CVE-2019-19683

RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs...

Design/Logic Flaw

RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions...

Cross site scripting

nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/id Admin/Blog/BlogPostEdit/id. NOTE: the...

Privilege escalation

nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin...

Path traversal

RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs...

CVE-2019-19682

nopCommerce

CVE-2019-19682

nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/id Admin/Blog/BlogPostEdit/id. NOTE: the...

CVE-2019-19684

CVE-2019-19684 affects nopCommerce v4.2.0, enabling privilege escalation via file upload through Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs (Admin/FacebookAuthentication/Configure) by uploading a crafted Facebook Auth plugin. Root cause: insecure file upload in the PluginCon...

CVE-2019-19684

nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentication/Configure because it is possible to upload a crafted Facebook Auth plugin...

CVE-2019-19685

CVE-2019-19685 concerns a CSRF flaw in RoxyFileman shipped with nopCommerce v4.2.0. The issue arises because GET requests can perform state-changing actions (renames and deletions), enabling an attacker to induce unintended requests from an authenticated user. The affected component is RoxyFilema...

CVE-2019-19685

RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions...

CVE-2019-19683

RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs...

CVE-2019-19683

CVE-2019-19683 affects nopCommerce v4.2.0 when using RoxyFileman. The issue is a path traversal vulnerability: an attacker can exploit ../ traversal via d or f to reach Admin/RoxyFileman/ProcessRequest due to the implementation in Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

Code injection

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2019-11519

Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations - Languages - Edit Language - Import Resources - Upload XML file" screen...

CVE-2019-11519

nopCommerce up to version 4.10 is affected by an XML External Entity (XXE) vulnerability in Libraries/Nop.Services/Localization/LocalizationService.cs. The issue is exposed via the Import Resources flow on Configurations -> Languages -> Edit Language -> Upload XML file, enabling an XXE c...

nopCommerce 3.70 Cross Site Scripting

Security Advisory CVE-ID: N/A Topic: Reflected Cross Site Scripting XSS Vulnerability in "successful registration" page Class: Input Validation Severity: Medium Discovery: 2016-04-28 Vendor Notification: 2016-04-28 Vendor response: 2016-05-30 Vendor Patch: 2016-05-31 Public Announced: 2016-08-15...