Page 4 of 35 results (0.006 seconds)

CVSS: 9.8EPSS: 11%CPEs: 2EXPL: 1

CVE-2018-19355

https://notcve.org/view.php?id=CVE-2018-19355

19 Nov 2018 — modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to execute arbitrary code by uploading a php file via modules/orderfiles/upload.php with auptype equal to product (for upload destinations under modules/productfiles), order (for upload destinations under modules/files), or cart (for upload destinations under modules/cartfiles). modules/orderfiles/ajax/upload.php en el addon Customer Files Upload 2018-08-01 para PrestaSho... • https://ia-informatica.com/it/CVE-2018-19355 • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 9.1EPSS: 20%CPEs: 2EXPL: 3

CVE-2018-13784 – PrestaShop < 1.6.1.19 - 'AES CBC' Privilege Escalation

https://notcve.org/view.php?id=CVE-2018-13784

09 Jul 2018 — PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php. PrestaShop en versiones anteriores a la 1.6.1.20 y versiones 1.7.x anteriores a la 1.7.3.4 gestiona de manera incorrecta el cifrado de cookies en Cookie.php, Rinjdael.php y Blowfish.php. • https://www.exploit-db.com/exploits/45046 •

CVSS: 9.8EPSS: 77%CPEs: 2EXPL: 1

CVE-2018-10942

https://notcve.org/view.php?id=CVE-2018-10942

10 May 2018 — modules/attributewizardpro/file_upload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attackers to execute arbitrary code by uploading a .phtml file. modules/attributewizardpro/file_upload.php en el addon Attribute Wizard 1.6.9 para PrestaShop, de la versión 1.4.0.1 a la 1.6.1.18, permite que atacantes remotos ejecuten código arbitrario mediante la subida de un archivo .phtml. • https://ia-informatica.com/it/CVE-2018-10942 • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-7491

https://notcve.org/view.php?id=CVE-2018-7491

26 Feb 2018 — In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors' values. En PrestaShop hasta la versión 1.7.2.5, se ha encontrado una vulnerabilidad de secuestro de clics que podría conducir a un impacto que cambia el estado en el contexto de un usuario o administrador. Esto se ... • http://forge.prestashop.com/browse/BOOM-4917 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3

CVE-2015-1175 – Prestashop 1.6.0.9 Cross Site Scripting

https://notcve.org/view.php?id=CVE-2015-1175

20 Jan 2015 — Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the layered_price_slider parameter. Vulnerabilidad de XSS en blocklayered-ajax.php en el módulo blocklayered en PrestaShop 1.6.0.9 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro layered_price_slider. Prestashop version 1.6.0.9 suffers from a cros... • https://packetstorm.news/files/id/130026 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •