CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7491
https://notcve.org/view.php?id=CVE-2018-7491
In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors' values. En PrestaShop hasta la versión 1.7.2.5, se ha encontrado una vulnerabilidad de secuestro de clics que podría conducir a un impacto que cambia el estado en el contexto de un usuario o administrador. Esto se debe a que la función generateHtaccess function en classes/Tools.php no establece los valores ni de X-Frame-Options ni de 'Content-Security-Policy "frame-ancestors'. • http://forge.prestashop.com/browse/BOOM-4917 https://github.com/PrestaShop/PrestaShop/pull/8807 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2015-1175 – Prestashop 1.6.0.9 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-1175
Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the layered_price_slider parameter. Vulnerabilidad de XSS en blocklayered-ajax.php en el módulo blocklayered en PrestaShop 1.6.0.9 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro layered_price_slider. Prestashop version 1.6.0.9 suffers from a cross site scripting vulnerability. • http://octogence.com/advisories/cve-2015-1175-xss-prestashop http://packetstormsecurity.com/files/130026/Prestashop-1.6.0.9-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/534511/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/100013 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 0CVE-2012-6641
https://notcve.org/view.php?id=CVE-2012-6641
Cross-site scripting (XSS) vulnerability in redirect.php in the Socolissimo module (modules/socolissimo/) in PrestaShop before 1.4.7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to "parameter names and values." Vulnerabilidad de XSS en redirect.php en el módulo Socolissimo (modules/socolissimo/) en PrestaShop anterior a 1.4.7.2 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores relacionados con "nombres y valores de parámetros." • http://secunia.com/advisories/48036 http://www.prestashop.com/de/entwickler-versionen/changelog/1.4.7.2 http://www.securityfocus.com/bid/52962 https://exchange.xforce.ibmcloud.com/vulnerabilities/74773 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2012-2517 – PrestaShop 1.4.7 - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-2517
Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to ajax.php. Una vulnerabilidad de tipo cross-site scripting (XSS) en PrestaShop versiones anteriores a 1.4.9, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del índice del parámetro product[] en el archivo ajax.php. PrestaShop versions 1.4.7 and 1.4.8 suffer from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/37684 https://www.htbridge.com/advisory/HTB23091 https://www.prestashop.com/download/old/changelog_1.4.9.0.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 22EXPL: 6CVE-2011-4544 – PrestaShop 1.4.4.1 - '/admin/ajaxfilemanager/ajax_save_text.php' Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2011-4544
Multiple cross-site scripting (XSS) vulnerabilities in Prestashop before 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) address or (2) relativ_base_dir parameter to modules/mondialrelay/googlemap.php; the (3) relativ_base_dir, (4) Pays, (5) Ville, (6) CP, (7) Poids, (8) Action, or (9) num parameter to prestashop/modules/mondialrelay/googlemap.php; (10) the num_mode parameter to modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php; (11) the Expedition parameter to modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php; or the (12) folder or (13) name parameter to admin/ajaxfilemanager/ajax_save_text.php. Varias vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Prestashop antes de v1.5 permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) la dirección o (2) el parámetro relativ_base_dir a modules/mondialrelay/googlemap.php; tambien con los parámetros (3) relativ_base_dir, (4) Pays (5), Ville, (6) CP, (7) Poids, (8) Action, o (9) num para prestashop/modules/mondialrelay/googlemap.php; También el parámetro (10) num_mode a modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php; (11) el parámetro de la expedición a modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php, o los parámetros (12) folder o (13) name a admin/ajaxfilemanager/ajax_save_text.php. • https://www.exploit-db.com/exploits/36344 https://www.exploit-db.com/exploits/36342 https://www.exploit-db.com/exploits/36343 https://www.exploit-db.com/exploits/36341 http://www.securityfocus.com/bid/50784 https://www.dognaedis.com/vulns/DGS-SEC-5.html https://www.dognaedis.com/vulns/DGS-SEC-6.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •