PT-2016-5068

Name of the Vulnerable Software and Affected Versions Magento Enterprise Edition versions prior to 1.14.2.3 Magento Community Edition versions prior to 1.9.2.3 Description The issue allows remote attackers to obtain sensitive order information. This is achieved by exploiting the...

CVE-2016-2212: Exposure of Sensitive Information to an Unauthorized Actor

The getOrderByStatusUrlKey function in the MageRssHelperOrder class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the orderid in a JSON object ...