CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2013-4791
https://notcve.org/view.php?id=CVE-2013-4791
13 Feb 2020 — PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE. PrestaShop versión anterior a 1.4.11, permite a Logistician, translators y otras cuentas de perfil de nivel bajo inyectar un vector de tipo XSS persistente en TinyMCE. • http://davidsopaslabs.blogspot.com/2013/07/prestashop-persistent-xss-and-csrf.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2013-4792
https://notcve.org/view.php?id=CVE-2013-4792
13 Feb 2020 — PrestaShop before 1.4.11 allows logout CSRF. PrestaShop versión anterior a 1.4.11, permite un ataque de tipo CSRF del cierre de sesión. • http://davidsopaslabs.blogspot.com/2013/07/prestashop-persistent-xss-and-csrf.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2012-2517 – PrestaShop 1.4.7 - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-2517
11 Feb 2020 — Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to ajax.php. Una vulnerabilidad de tipo cross-site scripting (XSS) en PrestaShop versiones anteriores a 1.4.9, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del índice del parámetro product[] en el archivo ajax.php. • https://www.exploit-db.com/exploits/37684 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 4%CPEs: 1EXPL: 1CVE-2013-6358
https://notcve.org/view.php?id=CVE-2013-6358
23 Jan 2020 — PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory. PrestaShop versión 1.5.5, permite a atacantes autenticados remotos ejecutar código arbitrario mediante la carga de un perfil diseñado y luego accediendo a él en el directorio module/. • https://web.archive.org/web/20150423041900/http://labs.davidsopas.com/2013/10/how-salesman-could-hack-prestashop.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6632
https://notcve.org/view.php?id=CVE-2020-6632
09 Jan 2020 — In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php, themes/default/template/header.tpl, and themes/new-theme/js/header.js. En PrestaShop versión 1.7.6.2, una ataque de tipo XSS puede producirse durante la adición o eliminación de un enlace QuickAccess. Esto está relacionado con los archivos AdminQuickAccessesController.php, themes/default/template/header.tpl y themes/new-theme/js/header.js. • https://github.com/PrestaShop/PrestaShop/pull/17050/commits • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 7%CPEs: 3EXPL: 1CVE-2019-19594
https://notcve.org/view.php?id=CVE-2019-19594
05 Dec 2019 — reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file. En el archivo reset/modules/fotoliaFoto/multi_upload.php en la integración RESET.PRO Adobe Stock API para PrestaShop versiones 1.6 y 1.7, permite a atacantes remotos ejecutar código arbitrario cargando un archivo .php. • https://ia-informatica.com/it/CVE-2019-19594 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 7%CPEs: 3EXPL: 1CVE-2019-19595
https://notcve.org/view.php?id=CVE-2019-19595
05 Dec 2019 — reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file. El archivo reset/modules/advanced_form_maker_edit/multiupload/upload.php en la integración de RESET.PRO Adobe Stock API versión 4.8 para PrestaShop, permite a atacantes remotos ejecutar código arbitrario cargando un archivo .php. • https://ia-informatica.com/it/CVE-2019-19595 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2019-13461
https://notcve.org/view.php?id=CVE-2019-13461
09 Jul 2019 — In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop bug #14444. En PrestaShop versiones anteriores a 1.7.6.0 RC2, los parámetros id_address_delivery y id_address_invoice se ven afectados por una vulnerabilidad de Referencia de Objeto Directa no Segura debido a un... • https://assets.prestashop2.com/en/system/files/ps_releases/changelog_1.7.6.0-rc2.txt • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2019-11876
https://notcve.org/view.php?id=CVE-2019-11876
24 May 2019 — In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link. En PrestaShop versión 1.7.5.2, el parámetro shop_country en el archivo install/index.php la instalación script/component se ve afectado por una vulnerabilidad Reflected XSS. la explotación por parte de un actor ma... • https://www.logicallysecure.com/blog/xss-presta-xss-drupal • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 1CVE-2018-20717
https://notcve.org/view.php?id=CVE-2018-20717
15 Jan 2019 — In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process and abuse an object chain in order to gain Remote Code Execution. This occurs because protection against serialized objects looks for a 0: followed by an integer, but does not consider 0:+ followed by an integer. En la sección de pedidos de PrestaShop, ... • https://blog.ripstech.com/2018/prestashop-remote-code-execution • CWE-94: Improper Control of Generation of Code ('Code Injection') •