PT-2019-15910

Name of the Vulnerable Software and Affected Versions nopCommerce version 4.2.0 Description The issue allows for Cross-Site Request Forgery CSRF attacks because GET requests can be used to perform actions such as renames and deletions. Recommendations For nopCommerce version 4.2.0, consider...

PT-2019-15907

Name of the Vulnerable Software and Affected Versions nopCommerce versions prior to 4.20 Description The issue allows for XSS in the SaveStoreMappings of the components PresentationNop.WebAreasAdminControllersNewsController.cs and PresentationNop.WebAreasAdminControllersBlogController.cs via Body...

Code injection

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2019-11519

nopCommerce up to version 4.10 is affected by an XML External Entity (XXE) vulnerability in Libraries/Nop.Services/Localization/LocalizationService.cs. The issue is exposed via the Import Resources flow on Configurations -> Languages -> Edit Language -> Upload XML file, enabling an XXE c...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2019-11519: Improper Restriction of XML External Entity Reference

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

PT-2019-12351

Name of the Vulnerable Software and Affected Versions nopCommerce versions prior to 4.10 Description The issue concerns an XXE vulnerability in the LocalizationService.cs file. This vulnerability can be exploited via the "Configurations - Languages - Edit Language - Import Resources - Upload XML...

nopCommerce 3.70 Cross Site Scripting

Security Advisory CVE-ID: N/A Topic: Reflected Cross Site Scripting XSS Vulnerability in "successful registration" page Class: Input Validation Severity: Medium Discovery: 2016-04-28 Vendor Notification: 2016-04-28 Vendor response: 2016-05-30 Vendor Patch: 2016-05-31 Public Announced: 2016-08-15...