CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-8707
https://notcve.org/view.php?id=CVE-2015-8707
Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field. Los tokens de restablecimiento de contraseña en Magento CE en versiones anteriores a la 1.9.2.2 y Magento EE en versiones anteriores a la 1.14.2.2 se pasan mediante una petición GET y no se cancelan tras su uso. Esto permite que los atacantes remotos obtengan las contraseñas de usuario mediante un servicio externo manipulado con acceso al campo referrer. • https://magento.com/security/patches/supee-6788 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 95%CPEs: 2EXPL: 6CVE-2016-4010 – Magento 2.0.6 Unserialize Remote Code Execution
https://notcve.org/view.php?id=CVE-2016-4010
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data. Magento CE y EE en versiones anteriores a 2.0.6 permite a atacantes remotos llevar a cabo ataques de inyección de objeción de PHP y ejecutar código PHP arbitrario a través de la manipulación de los datos del carro de compra. Magento versions prior to 2.0.6 suffer from an unauthenticated arbitrary unserialize to arbitrary write file vulnerability. • https://www.exploit-db.com/exploits/39838 https://github.com/brianwrf/Magento-CVE-2016-4010 https://github.com/shadofren/CVE-2016-4010 http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution https://magento.com/security/patches/magento-206-security-update https://packetstormsecurity.com/files/137121/Magento-Unauthenticated-Arbitrary-File-Write.html https://packetstormsecurity.com/files/137312/Magento-2.0.6-Unserialize-Remote-Code-Execution.html http://blog.checkpoint.com/2015/11/ • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 2CVE-2016-2212 – Magento 1.9.2.2 RSS Feed Information Disclosure
https://notcve.org/view.php?id=CVE-2016-2212
The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the order_id in a JSON object in the data parameter in an RSS feed request to index.php/rss/order/status. La función getOrderByStatusUrlKey en la clase Mage_Rss_Helper_Order en app/code/core/Mage/Rss/Helper/Order.php en Magento Enterprise Edition en versiones anteriores a 1.14.2.3 y Magento Community Edition en versiones anteriores a 1.9.2.3 permite a atacantes remotos obtener información sensible de order a través del order_id en un objeto JSON en el parámetro data en una petición de feed RSS a index.php/rss/order/status. Magento versions 1.9.2.2 and below suffer from an information disclosure vulnerability in their RSS feed. • http://karmainsecurity.com/KIS-2016-02 http://packetstormsecurity.com/files/135941/Magento-1.9.2.2-RSS-Feed-Information-Disclosure.html http://seclists.org/fulldisclosure/2016/Feb/105 http://www.securityfocus.com/archive/1/537601/100/0/threaded https://magento.com/security/patches/supee-7405 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 3%CPEs: 4EXPL: 4CVE-2015-6497 – Magento 1.9.2 File Inclusion
https://notcve.org/view.php?id=CVE-2015-6497
The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap. La función create en el archivo app/code/core/Mage/Catalog/Model/Product/Api/V2.php en Magento Community Edition (CE) versiones anteriores a 1.9.2.1 y Enterprise Edition (EE) versiones anteriores a 1.14.2.1, cuando es usado con PHP versiones anteriores a 5.4.24 o 5.5.8, permite a usuarios autenticados remotos ejecutar código PHP arbitrario por medio del parámetro productData en index.php/api/v2_soap. Magento versions 1.9.2 and below suffer from an autoloaded file inclusion vulnerability. • http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html http://karmainsecurity.com/KIS-2015-04 http://magento.com/security/patches/supee-6482 http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html http://seclists.org/fulldisclosure/2015/Sep/48 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 61%CPEs: 2EXPL: 1CVE-2015-1399
https://notcve.org/view.php?id=CVE-2015-1399
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files. Vulnerabilidad de la inclusión remota de ficheros PHP en la función fetchView en la clase Mage_Core_Block_Template_Zend en Magento Community Edition (CE) 1.9.1.0 y Enterprise Edition (EE) 1.14.1.0 permite a administradores remotos ejecutar código PHP arbitrario a través de una URL en vectores no especificados que involucran la función setScriptPath. NOTA: no está claro si este problema cruza los límites de privilegios, como los administradores podrían ya tener los privilegios para incluir ficheros arbitrarios. • http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability http://www.securitytracker.com/id/1032194 • CWE-94: Improper Control of Generation of Code ('Code Injection') •