CVSS: 9.8EPSS: 94%CPEs: 2EXPL: 5CVE-2016-4010 – Magento < 2.0.6 - Arbitrary Unserialize / Arbitrary Write File
https://notcve.org/view.php?id=CVE-2016-4010
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data. Magento CE y EE en versiones anteriores a 2.0.6 permite a atacantes remotos llevar a cabo ataques de inyección de objeción de PHP y ejecutar código PHP arbitrario a través de la manipulación de los datos del carro de compra. Magento versions prior to 2.0.6 suffer from an unauthenticated arbitrary unserialize to arbitrary write file vulnerability. • https://www.exploit-db.com/exploits/39838 https://github.com/brianwrf/Magento-CVE-2016-4010 https://github.com/shadofren/CVE-2016-4010 http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution https://magento.com/security/patches/magento-206-security-update https://packetstormsecurity.com/files/137121/Magento-Unauthenticated-Arbitrary-File-Write.html https://packetstormsecurity.com/files/137312/Magento-2.0.6-Unserialize-Remote-Code-Execution.html http://blog.checkpoint.com/2015/11/ • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 2CVE-2016-2212 – Magento 1.9.2.2 RSS Feed Information Disclosure
https://notcve.org/view.php?id=CVE-2016-2212
The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the order_id in a JSON object in the data parameter in an RSS feed request to index.php/rss/order/status. La función getOrderByStatusUrlKey en la clase Mage_Rss_Helper_Order en app/code/core/Mage/Rss/Helper/Order.php en Magento Enterprise Edition en versiones anteriores a 1.14.2.3 y Magento Community Edition en versiones anteriores a 1.9.2.3 permite a atacantes remotos obtener información sensible de order a través del order_id en un objeto JSON en el parámetro data en una petición de feed RSS a index.php/rss/order/status. Magento versions 1.9.2.2 and below suffer from an information disclosure vulnerability in their RSS feed. • http://karmainsecurity.com/KIS-2016-02 http://packetstormsecurity.com/files/135941/Magento-1.9.2.2-RSS-Feed-Information-Disclosure.html http://seclists.org/fulldisclosure/2016/Feb/105 http://www.securityfocus.com/archive/1/537601/100/0/threaded https://magento.com/security/patches/supee-7405 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 3%CPEs: 4EXPL: 4CVE-2015-6497 – Magento 1.9.2 File Inclusion
https://notcve.org/view.php?id=CVE-2015-6497
The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap. La función create en el archivo app/code/core/Mage/Catalog/Model/Product/Api/V2.php en Magento Community Edition (CE) versiones anteriores a 1.9.2.1 y Enterprise Edition (EE) versiones anteriores a 1.14.2.1, cuando es usado con PHP versiones anteriores a 5.4.24 o 5.5.8, permite a usuarios autenticados remotos ejecutar código PHP arbitrario por medio del parámetro productData en index.php/api/v2_soap. Magento versions 1.9.2 and below suffer from an autoloaded file inclusion vulnerability. • http://blog.mindedsecurity.com/2015/09/autoloaded-file-inclusion-in-magento.html http://karmainsecurity.com/KIS-2015-04 http://magento.com/security/patches/supee-6482 http://packetstormsecurity.com/files/133544/Magento-1.9.2-File-Inclusion.html http://seclists.org/fulldisclosure/2015/Sep/48 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 86%CPEs: 2EXPL: 5CVE-2015-1397 – Magento eCommerce - Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-1397
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set. Vulnerabilidad de inyección SQL en la función getCsvFile en la clase Mage_Adminhtml_Block_Widget_Grid en Magento Community Edition (CE) 1.9.1.0 y Enterprise Edition (EE) 1.14.1.0 permite a administradores remotos ejecutar comandos SQL arbitrarios a través del parámetro popularity[field_expr] cuando el parámetro popularity[from] o popularity[to] está configurado. • https://www.exploit-db.com/exploits/37977 https://github.com/tmatejicek/CVE-2015-1397 https://github.com/WHOISshuvam/CVE-2015-1397 https://github.com/Wytchwulf/CVE-2015-1397-Magento-Shoplift http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability http://www.securitytracker.com/id/1032194 https://blog.sucuri.net/2015/04/magento-shoplift-supee-5344-exploits-in-the-wild.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2015-3458
https://notcve.org/view.php?id=CVE-2015-3458
The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files. La función fetchView en la clase Mage_Core_Block_Template_Zend en Magento Community Edition (CE) 1.9.1.0 y Enterprise Edition (EE) 1.14.1.0 no restringe el envoltorio de flujos utilizado en una ruta de plantilla, lo que permite a administradores remotos incluir y ejecutar ficheros PHP arbitrarios a través del envoltorio de flujos phar://, relacionado con la función setScriptPath. NOTA: no está claro si este problema cruza los límites de los privilegios, como los administradores podría ya tener los privilegios para incluir ficheros arbitrarios. • http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability http://www.securityfocus.com/bid/74412 http://www.securitytracker.com/id/1032230 • CWE-264: Permissions, Privileges, and Access Controls •