CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15081 – Information exposure in the upload directory in PrestaShop
https://notcve.org/view.php?id=CVE-2020-15081
In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory. En PrestaShop desde versión 1.5.0.0 y anteriores a 1.7.6.6, se presenta una exposición de información en el directorio de carga. El problema es corregido en versión 1.7.6.6. • https://github.com/PrestaShop/PrestaShop/commit/bac9ea6936b073f84b1abd9864317af3713f1901 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-997j-f42g-x57c • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-548: Exposure of Information Through Directory Listing •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2020-12120
https://notcve.org/view.php?id=CVE-2020-12120
The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner password that can be used to modify orders via SOAP. Attackers can also retrieve information about orders or buyers. El addon Correos Express para PrestaShop versiones 1.6 hasta 1.7, permite a atacantes remotos obtener información confidencial, tal y como la contraseña de propietario del servicio que puede ser usada para modificar los pedidos por medio de SOAP. Los atacantes también pueden recuperar información sobre los pedidos o los compradores. • https://addons.prestashop.com/en/delivery-date/27273-correos-express-solutions-of-urgent-transport.html https://ia-informatica.com/it/CVE-2020-12120 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5286 – Reflected XSS related in import page in PrestaShop
https://notcve.org/view.php?id=CVE-2020-5286
In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file. The problem is fixed in 1.7.6.5 En PrestaShop entre las versiones 1.7.4.0 y 1.7.6.5, hay una vulnerabilidad de tipo XSS reflejado cuando se carga un archivo incorrecto. El problema se corrigió en la versión 1.7.6.5. • https://github.com/PrestaShop/PrestaShop/commit/fc0625fb0a9aab1835515f1bea52e8e063384da7 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-98j8-hvjv-x47j • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5287 – Improper access control on customers search in PrestaShop
https://notcve.org/view.php?id=CVE-2020-5287
In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5. En PrestaShop entre las versiones 1.5.5.0 y 1.7.6.5, hay un control de acceso inapropiado en la búsqueda de clientes. El problema se corrigió en la versión 1.7.6.5. • https://github.com/PrestaShop/PrestaShop/commit/27e49d89808f1d76eb909a595f344a6739bc0b52 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-r6rp-6gv6-r9hq • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5288 – Improper access control on product attributes page in PrestaShop
https://notcve.org/view.php?id=CVE-2020-5288
"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5. En PrestaShop entre las versiones 1.7.0.0 y 1.7.6.5, tiene un control de acceso inapropiado en la página de atributos del producto. El problema se corrigió en la versión 1.7.6.5 • https://github.com/PrestaShop/PrestaShop/commit/fc1d796dda769efdbc4d9e02ea7a11e4167338d0 https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-4wxg-33h3-3w5r • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •