via d or f to reach Admin/RoxyFileman/ProcessRequest due to the implementation in Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

Code injection

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2019-11519

nopCommerce up to version 4.10 is affected by an XML External Entity (XXE) vulnerability in Libraries/Nop.Services/Localization/LocalizationService.cs. The issue is exposed via the Import Resources flow on Configurations -> Languages -> Edit Language -> Upload XML file, enabling an XXE c...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

nopCommerce 3.70 Cross Site Scripting

Security Advisory CVE-ID: N/A Topic: Reflected Cross Site Scripting XSS Vulnerability in "successful registration" page Class: Input Validation Severity: Medium Discovery: 2016-04-28 Vendor Notification: 2016-04-28 Vendor response: 2016-05-30 Vendor Patch: 2016-05-31 Public Announced: 2016-08-15...