CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7491
https://notcve.org/view.php?id=CVE-2018-7491
In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors' values. En PrestaShop hasta la versión 1.7.2.5, se ha encontrado una vulnerabilidad de secuestro de clics que podría conducir a un impacto que cambia el estado en el contexto de un usuario o administrador. Esto se debe a que la función generateHtaccess function en classes/Tools.php no establece los valores ni de X-Frame-Options ni de 'Content-Security-Policy "frame-ancestors'. • http://forge.prestashop.com/browse/BOOM-4917 https://github.com/PrestaShop/PrestaShop/pull/8807 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2015-1175 – Prestashop 1.6.0.9 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-1175
Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the layered_price_slider parameter. Vulnerabilidad de XSS en blocklayered-ajax.php en el módulo blocklayered en PrestaShop 1.6.0.9 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro layered_price_slider. Prestashop version 1.6.0.9 suffers from a cross site scripting vulnerability. • http://octogence.com/advisories/cve-2015-1175-xss-prestashop http://packetstormsecurity.com/files/130026/Prestashop-1.6.0.9-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/534511/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/100013 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 0CVE-2012-6641
https://notcve.org/view.php?id=CVE-2012-6641
Cross-site scripting (XSS) vulnerability in redirect.php in the Socolissimo module (modules/socolissimo/) in PrestaShop before 1.4.7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to "parameter names and values." Vulnerabilidad de XSS en redirect.php en el módulo Socolissimo (modules/socolissimo/) en PrestaShop anterior a 1.4.7.2 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores relacionados con "nombres y valores de parámetros." • http://secunia.com/advisories/48036 http://www.prestashop.com/de/entwickler-versionen/changelog/1.4.7.2 http://www.securityfocus.com/bid/52962 https://exchange.xforce.ibmcloud.com/vulnerabilities/74773 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2012-2517 – PrestaShop 1.4.7 - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-2517
Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to ajax.php. Una vulnerabilidad de tipo cross-site scripting (XSS) en PrestaShop versiones anteriores a 1.4.9, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del índice del parámetro product[] en el archivo ajax.php. PrestaShop versions 1.4.7 and 1.4.8 suffer from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/37684 https://www.htbridge.com/advisory/HTB23091 https://www.prestashop.com/download/old/changelog_1.4.9.0.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 2CVE-2011-4545 – Prestashop 1.4.4.1 - 'displayImage.php' HTTP Response Splitting
https://notcve.org/view.php?id=CVE-2011-4545
CRLF injection vulnerability in admin/displayImage.php in Prestashop 1.4.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the name parameter. Vulnerabilidad de inyección CRLF en admin/displayimage.php en Prestashop v1.4.4.1 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de división de respuesta HTTP a través del parámetro name. • https://www.exploit-db.com/exploits/36345 http://www.securityfocus.com/bid/50785 https://www.dognaedis.com/vulns/DGS-SEC-7.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •